Network Autonomous Wireless Location System

• US 20100273504A1
• Filed: 04/22/2009
• Published: 10/28/2010
• Est. Priority Date: 04/22/2009
• Status: Active Grant

• Current Assignee: Skyhook Holding, Inc. (Liberty Broadband Corp.)
• Original Assignee: TruePosition Incorporated
• Inventors: Ward, Matthew L., Bull, Jeffrey F.
• Granted Patent: US 8,213,957 B2
• Time in Patent Office: Days
• US Class Current: 455/456.100
• CPC Class Codes: G01S 19/46 the supplementary measurement being of a radio-wave signal type
• CPC Class Codes: G01S 5/0249 Determining position using measurements made by a non-stationary device other than the device whose position is being determined
• CPC Class Codes: H04K 2203/16 for telephony
• CPC Class Codes: H04K 3/65 using deceptive jamming or spoofing, e.g. transmission of false signals for premature triggering of RCIED, for forced connection or disconnection to/from a network or for generation of dummy target signal

Abstract

A Network Autonomous Wireless Location System (NAWLS) is designed to allow for precise location of a mobile device (e.g., a cell phone) without interconnection to, and with minimal disruption of, the local wireless communications network. Using distributed radio network monitors (RNM) and a managed network emulator (NE); mobile devices are sampled, acquired or captured. Once triggered by the RNM or NE, an untethered wireless location system (U-WLS) is used to calculate a precise location. The U-WLS; comprising mobile receiver sites, each capable of self location, exchanging information with other components of the NAWLS, and receiving or exchanging signals from the mobile device; utilizes various network-based and handset-based wireless location techniques dependent on the deployed options. In addition, the NAWLS includes data links interconnecting the U-WLS, NE and RNM.

Claims

1. A network autonomous wireless location system (NAWLS) configured to locate a mobile device, said mobile device having a wireless communications transceiver for communicating with a wireless communications network (WCN), said NAWLS comprising:

a) a radio network monitor (RNM) configured to passively monitor two or more radio air interfaces;

b) a network emulator (NE) configured to emulate one or more WCN, said one or more WCN possessing one or more radio air interfaces; and

c) an untethered wireless location system (U-WLS), said U-WLS comprising a plurality of mobile receiver sites, wherein each said mobile receiver site includes a receiver configured to receive uplink radio signals from said mobile device, and means for determining a precise location and velocity for the mobile receiver site, said U-WLS configured to determine a precise location and velocity of the mobile device from radio signal information received by said plurality of mobile receiver sites.

2. A system as recited in claim 1, wherein the said precise location includes a longitude, latitude and altitude.

3. A system as recited in claim 1, wherein said radio air interfaces include first and second downlink beacons, wherein said first and second downlink beacons comprise broadcast control channel (BCCH) beacons.

4. A system as recited in claim 1, wherein each of the means for determining a precise location and velocity of the mobile receiver site comprises a global navigation satellite system (GNSS) receiver configured to receive GNSS signals.

5. A system as recited in claim 1, wherein the said mobile receiver sites further comprises antennae and receivers configured to receive GNSS signals for the purpose of time synchronization.

6. A system as recited in claim 1, wherein the said mobile receiver sites further comprises antennae and receivers configured to receive GNSS signals for the purpose of frequency synchronization.

7. A system as recited in claim 1, wherein the said mobile receiver sites further comprises antennae and receivers configured to receive GNSS signals for the purpose determining the location of the mobile receiver site.

8. A system as recited in claim 1, wherein each of the means for determining a precise location and velocity of the mobile receiver site comprises a radio receiver configured to receive terrestrial radio broadcast timing signals.

9. A system as recited in claim 1, wherein the said mobile receiver sites further comprises antennae and receivers configured to receive radio broadcast timing signals for the purpose of time synchronization.

10. A system as recited in claim 1, wherein the said mobile receiver sites further comprises antennae and receivers configured to receive radio broadcast timing signals for the purpose of frequency synchronization.

11. A system as recited in claim 1, wherein the said mobile receiver sites further comprises antennae and receivers configured to receive radio broadcast timing signals for the purpose of determining the location of the mobile receiver site.

12. A system as recited in claim 1, wherein said radio air interfaces comprises a first radio access network (RAN) technology and a second RAN technology.

13. A system as recited in claim 1, wherein said radio air interfaces comprises a first radio access network (RAN) technology, a second RAN technology and an emulated radio air interface.

14. A system as recited in claim 13, wherein said emulated radio air interface comprises a first radio access network (RAN) technology and a second RAN technology.

15. A system as recited in claim 3, wherein said first downlink beacon comprises a first radio access network (RAN) technology and said second downlink beacon comprises a second RAN technology.

16. A system as recited in claim 15, wherein said first RAN technology comprises GSM and said second RAN technology comprises at least one of UMTS, LTE, WiMAX, and CDMA.

17. A system as recited in claim 1, wherein said NE is configured to provide an independent wireless communications network, emulating both the RAN and CN networks.

18. A system as recited in claim 17, wherein said NE is further configured to provide an emulated downlink beacon.

19. A system as recited in claim 18, wherein said emulated downlink beacon is configured to actively acquire the mobile device.

20. A system as recited in claim 1, wherein said NE is configured to supply, on an individual mobile device basis, a second mobile uplink and downlink signaling paths to the mobile device, for use in cases where a traffic/data channel allocation is necessary to identify, locate or silence the mobile device.

21. A system as recited in claim 1, wherein said U-WLS provides at least one of the following location technologies to locate the mobile device using uplink transmissions from the mobile device:

Time-of-Arrival (TOA), uplink time-difference-of-arrival (U-TDOA), angle-of-arrival (AoA), and hybrid TDOA/AoA location technologies.

22. A system as recited in claim 21, wherein said U-WLS is further configured to provide location server functionality for handset-based location techniques.

23. A system as recited in claim 22, wherein said handset-based location techniques include at least one member of the following group:

Enhanced Observed Time Difference (E-OTD), Observed Time Difference of Arrival (OTDOA), A-GNSS (Assisted Global Navigation Satellite System), and a hybrid technique including U-TDOA/A-GNSS.

24. A system as recited in claim 23, wherein said A-GNSS is the Navstar Global Positioning System.

25. A system as recited in claim 1, wherein said U-WLS is connected to the NE via a digital data link, wherein said U-WLS is configured to use said data link to inform the NE that a location has been completed, that additional power is needed to locate the mobile device, that an inter-RAT (radio access technology) handoff is needed, and/or that allocation to a traffic channel is needed.

26. A system as recited in claim 1, wherein said Network Emulator is connected to the U-WLS via a digital data link, wherein said NE is configured to use said data link to trigger and task the U-WLS perform a location based on a Network Transaction trigger.

27. A system as recited in claim 26, wherein said digital data link is further configured for use by the U-WLS and NE to employ on-board location technology resident on the mobile device.

28. A system as recited in claim 1, wherein said RNM comprises a passive software defined radio receiver configured to receive uplink and downlink transmissions from the mobile device, the RAN and the NE.

29. A system as recited in claim 1, wherein said RNM comprises a set of receivers and is connected to the U-WLS via a digital data link allowing the RNM to task the U-WLS to locate the mobile device when said mobile device is involved in a radio transaction.

30. A system as recited in claim 1, wherein said NE comprises a set of transceivers and servers and is connected to the U-WLS via a digital data link allowing the NE to task the U-WLS to locate the mobile device when said mobile device is involved in a network transaction.

31. A system as recited in claim 30, wherein said digital data link includes a wireless connection, and wherein said network transaction includes messaging for at least one member of the following group:

Mobile Origination, Mobile Termination, Location Update, Cell Change Command, AnyTimeInterrogation, SMS Origination, SMS Termination, Periodic Registration, and Identity Request.

32. A system as recited in claim 1, wherein said RNM is connected to said NE via a digital data link allowing the RNM to inform the NE of broadcast control channel (BCCH) frequency, power levels and informational content.

33. A system as recited in claim 32, wherein said RNM is further configured to monitor NE-emulated downlink beacon and second mobile uplink and downlink signals to detect interference and to cause the NE to reduce a broadcast radio power level and to reduce power levels of emulated uplink and downlink signals.

34. A system as recited in claim 1, comprising an aerial component providing radio relay service between mobile cell sites.

35. A system as recited in claim 34, wherein said aerial component further provides airborne imaging.

36. A system as recited in claim 34, wherein said aerial component further serves as a mobile cell site platform providing extended coverage and three dimensional receiver diversity for location calculation.

37. A system as recited in claim 34, wherein said aerial component further serves as a mobile cell site platform providing extended coverage and three dimensional receiver diversity for location and velocity calculation.

38. A system as recited in claim 1, further comprising means for adjusting the transmission power of the NE to minimize interference while optimizing broadcast power.

39. A system as recited in claim 38, further comprising means for adjusting the transmitted information.

40. A system as recited in claim 39, wherein the means for adjusting the transmitted information enables optimization of the rate of mobile device signal sampling by balancing sampling network capabilities while minimizing communication network impacts.

41. A method for locating a mobile device having a wireless communications transceiver for communicating with a local wireless communications network including a radio access network (RAN) and a core network (CN), comprising:

using a Network Autonomous Wireless Location System (NAWLS) to collect mobile-specific information, including temporary and permanent identifiers, via radio messaging without using a wired connection to the local wireless communications network; and

locating said mobile device using uplink signals transmitted by said mobile device.

42. A method as recited in claim 41, wherein said NAWLS comprises a network of interconnected network emulators (NEs) configured for capturing a GSM mobile from an operating commercial GSM network by emulating said network, determining the distance that the captured GSM mobile is from a first NE via the timing advance (TA) parameter, handing over the captured GSM mobile to a second NE, determining the distance that the captured GSM mobile is from the second NE via the TA parameter, handing over the captured GSM mobile to a third NE, determining the distance that the captured GSM mobile is from the third NE via the TA parameter, and determining the location of the captured mobile with a time-of-arrival (TOA) geolocation technique.

43. A method as recited in claim 41, wherein said NAWLS comprises a network of interconnected network emulators (NEs) configured for capturing a UMTS mobile from an operating GSM network by emulating said network, determining the distance that the captured UMTS mobile is from a first NE via the Round Trip Time (RTT) parameter modified by a Rx-Tx time from the captured UMTS mobile, determining the distance that the captured UMTS mobile is from a second NE from another RTT parameter when the captured UMTS mobile is in soft handover or is handed over to a second NE, determining the distance that the captured UMTS mobile is from a third NE from another RTT parameter when the captured mobile is in soft handover or is handed over to the third NE, and determining the location of the captured UMTS mobile with a TOA location technique.

44. A method as recited in claim 41, wherein said NAWLS includes an untethered WLS (U-WLS) comprising a set of geographically distributed receivers and mobile location servers coupled with one or more network emulator (NE) transceivers, and said U-WLS is employed to determine the identity and location of mobile GSM and multi-mode mobile devices without physical connection to the local wireless communications network.

45. A method as recited in claim 41, wherein NAWLS is operated to minimize disruption of the local wireless communications network by monitoring the wireless communications network and NE and adjusting NE transmissions and parameters as needed.

46. A method as recited in claim 41, wherein the NAWLS is used to generate ad hoc geo-fenced areas.

47. A method as recited in claim 41, further comprising generating ad hoc quiet zones where subscriber service is limited or denied.

48. A method as recited in claim 41, further comprising capturing a GSM mobile phone from an operating commercial GSM wireless network by emulating said network, causing a successful Location Update and providing false paging channel and neighbor cell information while determining the location of said GSM mobile phone by geolocating on a Location Update control channel transmission of said mobile phone.

49. A method as recited in claim 41, further comprising acquiring a GSM mobile phone from an operating commercial GSM wireless network by emulating said network and determining the location, speed and heading of said GSM mobile phone by geolocating on a Location Update control channel transmission of said mobile phone.

50. A method as recited in claim 41, further comprising acquiring a GSM mobile phone from an operating commercial GSM wireless network by emulating said network and determining the identity, TMSI, IMSI and IMEI, of said mobile phone through the use of an Iden_Req message.

51. A method as recited in claim 41, further comprising denying wireless service to a GSM mobile phone from an operating commercial GSM wireless network by emulating said network, capturing said mobile phone, determining the identity of said mobile phone, and assigning it to a silent traffic channel.

52. A method as recited in claim 41, further comprising denying wireless service to a GSM mobile phone from an operating GSM wireless network by emulating said network, capturing said mobile phone, determining the location of said mobile phone, determining that the mobile phone is in a defined cold zone geographic are, and putting it on a silent traffic channel.

53. A method as recited in claim 41, further comprising determining whether to deny wireless service to a GSM mobile phone from an operating GSM wireless network by emulating said network, capturing said mobile phone, determining its location, verifying it is located in a cold zone, determining its identity, checking to see if its identifying information is on an allowed list and putting it on a silent traffic channel if its identifying information is not on an allowed list.

54. A method as recited in claim 41, further comprising locating a GSM mobile phone on a traffic channel (TCH) serviced by an operating commercial GSM wireless network, without direct physical connection to said GSM network by emulating said network, capturing said mobile phone, assigning it to a silent traffic channel, and determining its location on the traffic channel with TOA, POA, U-TDOA, AoA, ECID, PDOA, CGI+TA, or any combination thereof.

55. A method as recited in claim 41, further comprising locating a GSM mobile phone operating on a GSM network that possesses a GPS or AGPS receiver in it by emulating said network, capturing said mobile, assigning it to a silent traffic channel, and requesting the position of the mobile phone from its internal GPS receiver.

56. A method as recited in claim 41, further comprising determining the location of a mobile phone operating on a commercial UMTS network without a direct physical connection to said network by emulating said network and determining the location of said mobile by geolocating on a Location Update control channel transmission of said mobile phone.

57. A method as recited in claim 41, further comprising determining the identity of a UMTS/GSM mobile phone operating on a UMTS network without physical connection to that network by emulating the UMTS network, capturing said mobile phone, commanding it to move to the emulated GSM network, and determining its mobile identity with an Identity Request (Iden_Req) command.

58. A method as recited in claim 41, further comprising denying wireless service to a UMTS/GSM mobile phone from an operating commercial UMTS wireless network without a physical connection to any wireless networks by emulating said network, capturing said mobile phone, commanding said mobile phone to move to the emulated GSM network, determining the identity of said mobile phone, and assigning it to a silent traffic channel.

59. A method as recited in claim 41, further comprising determining the location of a mobile phone operating on a commercial UMTS network without a direct physical connection to said network by emulating said network and determining the location of said mobile phone by geolocating on a Location Update control channel transmission of said mobile phone, commanding the mobile phone to move to an emulated GSM network, moving said mobile phone to a GSM traffic channel and geolocating it again.

60. A method as recited in claim 41, further comprising locating a UMTS/GSM mobile phone operating on a UMTS network that possesses a GPS or AGPS receiver in it by emulating said UMTS network, capturing said mobile phone, commanding it to move to a emulated GSM network, assigning it to a silent traffic channel, requesting the position of the mobile phone from its internal GPS receiver.

61. A method as recited in claim 41, further comprising receiving and demodulating uplink transmissions from wireless devices operating on GSM networks, both unencrypted and encrypted, and storing them to a high speed database for further analysis.

62. A method as recited in claim 41, further comprising locating a GSM mobile phone on a traffic channel in a GSM network without any physical connection to said network by receiving and demodulating uplink and downlink transmissions from said mobile phone and said GSM network, and storing to a database, decrypting appropriate demodulated transmission and locating said mobile phone with decrypted information via TOA, POA, U-TDOA, AoA, ECID, PDOA, CGI+TA, or any combination thereof.