IN THE UNITED STATES PATENT AND TRADEMARK OFFICE BEFORE THE PATENT TRIAL AND APPEAL BOARD

Transcription

1 IN THE UNITED STATES PATENT AND TRADEMARK OFFICE BEFORE THE PATENT TRIAL AND APPEAL BOARD In the Inter Partes Review of: ) ) Trial Number: To be assigned U.S. Patent No.: 7,126,940 ) ) Attorney Docket No.: Filed: October 23, 2001 ) ) Issued: October 24, 2006 ) Panel: To be assigned ) Title: POSITIONING A ) TERMINAL IN A PACKET-SWITCHED ) MOBILE TELEPHONE NETWORK ) Mail Stop Patent Board Patent Trial and Appeal Board P.O. Box 1450 Alexandria, VA PETITION FOR INTER PARTES REVIEW OF U.S. PATENT NO. 7,126,940 PURSUANT TO 35 U.S.C AND 37 C.F.R. 42

2 TABLE OF CONTENTS Table of Contents Attorney Docket No Page I. MANDATORY NOTICES UNDER 37 C.F.R. 42.8(a)(1)... 1 A. Real Party-In-Interest Under 37 C.F.R. 42.8(b)(1)... 1 B. Related Matters Under 37 C.F.R. 42.8(b)(2)... 1 C. Lead and Back-Up Counsel Under 37 C.F.R. 42.8(b)(3)... 1 D. Service Information Under 37 C.F.R. 42.8(b)(4)... 1 II. PAYMENT OF FEES UNDER 37 C.F.R III. SUMMARY OF THE 940 PATENT... 2 A. Technology Background... 2 B. Description of the 940 Patent... 4 C. Priority Date of the 940 Patent IV. REQUIREMENTS FOR INTER PARTES REVIEW UNDER 37 C.F.R A. Grounds for Standing Under 37 C.F.R (a) B. Identification of Challenge Under 37 C.F.R (b) and Relief Requested C. How the Challenged Claim(s) Are to Be Construed (37 C.F.R (b)(3)) D. How the Construed Claim(s) Are Unpatentable (37 C.F.R (b)(4)) V. BRIEF DESCRIPTION OF PRIOR ART RELIED UPON A. The Ericsson Proposal to ETSI ( the Ericsson Proposal ) B. The TS V0.0.2 Draft Specification ( the TS Draft Specification") C. Admitted Prior Art in the 940 Patent VI. DETAILED EXPLANATION OF PERTINENCE AND MANNER OF APPLYING CITED PRIOR ART TO EVERY CLAIM FOR WHICH REVIEW IS REQUESTED UNDER 37 C.F.R (b) i

3 A. Claims 1-25 of U.S. Patent No. 7,126,940 are obvious over the Ericsson Proposal in view of the Admitted Prior Art in U.S. Patent No. 7,126, B. Claims 1-25 of U.S. Patent No. 7,126,940 are obvious over the TS Draft Specification in view of the Admitted Prior Art in U.S. Patent No. 7,126, VII. CONCLUSION ii

4 LIST OF EXHIBITS Exhibit No. Exhibit 1001 U.S. Patent No. 7,126, G TS v G TS v G TS v Ericsson Proposal 1006 Application As-filed 1007 Office Action dated January 25, Response dated May 27, Final Office Action dated August 16, 2005 Attorney Docket No Response After Final Action dated November 16, Advisory Action dated January 9, RCE dated June 19, Expert Declaration of Tim A. Williams, PhD. iii

5 Inter partes review is respectfully requested for claims 1-25 of U.S. Patent No. 7,126,940 ( the 940 Patent ) [Ex. 1001]. I. MANDATORY NOTICES UNDER 37 C.F.R. 42.8(a)(1) 1. The following mandatory notices are provided as part of this Petition. A. Real Party-In-Interest Under 37 C.F.R. 42.8(b)(1) 2. The real-party-in-interest for this Petition is ZTE (USA) ( Petitioner ). B. Related Matters Under 37 C.F.R. 42.8(b)(2) 3. The 940 Patent is not the subject of any other judicial or administrative matter that would affect, or be affected by, a decision in this proceeding. C. Lead and Back-Up Counsel Under 37 C.F.R. 42.8(b)(3) 4. Petitioner provides the following designation of counsel. Lead Counsel Steven A. Moore (Reg. No. 55,462) PILLSBURY WINTHROP SHAW PITTMAN LLP Postal and Hand Delivery Address 501 W. Broadway Suite 1100 San Diego, CA Telephone: Facsimile: steve.moore@pillsburylaw.com Back-Up Counsel Richard W. Thill (Reg. No. 53,686) PILLSBURY WINTHROP SHAW PITTMAN LLP Postal and Hand Delivery Address 501 W. Broadway Suite 1100 San Diego, CA Telephone: Facsimile: richard.thill@pillsburylaw.com; D. Service Information Under 37 C.F.R. 42.8(b)(4) 5. Service of any documents via hand-delivery may be made at the postal mailing addresses of the respective lead or back-up counsel designated above with

6 courtesy copies to the addresses Petitioner consents to electronic service. II. PAYMENT OF FEES UNDER 37 C.F.R The undersigned authorizes the Office to charge Deposit Account No for the fee set forth in 37 C.F.R (a) for this Petition for Inter Partes Review. The undersigned further authorizes payment for any additional fees that might be due in connection with this Petition to be charged to the above-referenced Deposit Account. III. SUMMARY OF THE 940 PATENT 7. The following information is supported by the Declaration of Tim A. Williams, Ph.D. ( Williams Declaration ) [Ex. 1013]. A. Technology Background 1. The 940 Patent [Ex. 1001] describes a system and method for locating a mobile station (MS) in a mobile telephone network that combines packet-switched data resources and circuit-switched location services. The network consists of a core network element, base stations, a base station controller and the mobile station. The system also includes a location unit for determining the location of the mobile terminal, which has a circuit-switched connection to the base station controller. The base station controller has dual functionality that enables it to 2

7 process both circuit-switched (connection-based) and packet-switched (connectionless) messages. [ABSTRACT] 2. In the relevant time frame (circa ), the provision of location services in circuit-switched GSM networks was well-established. 1 In 2000, GPRS (General Packet Radio Service) added packet-switched functionality to GSM, but before that the European Telecommunications Standards Institute (ETSI) had working groups to address the provision of location services in combined GSM/GPRS networks. In particular, the 3GPP TSG GERAN (GSM/EDGE Radio Access Network) working group held a meeting in Seattle, Washington from August 28 through September1, 2000, where on August 31, 2000, Nokia, Ericsson, Seimens, Motorola and Qualcomm jointly submitted a draft specification TS v0.0.1, 2 titled Stage 2 Description of Location Services in GERAN (R00), [Ex. 1002] adopted as version [Ex. 1003] with minor revisions, 3 and later released as 3G TS v [Ex. 1004] in November The original 1 See, e.g., ETSI TS v7.0.0, Digital cellular telecommunications system (Phase 2+); Location Services (LCS); (Functional description) Stage 2 (GSM version Release 1998), available at: 24v070000p.pdf 2 Available at: - /ftp/tsg_geran/tsg_geran/geran_01_seattle/docs/gp zip 3 Available at: HOCs/LCS/Docs/GAHL zip 4 Available at: 3

8 4 Attorney Docket No draft (ver ) was published two months before the priority date of the 940 Patent. At a subsequent meeting in Dallas, Texas from October 24-27, 2000 (3GPP TSG GERAN LCS Ad hoc #1), Ericsson submitted an independent proposal 5 [Ex. 1006] for location services protocol stacks and signal flows, titled Stage Two input for LCS in GPRS, for potential inclusion in TS The Dallas meeting dates overlap the foreign priority date of the 940 Patent. B. Description of the 940 Patent 3. The 940 Patent describes the operation of location services in prior art circuit-switched networks, using GSM as an example. In GSM systems, a network element known as a Serving Mobile Location Center (SMLC) is used to process location requests originated by the mobile station (Mobile Originated Location Request MOLR) or by an external client (Mobile Terminated Location Request MTLR). The SMLC is responsible for managing the overall coordination and scheduling of resources required to determine the location of a mobile station. In response to either type of request, two SCCP (Signaling Connection Control Part) connections are opened. SCCP includes provisions for exchanging messages required for determining the location of the mobile station. One SCCP connection is between the MSC (Mobile Switching Center) and the BSC (Base Station Controller), and another SCCP connection is between the BSC and the SMLC 5 Available at: HOCs/LCS/Docs/GAHL zip

9 (Serving Mobile Location Centre). The interface between the SMLC and the BSC is known as the Lb interface. Each SCCP connection has its own identifier (SCCP Connection ID) that can be used to establish an association. 4. After opening these two SCCP connections, it is possible to pass a location request to the SMLC. The BSC forwards the positioning messages between the mobile station and SMLC over the radio interface. The same connection can also be used to pass BSSLAP (Base Station Subsystem Link Access Protocol) messages between the SMLC and the base station serving the mobile station. [2:20-52] 5. In a packet-switched network, such as the GPRS (General Packet Radio Service), the BSC has a packet-switched interface (Um interface) with the MS and a packet-switched interface (Gb interface) with core network element called the Serving GPS Support Node (SGSN), while the interface (Lb interface) between the BSC and the SMLC remains a circuit-switched link that cannot process packetbased messages. The problem addressed by the 940 Patent is how to use the legacy circuit-switched Lb interface between the SMLC and the BSC for location services while supporting packet-based location service messages between the BSC and the SGSN. [2:53-4:5] The novelty of the 940 Patent is converting packet-switched message formats to circuit-switched message formats (and vice versa) in the base station controller. 5

10 6. FIG. 1B of the 940 Patent illustrates a typical (i.e., prior art) structure of a packet-switched radio system, together with its interfaces to the fixed telephone network (PSTN) and the packet transmission network (GPRS). [5:28-36] 7. In FIG. 1B, a subscriber terminal 150 has a cellular radio link 170 to a Base Station 100. The Base Station is linked to a Base Station Controller (BSC) 102. Together, the Base Station and the Base Station Controller are referred to as the Base Station System (BSS). [6:1-9] 8. The Base Station 100 includes a multiplexer (MUX) 116, several transceivers (TRXn) 114, and a control unit (CNTL) 118 that controls the operation of the transceivers and multiplexer. The multiplexer is used to place the traffic and control channels used by the transceivers into the transmission channel 160. [6:10-14] 9. The BSC 102 includes a switching matrix 120 and a control unit 124. The switching matrix is used for switching voice and data and for connecting signaling circuits. The control unit 124 performs call control, mobility management, gathering of statistical information, and signaling. 10. The physical structure of the BSC 102 and the Base Station 100, as well as the division of tasks between them, can vary depending on the implementation. Typically, the Base Station is responsible for the implementation of the radio link. The BSC typically manages the radio resources, and controls channel switching 6

11 between cells, power regulation, timing and synchronization, and paging the subscriber terminal. [6:27-34] 11. The switching matrix 120 can be used to make connections into the Public Switched Telephone Network (PSTN) 134 via the Mobile Switching Center (MSC) 132, and into a packet transmission network, such as the GPRS network 142 shown in FIG. 1B. Packet transmission is carried out via a data communications network 146 (e.g., the Internet), from a computer 152 connected to the subscriber terminal 150. [6:56-65] 12. The connection between the packet transmission network 142 and switching matrix 120 is established by a Serving GPRS Support Node (SGSN) 140. The purpose of the support node is to transfer packets between the base station system and a gateway node 144, a Gateway GPRS Support Node (GGSN) in the case of a GPRS network, and to keep track of the position of subscriber terminal 150 within its operating area. [7:5-12] 13. The gateway node 144 connects the public packet transmission network 146 with the private packet transmission network 142. [7:13-27] 14. FIG. 1D shows how a packet-switched transmission channel is established between the subscriber terminal 150 and the GPRS network The bold line shows the flow of transmitted data to/from the server computer 148 to the portable computer 152. The data flows through the system in the air 7

12 interface, also known as the Um interface 170, from the antenna 112 to the transceiver 114, and from there multiplexed in the multiplexer 116 through the transmission channel (reference 160 in FIG. 1B) in the Abis interface to the switching matrix 120, where a connection is established to the output going into the Serving GPRS Support Node 140 at the Gb interface. From the support node 140, the data is transmitted via the packet transmission network 142 through the gateway node 144, and connected to the public packet transmission network 146 and its server computer 148. [7:46-65] 16. FIG. 1D also shows the components of the packet-switched core network (CN). In addition to the support node 140, the packet transmission network 142 and the gateway node 144, the core network also includes a Gateway Mobile Location Center (GMLC) 186 and a Home Location Register (HLR) 184. [8:5-13] 17. The purpose of the Gateway Mobile Location Center 186 is to provide location service to an external client 188. The Home Location Register 184 includes subscriber data and routing information for the location service. An additional location service device shown in FIG. 1D includes the Serving Mobile Location Center (SMLC) 182, which can reside in the base station controller (labeled RNC in Fig. 1D for Radio Network Controller ) in its control component 124. It can also be a separate device connected to either the base station controller or the support node 140. [8:14-22] 8

13 18. FIG. 2 illustrates the protocol stacks used in the GPRS network elements, which include the mobile station (MS), the base station system (BSS) that includes both the base station (BS) and base station controller (BSC), the Serving GPRS Support Node (SGSN) and the Serving Mobile Location Center (SMLC). The protocol stacks conform to the ISO (International Standardization Organization) OSI (Open Systems Interconnection) model. The base station and the base station controller are not shown separately, because no interface has been defined between them. The protocol processing assigned to base station system BSS can thus in principle be freely distributed between the base station 100 and the base station controller 102. [8:62-9:1][emphasis added] 19. FIG. 4 illustrates the signaling sequence used to locate the MS. The process begins when a request for LoCation Services (LCS) is sent to the SGSN, either a request 401 from the mobile station or a request 400 from another network element or external client (e.g., LCS Client 188). 20. After receiving the request, the SGSN sends a Base Station System GPRS Protocol (BSSGP) message (402) to the Packet Control Unit (PCU), which is the packet-switched functionality of the base station controller (BSC). The BSSGP message includes TLLI (Temporary Logical Link Identity) and BVCI (BSSGP Virtual Connection Identifier) information. The BVCI indicates the cell where the mobile terminal is in operation. 9

14 21. The PCU examines the BSSGP message and, if it is a location message, converts it to the BSSAP-LE protocol (BSS Application Part Location Extensions) so that the circuit-switched functionality of the base station controller can forward the message (403) to the SMLC by means of a Signaling Connection Control Part (SCCP) connection established for the message. 22. Next, the location request message is passed to the SMLC via the SCCP connection using the BSSAP-LE protocol. The SMLC receives the location request message through the SCCP connection, which includes the BSSAP-LE message. The SMLC then carries out the location request. The SMLC can initiate return communication in the direction of the MS through the base station controller using the SCCP connection. The base station controller knows the association between the SCCP connection and the corresponding packet connection by means of the TLLI, so it can initiate communication with the appropriate terminal. This communication is used to determine location using the requested method (e.g., GPS, cell triangulation), and the location information is returned by means of a BSSAP-LE message (405) through the SCCP connection. 23. Next, the BSC converts the message to a BSSGP message (406) so that the packet-switched functionality of the PCU can transmit the message 406 to the SGSN. Lastly, the SGSN forwards the returned information to the requester. 10

15 24. FIG. 5 is a block diagram of the base station controller 501 used to implement the association between packet-switched and circuit-switched messages. The base station controller 501 includes a PCU protocol stack 502 for packet-switched functionality and a BSC protocol stack 503 for circuit-switched functionality. The base station controller communicates with the SGSN 504, using the PCU protocol stack 502, and communicates with the SMLC location server 505 using the BSC protocol stack 503. The base station controller 501 also communicates with the mobile station MS through the air interface (not shown in FIG. 5). 25. A control unit 506 controls the association of packet-switched messages with circuit-switched messages in the base station controller. The control unit 506 stores the identification data of packet-switched messages and circuit-switched messages related to a certain connection into a storage device 507 to establish the association. The association can be implemented as a table, as shown in FIG. 5, where each packet-switched connection identifier TLLI1, TLLI2, TLLI3, etc. is mapped to a circuit-switched connection identifier SCCP-ID1, SCCP-ID2, SCCP- ID3, etc. 26. When a packet-based location message from the SGSN 504 is received at the PCU protocol stack 502, the control unit 506 maps the message to the corresponding circuit-switched message, using the table 507, and sends the 11

16 converted message to the BSC protocol stack 503 for transmission to the SMLC 505. The reverse process is used when a circuit-switched message from the SMLC 505 is received at the BSC protocol stack 503. This mapping is the central concept of the claimed invention. 27. FIG. 6 shows the connection between the base station system (labeled GERAN using standard GPRS notation) and the SMLC over the Lb interface using the SS7 protocol. The first layer L1, is the physical layer. The MTP protocol layer is used for transmission of messages between the location center (SMLC) and the base station controller (that is, the circuit-switched functionality of the base station controller). The SCCP layer implements a virtual connection between the corresponding layers. The preferred implementation of the third layer L3 is according to the BSSAP-LE protocol, and serves as the transmission protocol for the application layers (not shown).summary of the Prosecution History of the 940 Patent 8. The application [Ex. 1006] that led to the 940 Patent was filed on C. Priority Date of the 940 Patent 9. The claimed priority date of the 940 Patent is October 24, 2000 IV. REQUIREMENTS FOR INTER PARTES REVIEW UNDER 37 C.F.R

17 10. As set forth below and pursuant to 37 C.F.R , each requirement for inter partes review of the 940 patent is satisfied. A. Grounds for Standing Under 37 C.F.R (a) 11. Petitioner hereby certifies that the 940 Patent is available for inter partes review and that the Petitioner is not barred or estopped from requesting inter partes review challenging the claims of the 940 Patent on the grounds identified herein. More particularly, Petitioner certifies that: (1) Petitioner is not the owner of the 940 Patent; (2) Petitioner has not filed a civil action challenging the validity of a claim of the 940 Patent; (3) this Petition is filed less than one year after the date on which the Petitioner, the Petitioner s real party-in-interest, or a privy of the Petitioner was served with a complaint alleging infringement of the 940 Patent; (4) the estoppel provisions of 35 U.S.C. 315(e)(1) do not prohibit this inter partes review; and (5) this Petition is filed after the later of (a) the date that is nine months after the date of the grant of the 940 patent or (b) the date of termination of any post-grant review of the 940 Patent. B. Identification of Challenge Under 37 C.F.R (b) and Relief Requested 12. The precise relief requested by Petitioner is that claims 1-25 of the 940 Patent be found unpatentable. 13. Inter partes review is requested in view of the following references: 13

18 Country of Pat./Pub. Reference Date of issuance or Ex. Origin Number publication U.S. 7,126,940 June 6, U.S. U.S. Ericsson Proposal TS v0.0.2 Specification October 24, August 31, The material relied upon in the 940 Patent is admitted prior art. The Ericsson Proposal qualifies as a prior art publication under 35 USC 102(a). The TS reference qualifies as a prior art publication under 35 USC 102(a). The following specific grounds of rejection are asserted under 35 USC 103: Count 1: Claims 1-25 are invalid under 35 U.S.C. 103(a) as obvious over the Ericsson Proposal in view of the admitted prior art ( APA ) in the 940 Patent. Count 2: Claims 1-25 are invalid under 35 U.S.C. 103(a) as obvious over the TS Draft Specification in view of the admitted prior art in the 940 Patent ( APA ). C. How the Challenged Claim(s) Are to Be Construed (37 C.F.R (b)(3)) 15. A claim in inter partes review is given the broadest reasonable construction in light of the specification. See 37 C.F.R (b); In re ICON Health and Fitness, Inc., 496 F.3d 1374, 1379 (Fed. Cir. 2007) ( [T]he PTO must give claims their broadest reasonable construction consistent with the specification. Therefore, 14

19 we look to the specification to see if it provides a definition for claim terms, but otherwise apply a broad interpretation. ). For the purpose of this proceeding, and in accordance with the Expert Declaration of Dr. Tim A. Williams ( the Williams Declaration ), claim terms are presumed to take on their broadest reasonable interpretation to a person of ordinary skill in the art except as defined in the following table. CLAIM TERM core network (claim 19) core network element (claims 5 & 12) network element configured for both circuit-switched messages and packetswitched messages (claims 1, 12 & 18) CONSTRUCTION elements of the network outside of the UMTS (Universal Mobile Telephone System) including the support node [SGSN], the packet transmission network [GPRS network] and the gateway node [GGSN], a Gateway Mobile Location Center (GMLC) and a Home Location Register (HLR) a Serving GPRS Support Node (SGSN). one or more network elements for converting between a circuit-switched message format and a packet-switched message format. D. How the Construed Claim(s) Are Unpatentable (37 C.F.R (b)(4)) 16. An explanation of how the construed claims 1-25 of the 940 patent are unpatentable under the statutory grounds identified above, including identification of where each element of the claim is found in the prior art patents or printed publications is provided in Section VI, below. 15

20 V. BRIEF DESCRIPTION OF PRIOR ART RELIED UPON A. The Ericsson Proposal to ETSI ( the Ericsson Proposal ) 17. The Ericsson Proposal [Ex. 1005] was a submission to the 3GPP TSG GERAN LCS ad hoc Meeting #1 in Dallas, Texas beginning on October 24, 2000 coinciding with the foreign priority date of the 940 Patent. The submission, titled Stage Two Input for LCS in GPRS, proposed a GPRS protocol design and Network Positioning Procedures. 18. The proposal focuses on the packet-switched functionality associated with GERAN (GSM/EDGE Radio Access Network) development, and the interface between that GPRS packet-switched functionality and legacy GSM circuitswitched functionality. Figure 1 of the Ericsson Proposal (annotated and reproduced below) is a proposed architecture for GERAN and Core Network parts of the architecture. 19. In addition to the basic architecture of the system, the Ericsson Proposal addresses signaling protocols and interfaces and the procedures used to provide location information in response to different kinds of location requests. 16

21 20. With respect to the 940 Patent, the most important elements of the proposed architecture are the Base Station System (BSS) comprising a Base Transceiver Station (BTS or BS), the Serving Mobile Location Center (SMLC) and its Lb interface to the BSC, and the Serving GPRS Support Node (SGSN) and its Gb interface to the BSC. Especially relevant is the fact the Lb interface was already defined as a circuit-switched interface at the time of the proposal 6, and the Gb interface was already defined as a packet-switched interface at the time of the proposal. 7 6 See ETSI TS V3.0.3 ( ) 6a See ETSI EN V6.3.2 ( )

22 21. The Ericsson Proposal identifies the interfaces between the base station system (BSS), the serving mobile location center (SMLC) and the serving GPRS support node (SGSN). These interfaces are illustrated in Figures 3 and 4 of the proposal: 22. The common network element in these figures is the base station system (BSS), which has an Lb interface with the SMLC, a Gb interface with the SGSN, and a Um interface with the MS. The BSS is the element in the system that uses both circuit switched messages (on the Lb interface) and packet-switched messages 18

23 (on the Gb interface), and has a mechanism for converting from one format to the other (i.e., RELAY function) as illustrated in Figures 3 and When acting as an intermediary between packet-switched and circuitswitched messages, one side of the BSS uses a packet-switched protocol stack and the other side of the BSS uses a circuit-switched protocol stack. 24. Requests for the location of a mobile station can come from the mobile station itself, known as a mobile-originated location request (MOLR), or from an external client referred to as an LCS (LoCation Services) client, known as a mobile terminating location request (MTLR). Figure 6 of the Ericsson Proposal illustrates the sequence of steps used for a mobile terminating location request, where a packet-switched location request message is received at the BSS from an external LCS client through the GPRS core network, and converted and forwarded by the BSS as a circuit-switched location request message. These steps are described in detail in the Williams Declaration [Ex. 1013] 19

24 B. The TS V0.0.2 Draft Specification ( the TS Draft Specification") 25. The TS Draft Specification was jointly drafted by Nokia, Ericsson, Seimens, Motorola and Qualcomm on August 31, 2000 at the 3GPP TSG GERAN working group meeting in Seattle, Washington. It is titled Technical Specification Group Services Systems Aspects; Functional Stage 2 Description of Location 20

25 Services in GERAN. The document specifies the stage 2 LoCation Services (LCS) feature in GERAN, which provides the mechanisms to support mobile location services for operators, subscribers and third party service providers. The purpose of the specification is to define the GERAN LCS architecture, functional entities and operations to support location methods [ 1 Scope]. 26. Figure 1 shows the general arrangement of the Location Service feature. This illustrates, generally, the relation of LCS Clients and servers in the core network with the GERAN. The LCS entities within the GERAN communicate with the Core Network (CN) across the A, Gb and Iu-ps interfaces. Communication among the GERAN LCS entities makes use of the messaging and signaling capabilities of the GERAN. [ 5 GERAN LCS Architecture] 21

26 27. Within the GERAN, the BSC (base station controller) receives authenticated requests for LCS information from the core network across the A, Gb or Iu-ps interfaces and passes these to the SMLC (serving mobile location center). The SMLC may be a standalone network element or functionality which is integrated into the BSC. LCS entities then manage the GERAN resources, including the base transceiver station (BTS), the LMU (LCS measurement unit), the MS (mobile station) and calculation functions, to estimate the location of the MS and return the result to the Core Network. [ 5] 28. The SMLC manages the overall co-ordination and scheduling of resources required for the location of a mobile. It also calculates the final location estimate and estimates the achieved accuracy. [ 5.5.2] 29. Location requests from the external LCS client are communicated to the Base Station Controller (BSC) via the G b interface, which is known to be a packetswitched interface. The SMLC, which manages the location services information, communicates with the BSC over the L b interface, which is known to be a circuitswitched interface. Therefore, the BSC is a network element configured for both circuit-switched and packet-switched messages. 30. The flow of LCS operations is defined in Figure 2. When requested by external entities or by internal operations, the GERAN LCS functional entities will 1) request measurements (typically from the MS and/or one or more BTS radio 22

27 apparatus), 2) send the measurement results to the appropriate calculating function within GERAN, 3) receive the result from the calculating function within GERAN, and 4) send the results to the LCS entities in the core network or to application entities within GERAN. [ 5.2] 31. The Location Request/Response from/to the Core Network LCS Entities are packet-switched messages received and transmitted by the BSC over the Gb interface, while the corresponding coordination/ measurement/ calculation messages are managed by the SMLC in communication with the BSC over the circuit-switched Lb interface. An association between the circuit-switched messages and the packet-switched messages in the BSC is inherent in this messaging scheme. The circuit-switched connection between the SMLC and the BSC is further evidenced in Section 8.3 and Figure 10: 23

28 1) The SMLC sends a BSSMAP-LE Connection Oriented Information message to the BSC serving a particular target MS. The APDU parameter in this message contains a BSSLAP TA Request. 2) The BSC returns the current TA value and current serving cell for the target MS to the SMLC in a BSSLAP TA response contained within a BSSMAP-LE Connection Oriented Information message. The TA response may also include the latest measurement results received from the target MS for the serving and neighbouring cells. The SMLC then derives a location estimate for the target MS based on the received serving cell ID, TA value and other measurement results if included. 32. It is well-known in the art that connection oriented is synonymous with circuit-switched. As noted above, the connection between the BSC and the SMLC is over the Lb interface, which is known in the art to be a circuit-switched interface. 33. The LCS Measurement Unit makes measurements (e.g. of radio signals) and communicates these measurements to the SMLC. The LMU may make its measurements in response to requests (e.g. from the SMLC), or it may 24

29 autonomously measure and report regularly (e.g. timing of BTS transmissions) or when there are significant changes in radio conditions. 34. There may be one or more LMUs associated with the SMLC and an LCS request may involve measurements by one or more LMUs. Additionally, the LMU functionality may be integrated in a BTS. The LMU makes radio measurements to support one or more positioning methods. These measurements fall into one of two categories a) location measurements specific to one MS used to compute the location of that MS, and b) assistance measurements specific to all mobile stations in a certain geographic area. [ 5.5.3] Thus, one mode of measurement is explicitly disclosed as relating to a specific subscriber terminal. 35. As noted above, the SMLC determines the location of the mobile station and reports the location data to the BSC over the circuit-switched Lb interface. The other connection between the BSC and the core network is packet-switched over the Gb interface. 36. A more detailed description of the TS Draft Specification may be found in the Williams Declaration. C. Admitted Prior Art in the 940 Patent 37. The 940 Patent contains a number of prior art admissions that render many of its claims obvious in view of the Ericsson Proposal and the TS Draft Specification. These admissions relate to known aspects of GSM and GPRS 25

30 architecture and functionality. These admissions, described in detail in the Williams Declaration, are summarized below. a. ADMISSION 1: Hybrid GSM/GPRS networks are prior art. b. ADMISSION 2: Location services in GSM circuit-switched networks are prior art. c. ADMISSION 3: A Serving Mobile Location Center (SMLC) is prior art. d. ADMISSION 4: SCCP Connections, SCCP Connection Identifiers, and Base Station Controllers are prior art. e. ADMISSION 5: TLLI (Temporary Logical Link Identifiers) are prior art elements of packet-switched networks. f. ADMISSION 6: The Lb interface between the Base Station Controller (BSC) and the Serving Mobile Location Center (SMLC) is prior art. g. ADMISSION 7: The Serving GPRS Support Node (SGSN) and its Packet Control Unit (PCU) are prior art elements of the GPRS system. h. ADMISSION 8: The SS7 (Signaling System 7) signaling protocol is prior art. i. ADMISSION 9: The SS7 signaling protocol supports packetswitched positioning. VI. DETAILED EXPLANATION OF PERTINENCE AND MANNER OF APPLYING CITED PRIOR ART TO EVERY CLAIM FOR WHICH REVIEW IS REQUESTED UNDER 37 C.F.R (b) A. Claims 1-25 of U.S. Patent No. 7,126,940 are obvious over the Ericsson Proposal in view of the Admitted Prior Art in U.S. Patent No. 7,126, The claim chart below details how each and every element recited in claims 1-25 of the 940 Patent are obvious over the Ericsson Proposal in view of the 26

31 Admitted Prior Art in the 940 Patent. This claim chart is supported by the Expert Declaration of Dr. Tim A. Williams (Ex. 1013) and Appendix A1 thereto. Claim Claim 1 1(a) A method for positioning a subscriber terminal in a packet-switched mobile telephone network comprising: 1(b) passing a message for positioning the terminal via a network element of the mobile telephone network that is configured for both circuit-switched and packet- switched messages for implementing communications required for the positioning; 1(c) establishing an association between the circuit-switched and packet-switched messages for transferring data relating to a certain positioning between packet-switched and circuitswitched functionality; 1(d) and using a circuit-switched connection between the network element and a location centre. Claim 2 2. A method according to claim 1, wherein the data related to a certain positioning is data Ericsson Proposal & Admitted Prior Art See Ericsson Proposal, Summary. See Ericsson Proposal at p. 2; Fig. 1. See 940 Pat. at 3:1-5; Fig. 1D. See Ericsson Proposal at p. 3; Fig. 3. See Ericsson Proposal at Fig. 6. See Ericsson Proposal at Fig. 3. See Ericsson Proposal at p. 5; Fig

32 Claim Attorney Docket No Ericsson Proposal & Admitted Prior Art related to a certain location request. Id. at p. 6; Fig. 6. Claim 3 3. A method according to claim 1, wherein the data related to a certain positioning is data related to the positioning of a certain subscriber terminal. Claim 4 4. A method according to claim 1, wherein the determination of position is carried out by a location centre wherein connections in the mobile telephone network, other than said connection between said network element and the location centre, are packet-switched connections. Claim 5 5. A method according to claim 4, wherein a core network element of the mobile telephone network will pass the location request to the network element in packet-switched form with a packet identifier to establish a circuit-switched connection. Claim 6 Id. at p.11. See Ericsson Proposal at p.5; Fig. 5. Id. at p. 6; Fig. 6. Id. at p.11. See Ericsson Proposal at Fig. 3. See Ericsson Proposal at Fig. 3. See 940 Pat. at 11:1-15; Fig A method according to claim 1, wherein said See Ericsson Proposal at Fig

33 Claim association is established by correlating a packet-switched message identifier with a circuit-switched message identifier. Claim 7 7. A method according to claim 6, wherein the packet- switched message is converted into a message that can be forwarded under a circuitswitched protocol. Claim 8 8. A method according to claim 6, wherein the circuit-switched message is converted into a message that can be forwarded under a packetswitched protocol. Claim 9 9. A method according to claim 1, wherein the packet-switched functionality comprises a packet-switched protocol. Claim A method according to claim 1, wherein the circuit- switched functionality comprises a circuit-switched protocol. Claim A method according to claim 4, wherein the connection between the network element and the Ericsson Proposal & Admitted Prior Art See 940 Pat. at 2: See Claim 5. See Ericsson Proposal at Fig. 6 (steps 8 & 9 and steps 1 & 12). See 1(c) above. See 1(c) above. See 940 Pat. at 4:

34 Claim location centre is performed over an Lb interface using SS7 protocol. Claim 12 12(a) A system for positioning a subscriber terminal in a packet-switched mobile telephone network comprising: 12(b) a core network element, base stations, a base station controller controlling the base stations, and a mobile terminal of the mobile telephone network, wherein connections in the mobile telephone network are configured as packet-switched connections, wherein the system comprises: 12(c) a location unit for determining the position of the terminal, functionally connected with the a network element of the mobile telephone network, wherein a connection between the network element and the location unit is configured as a circuit-switched connection, and wherein the network element comprises: 12(d) both circuit-switched and packet-switched functionality for processing circuit-switched and, respectively, packet-switched messages, Attorney Docket No Ericsson Proposal & Admitted Prior Art See 1(a) above. See Ericsson Proposal at Fig. 3 See also 1(b) above. See Ericsson Proposal at Fig. 3. See Ericsson Proposal at Fig (e) the network element being arranged to See Ericsson Proposal at Fig

35 Claim establish an association between the circuitswitched and the packet-switched functionality for the transmission of data related to a specific positioning between the packet-switched and the circuit-switched functionality. Claim A system according to claim 12, wherein the circuit- switched functionality comprises a circuit-switched protocol stack, and the packetswitched functionality comprises a packetswitched protocol stack. Claim A system according to claim 12, wherein the network element is arranged to convert a packetswitched message into a circuit-switched message. Claim A system according to claim 12, wherein the network element is arranged to convert a circuitswitched message into a packet-switched message. Claim A system according to claim 12, wherein there is an Lb interface between the network Ericsson Proposal & Admitted Prior Art See Ericsson Proposal at Fig. 3. See claim 5. See claim 5. See claim

36 Claim element and the location unit, and the communications over said Lb interface are arranged to be conducted using SS7 protocol. Claim A system according to claim 12, wherein the system comprises obtaining of a signal from the terminal in order for the location unit to be able to determine the position of the terminal. Claim 18 18(a). A network element of a packet-switched mobile communications system wherein the network element is arranged to implement circuit- switched functionality for processing circuit-switched messages and packet-switched functionality for the processing of packetswitched messages; and 18(b) wherein the network element is arranged to establish an association between the circuitswitched and the packet- switched functionality for the transmission of data related to a specific positioning between the packet- switched and the circuit-switched functionality; and 18(c) wherein the network element is arranged for circuit-switched communication with a Ericsson Proposal & Admitted Prior Art See Ericsson Proposal at Fig. 4. See Ericsson Proposal at Fig. 3. See Ericsson Proposal at Fig. 6. See Ericsson Proposal at Fig

37 Claim location unit. Claim A network element according to claim 18, wherein the network element is arranged to establish a packet-switched connection to core network of the mobile communications system, and wherein the network element is arranged to process communications related to positioning of a mobile communications terminal and to associate packet-switched and circuit-switched positioning communications with each other. Claim A method according to claim 1, wherein said network element is a network element belonging to a base station system of the mobile telephone network. Claim A method according to claim 1, wherein said network element is a base station controller. Claim A system according to claim 12, wherein said network element is a network element belonging to a base station system of the mobile telephone network. Ericsson Proposal & Admitted Prior Art See Ericsson Proposal at Figs. 3, 6. See Ericsson Proposal at Figs. 1, 2 and 3. See claim 20. See claim

38 Claim Claim A system according to claim 12, wherein said network element is the base station controller. 24. Claim 24 A network element according to claim 18, wherein said network element is a network element belonging to a base station system of the mobile communications system. Claim A network element according to claim 18, wherein said network element is a base station controller. Ericsson Proposal & Admitted Prior Art See claim 20. See claim 20. See claim 20. B. Claims 1-25 of U.S. Patent No. 7,126,940 are obvious over the TS Draft Specification in view of the Admitted Prior Art in U.S. Patent No. 7,126, The claim chart below details how each and every element recited in claims 1-25 of the 940 Patent are obvious over the TS Draft Specification in view of the Admitted Prior Art in the 940 Patent. This claim chart is supported by the Expert Declaration of Dr. Tim A. Williams [Ex. 1013] and Appendix B1 thereto. 34

39 Claim Claim 1 1(a)A method for positioning a subscriber terminal in a packet-switched mobile telephone network comprising: 1(b) passing a message for positioning the terminal via a network element of the mobile telephone network that is configured for both circuit-switched and packet- switched messages for implementing communications required for the positioning; 1(c) establishing an association between the circuit-switched and packet-switched messages for transferring data relating to a certain positioning between packet-switched and circuitswitched functionality; 1(d) and using a circuit-switched connection between the network element and a location centre. Claim 2 2. A method according to claim 1, wherein the data related to a certain positioning is data related to a certain location request. Claim 3 TS Draft Specification & Admitted Prior Art See TS , 1 Scope Id. at 5 GERAN LCS Architecture; Fig. 1. See TS , 5 GERAN LCS Architecture. Id. At SMLC. TS , 5.2 LCS Operations; Fig. 2. TS , 8.3 TA Positioning Procedure for SMLC; Fig. 10. See TS ; Fig. 1 (Lb interface). See TS ; Fig

40 Claim 3. A method according to claim 1, wherein the data related to a certain positioning is data related to the positioning of a certain subscriber terminal. Claim 4 4. A method according to claim 1, wherein the determination of position is carried out by a location centre wherein connections in the mobile telephone network, other than said connection between said network element and the location centre, are packet-switched connections. Claim 5 5. A method according to claim 4, wherein a core network element of the mobile telephone network will pass the location request to the network element in packet-switched form with a packet identifier to establish a circuit-switched connection. Claim 6 6. A method according to claim 1, wherein said association is established by correlating a packet-switched message identifier with a circuitswitched message identifier. Claim 7 TS Draft Specification & Admitted Prior Art See TS , LMU. See TS ; Fig. 1 (Gb interface). Inherent. Inherent. 36

41 Claim 7. A method according to claim 6, wherein the packet- switched message is converted into a message that can be forwarded under a circuitswitched protocol. Claim 8 8. A method according to claim 6, wherein the circuit-switched message is converted into a message that can be forwarded under a packetswitched protocol. Claim 9 9. A method according to claim 1, wherein the packet-switched functionality comprises a packetswitched protocol. Claim A method according to claim 1, wherein the circuit- switched functionality comprises a circuit-switched protocol. Claim A method according to claim 4, wherein the connection between the network element and the location centre is performed over an Lb interface using SS7 protocol. Claim 12 TS Draft Specification & Admitted Prior Art Inherent. Inherent. Inherent. Inherent. See 940 Pat. at 3:

42 Claim 12(a). A system for positioning a subscriber terminal in a packet-switched mobile telephone network comprising: TS Draft Specification & Admitted Prior Art See TS , 1 Scope Id. at 5 GERAN LCS Architecture; Fig (b) a core network element, base stations, a base station controller controlling the base stations, and a mobile terminal of the mobile telephone network, wherein connections in the mobile telephone network are configured as packet-switched connections, wherein the system comprises: 12(c) a location unit for determining the position of the terminal, functionally connected with the a network element of the mobile telephone network, wherein a connection between the network element and the location unit is configured as a circuit-switched connection, and wherein the network element comprises: 12(d) both circuit-switched and packet-switched functionality for processing circuit-switched and, respectively, packet-switched messages, 12(e) the network element being arranged to establish an association between the circuit- See TS , Figure 1. TS , 5 GERAN LCS Architecture. Id. At SMLC. See 12(c) above. See TS , 5.2 LCS Operations; Fig

43 Claim switched and the packet-switched functionality for the transmission of data related to a specific positioning between the packet-switched and the circuit-switched functionality. Claim A system according to claim 12, wherein the circuit- switched functionality comprises a circuit-switched protocol stack, and the packetswitched functionality comprises a packetswitched protocol stack. Claim A system according to claim 12, wherein the network element is arranged to convert a packetswitched message into a circuit-switched message. Claim A system according to claim 12, wherein the network element is arranged to convert a circuitswitched message into a packet-switched message. Claim A system according to claim 12, wherein there is an Lb interface between the network element TS Draft Specification & Admitted Prior Art See TS , 8.3 TA Positioning Procedure for SMLC; Fig. 10. Inherent. Inherent. Inherent. See 940 Pat. at 3:

44 Claim and the location unit, and the communications over said Lb interface are arranged to be conducted using SS7 protocol. Claim A system according to claim 12, wherein the system comprises obtaining of a signal from the terminal in order for the location unit to be able to determine the position of the terminal. Claim 18 18(a). A network element of a packet-switched mobile communications system wherein the network element is arranged to implement circuitswitched functionality for processing circuitswitched messages and packet-switched functionality for the processing of packetswitched messages; 18(b) and wherein the network element is arranged to establish an association between the circuit-switched and the packet- switched functionality for the transmission of data related to a specific positioning between the packetswitched and the circuit-switched functionality; TS Draft Specification & Admitted Prior Art See TS Positioning for SMLC; Fig. 11. See TS , 5 GERAN LCS Architecture. Id. At SMLC. See TS , 5.2 LCS Operations; Fig. 2. See TS , 8.3 TA Positioning Procedure for SMLC; Fig. 10. See TS , LMU. 40

45 Claim TS Draft Specification & Admitted Prior Art 18(c) and wherein the network element is arranged for circuit-switched communication with a location unit. See TS , 5 GERAN LCS Architecture. Id. At SMLC. Claim 19 19(a). A network element according to claim 18, wherein the network element is arranged to establish a packet-switched connection to core network of the mobile communications system, 19(b) and wherein the network element is arranged to process communications related to positioning of a mobile communications terminal and to associate packet-switched and circuitswitched positioning communications with each other. Claim A method according to claim 1, wherein said network element is a network element belonging to a base station system of the mobile telephone network. Claim 21 See TS , 5 GERAN LCS Architecture; Fig. 1. See TS , 5 GERAN LCS Architecture. See TS at Fig