Method for improving the transmission capabilities of a trunked radio system

Description

Method for improving the transmission capabilities of a Trunked Radio System

Background of the invention

The invention concerns a method for improving the transmission capabilities of a Trunked Radio System.

Trunked Radio Systems especially based on the TETRA (Terrestrial Trunked Radio) Standard are mainly used in security and emergency organizations like Military, Police, Customs, Fire department etc.

Tetra has some advantages over other technologies such as GSM as for example:

the high spectral efficiency or mechanisms to ensure communication success even during overload situations.

The main disadvantage of Trunked Radio Systems is the rather low usable bandwidth for data transfer compared with broadband networks like GSM, UMTS etc..

Summary of the invention

Accordingly, it is an object of the present invention to improve the data transmission capabilities of a Trunked Radio System, especially of a TETRA System.

According to the invention this is done with a method comprising the steps of claim 1.

The dependent claims describe preferable embodiments of the invention.

Brief description of the drawings

JUL 2010

Fig 1 shows an architectural overview about a system which enables the use of the method according to the invention Fig.2 shows an example for the correlation of certain mobil stations of a connected broadband network to certain mobil stations of the trunked radio system.

Description of the preferred embodiments

Terrestrial Trunked Radio (TETRA) denotes a set of open digital trunked radio standards defined by the European Telecommunications Standards Institute (ETSI) to meet the needs of the most demanding of Professional Mobile Radio users. TETRA is an Interoperability standard that allows equipment from multiple vendors to interoperate with each other. TETRA is used by Professional Mobile Radio users such as Public Safety, Transportation, Utilities, Government, Commercial & Industrial, Oil & Gas and Military.

The main disadvantage of known TETRA systems is the low bandwidth of the data part, which is far beyond the real needs of the named customers.

The need of a broad bandwidth is coupled with the simultaneous requirement to high security. It is understandable that due to the nature of the named cases of use for TETRA, a high security measure must be guaranteed to ensure that vulnerable and secret information is only available to those who are within the organization and user group and can not be misused by any other person or other organization.

TETRA uses several measures for securing the communication. Two methods are commonly used:

• Air Interface Encryption, which encrypts the signalling and user traffic between the mobile stations 4,5 and the TETRA Switching and Management Infrastructure TETRA SwMI.

JUL 2010 • end to end encryption, which uses either a known algorithm like Advanced Encryption Standard (AES) etc. or a user specific algorithm to encode and decode the data. Sets of keys are generated and administered by the network operator and populated to the terminals of each user-organization.

There are technical measures to generate separate key sets for each user organizations and such key sets for those cases where two or more user organizations have to be involved together (i.e. a collaboration between elements of police and fire department). In this case the collaborating groups will use keys from a common key set and can use end to end encryption beyond the limits of their own organization only.

In a TETRA scenario for end to end encryption the key-index is sent during the conversation from one terminal to the other terminal directly (so called SYN Frames). The used keyindex is within the range of populated key set. Without special measures the TETRA switching and management infrastructure TETRA SwMI is not aware of the used key-index during the conversation. Thus this method is called end to end encryption.

The encryption in TETRA requires several keys to protect both, payload (i.e. speech, data during a connection) and signaling.

• Key Encryption Key (KEK): each mobile station 4,5 has a unique Key Encryption Key which is downloaded typically by wire by the network administrator 6. The network administrator 6 has a database tool maintaining all Key Encryption Keys and their relation to the Individual Tetra Subscriber Identities ITSI, the identities of the mobile stations 4,5. This relationship is an important fact for the whole end to end encryption.

• Signalling Encryption Key (SEK): which is used to encrypt the signaling messages.

JUL 2010

The mechanism of distribution of the keys to the Mobile Stations is called OTAK (Over the Air Key Management) and is based on TETRA Short Data Service SDS. Within the SDS message keys are encrypted with Key Encryption Key and the message itself is encrypted with Signalling Encryption Key. OTAK Message structure is standardized and is defined in section 8 SFPG Rec. 02 (edition 4).

• Traffic Encryption Keys are used to encrypt the voice payload itself. Typically three Traffic Encryption Keys are hold per Crypto Group (Past, Present and Future). Traffic Encryption Keys are maintained by the OTAK mechanism described above. They are transmitted during the conversation from mobile station to mobile station. Therefore the TETRA Switching and Management Infrastructure TETRA SwMI is not aware of the Traffic Encryption Keys.

Fig. 1 shows the preferable combination of a TETRA network with a Broadband Mobile Network for example on the basis of UMTS-standard, where the method according to the present invention is used to improve the transmission capabilities of a Tetra network. The functional border 21 between the two networks is bridged with a Gateway 20. The Broadband Mobile Network acts as an overlay network, the underlying TETRA network is administered via administration unit (6).

A TETRA Switching and Management Infrastructure TETRA SwMI 1 servers several Base Stations 2, 3 and handles the TETRA internal-connection of the Tetra Mobile Stations 4, 5, Mobile Dispatchers (8) and Fixed-Line Dispatchers 7.

In case of end to end encryption all mobile stations 4,5 belonging to a specific user organization or group are programmed by the administrator before they are first used in the operation. This procedure inserts the corresponding Key encryption key into the mobile stations 4, 5, 8 and updates the database which stores the relation between all Key Encryption Keys and the corresponding Individual Tetra

JUL 2010

Subscriber Identities ITSI. When the mobile stations 4, 5, 8 are in operation, the Traffic Encryption Key TEK's for all Terminals belonging to the same user organization or group are updated by the administrator 6 by the means of standardized OTAK procedure 13. One or more application servers 12 are arranged to provide data services for the TETRA network. Such application servers are optionally connected to a dedicated IP-Network or Public Internet 30. The TETRA Switching and Management Infrastructure TETRA SwMI 1 is able to inter-connect to other networks (i.e. PSTN, Internet, etc.) using appropriate Gateways 14.

Similarly within the Broadband Mobile Network, a broadband switch 22 servers broadband base stations 23, 24 and broadband mobile stations 25, 26. The broadband switch 22 also provides access to public internet or a dedicated IPNetwork through use of appropriate Gateways 27.

In the present embodiment, broadband mobile stations 25, 26 are depicted separately from the TETRA Mobile Stations 4, 5. However, the functionality of both kinds of terminals can be physically implemented to a single Dual-Mode mobile station which can act as a TETRA Mobile Station 4,5 as well as a broadband mobile station 25, 26.

The initialization and the distribution of keys within the TETRA Network is a process involving several entities in the network and is state of the art.

According to the invention, the Key Encryption Keys used within the TETRA Networks for secure communication are also inserted into at least one mobile station 25, 26 of the broadband network.

As within a TETRA network, also in a Broadband network each mobile station 25, 26 has its unique distinguishable address. If the Broadband Network in the above drawing is a UMTS network, the distinguishable address for each mobile station

JUL 2010

25, 26 will be the so called E.164 number (i.e. their telephone number). In the present embodiment a UMTS network is used, but any other broadband network on basis of WLAN, Wimax, etc. can be used instead.

The initialization and distribution of the TETRA Traffic Encryption Keys into a Broadband Network is done in the following steps:

Initialization of Broadband Mobile Stations - an Intra

Network Key Administrator Module TETRA INKA 9 inserts the Key Encryption Keys in to the corresponding Broadband Mobile Stations 25, 26. During this task the subscriber unique address of each broadband mobile station (i.e. E.164 in case 15 of inter-working with 3G, GSM, UMTS ) and it's relation to the corresponding Key Encryption Key is stored into an internal database.

At this point the information about the Individual TETRA 20 Subscriber Identity, Broadband Subscriber unique address

E.164 and Key Encryption Keys is stored in the network as follows :

The TETRA Network Administrator (6) has the knowledge about 25 the relation between Key Encryption Keys and the corresponding Individual Tetra Subscriber Identities ITSI and the Intra Network Key Administrator TETRA INKA (9) has the knowledge about the relation between Key Encryption Keys and the corresponding subscriber unique address of each broadband 30 mobile station E.161

This means that the network has the knowledge about the Individual Tetra Subscriber Identities ITSI / subscriber unique address E.161/ Key Encryption Key relations which is 35 the basis for End to End Encryption over the border of the

TETRA network into the Broadband Network using the same Key infrastructure as used for the TETRA network.

JUL 2010

The relationship between the Individual Tetra Subscriber Identities ITSI , the subscriber unique address E.161 and the Key Encryption Key is illustrated in Fig. 2

The next step comprises the distribution of the Traffic Encryption Keys TEK

As described before, the Traffic Encryption Keys in TETRA networks are used for the End to End Encryption and are distributed by means of OTAK to the TETRA Mobile Stations 4,

5.

The OTAK procedure uses the TETRA Short Data Service with handshake for this purpose and is either directly done via the TETRA Network Administrator 6 or via a connection 10 to the TETRA Switching and Management Infrastructure TETRA SwMI

1.

In either case the sent SDS Message to a specific mobile station 4, 5 contains the corresponding Traffic Encryption Keys for this specific mobile station which themselves are encrypted with the individual Key Encryption Keys. For this reason the network must be aware of the Key Encryption Key / Individual Tetra Subscriber Identities correlation, to be able to encrypt the message correctly for each individual Mobile Station 4, 5.

Since in Step 1 the initialization of broadband mobile stations, the correlation between Key Encryption Keys, the Broadband unique address for broadband mobile stations 25, 26 and the corresponding Individual Tetra Subscriber Identities is well known, the OTAK mechanism can be used to distribute the Traffic Encryption Keys in an appropriate form depending on the Broadband network. As an example the Short Message Service mechanism can be used to send the OTAK Message to the corresponding Broadband Mobile Stations 25, 26 in case of 3G, UMTS or GSM broadband networks.

JUL 2010

The broadband mobile station can optionally send an special SMS back to the TETRA Network to indicate the correct reception of the adapted OTAK Message and the corresponding keys .

This task is referred as Adapted OTAK 15 in Fig. 1 and is initiated by the Intra Network Key Administrator TETRA INKA 9, since this network entity has the knowledge about the Key Encryption Key/Broadband unique address- correlations. Again the execution of the Adapted OTAK 15 can be done by the TETRA Switching and Management Infrastructure TETRA SwMI 1 or an appropriate Gateway 20 to the broadband network. The essential information is the Broadband subscriber unique address relation to the corresponding Key Encryption Key and Individual Tetra Subscriber Identities, which is stored in the Intra Network Key Administrator TETRA INKA 9.

In addition to that, the distributed Traffic Encryption Keys to the broadband Mobile Stations 25, 26 can also be distributed to the Application Server 12. This enables secure Inter-Connection for Data Services between broadband Mobile Stations 25, 26 and the Application Server 12.

The frequency of the update procedure with the help of adapted OTAK message is dependant on the security policy of each user group or user organization. In case of high security requirements the adapted OTAK is used very frequently to make sure all used keys are changed often.

Once the Traffic Encryption Keys are distributed to the corresponding Broadband Mobile Stations 25, 26 and to the Application Server 12, several secure communications are possible:

• a secure end to end encrypted communication between broadband mobile stations 25, 26.

JUL 2010 • a secure end to end encrypted communication between broadband mobile stations 25, 26 and the Application server 12 over a dedicated or public IP-Network 30 is possible.

• a secure end to end encrypted communication between broadband mobile stations 25, 26 and the TETRA Mobile Stations 4,5.

All of the mentioned communication can take place with one key infrastructure (which was in place for TETRA Network). Again here many of commonly used algorithms like AES, DES etc. are possible. The main point is that the keyset is administered by the underlying TETRA network.

The invention offers following advantages to currently available techniques:

It implements a homogenous key distribution system. The same Key distribution system as used in the TETRA network can be extended to any other overlay network as shown on the present embodiment for a UMTS network. This reduces a huge effort for administrating different crypto technologies across the border of different networks, Further on the TETRA Traffic Encryption Keys originally designed for use within a TETRA network for voice communication only are extended for broadband data communication. A unique assignment of a TETRA mobile station to a corresponding broadband mobile station can be done due to the correlation between Key Encryption Keys, the Broadband unigue address for broadband mobile stations 25, 26 and the corresponding Individual Tetra Subscriber Identities each TETRA mobile station is assigned uniquely to a corresponding broadband mobile station.

The logic of different keys for different user groups or organizations is not changed with the described method. Hence this logic is also available on the broadband network side.