Method and system for encryption of messages in land mobile radio systems

• US 9,148,421 B2
• Filed: 03/07/2014
• Issued: 09/29/2015
• Est. Priority Date: 07/19/2007
• Status: Active Grant

• Current Assignee: E F Johnson Company (JVC Kenwood Corporation)
• Original Assignee: E F Johnson Company (JVC Kenwood Corporation)
• Inventors: Benshetler, Jeffery E., Roy, Arindam
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): Ambaye, Samuel
• Application Number:
  US14/200,812
• Publication Number:
  US 20140195801A1
• Time in Patent Office: 571 Days
• Field of Search: 713/156, 713/168, 713/185, 726/9
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

A method and system for authentication of sites in a land mobile radio (LMR) system and encryption of messages exchanged by the sites. In some embodiments, the method includes transmitting a certificate created by a trusted authority by applying a function to a first site public key using the trusted authority'"'"'s private key to generate a reduced representation, which is encrypted with the trusted authority'"'"'s private key. Other sites may receive the certificate, decrypt it using the trusted authority'"'"'s public key, and authenticate the first site. The method may further include generating a session key, encrypting it with the public key of the first site, and transmitting the encrypted session key to the first site. The first site decrypts the encrypted session key with the first site'"'"'s private key, and transmits a message encrypted with the shared session key to other sites for decryption using the session key.

Claims

1. A method for authenticating a plurality of sites in a land mobile radio (LMR) system and encrypting messages exchanged by the sites, the plurality of sites being connected by a data network, the method comprising:

receiving, by one or more of the plurality of sites in the LMR system, a certificate transmitted by a first site, wherein the certificate is encrypted;

decrypting, by the one or more of the plurality of sites, the certificate transmitted by the first site;

authenticating the first site;

generating a shared session key that is valid across a group of sites in the LMR system;

encrypting the shared session key; and

transmitting the encrypted shared session key to the first site for use by the first site to encrypt a message for multicast transmission.

2. The method according to claim 1, wherein the certificate is created by a trusted authority by encrypting at least a public key of the first site with the trusted authority'"'"'s private key.

3. The method according to claim 2, wherein the certificate is decrypted using the trusted authority'"'"'s public key.

4. The method according to claim 2, wherein the shared session key is encrypted with the public key of the first site.

5. The method according to claim 2, further comprising:

applying a hash function to the public key of the first site to create a reduced representation,

wherein a certificate of the first site is generated by encrypting the reduced representation with the private key of the trusted authority.

6. The method according to claim 5 further comprising:

decrypting the certificate with the trusted authority'"'"'s private key; and

comparing the decrypted certificate with a locally calculated hash of the public key and authenticating the site.

7. The method according to claim 1, wherein the encrypted shared session key is transmitted to the first site for decryption by the first site using a private key of the first site.

8. The method according to claim 1, wherein the group of sites in the LMR system is a multicast group.

9. The method according to claim 1, wherein the message encrypted by the first site is transmitted by multicasting the encrypted message to the group of sites in the LMR system.

10. The method according to claim 1, wherein the message encrypted by the first site is transmitted by multicasting the encrypted message on an IP network.

11. The method according to claim 1, wherein the message encrypted by the first site is transmitted by multicasting the encrypted message on a packet switched network.

12. The method according to claim 1 further comprising:

receiving, by the one or more of the plurality of sites in the LMR system, the message encrypted by the first site; and

decrypting the encrypted message with the shared session key.

13. The method according to claim 1, wherein the certificate is a digital certificate of the first site.

14. The method according to claim 1 further comprising:

transmitting, by each of the one or more of the plurality of sites, its respective certificate when the site intends to communicate with other sites; and

receiving an updated shared session key after the site is authenticated.

15. The method according to claim 1, wherein the shared session key is a symmetric session key.

16. The method according to claim 1, wherein the shared session key is a secret symmetric session key.

17. The method according to claim 1 further comprising transmitting a new shared session key after a predetermined time interval.

18. The method according to claim 1 further comprising transmitting a new shared session key when a site intends to exchange messages.

19. A computer-implemented method for authenticating a plurality of sites in a land mobile radio (LMR) system and for encrypting messages exchanged by the sites, the plurality of sites being connected by an IP network, the computer-implemented method comprising:

transmitting, by a first site, a certificate of the first site;

generating a shared session key that is valid across a group of sites in the LMR system;

receiving, by the first site, the shared session key, wherein the shared session key is encrypted;

decrypting, by the first site, the encrypted shared session key with a private key of the first site; and

transmitting, by the first site, a multicast message encrypted with the shared session key.

20. The computer-implemented method according to claim 19, wherein the certificate is created by a trusted authority by encrypting at least a public key of the first site with the trusted authority'"'"'s private key.

21. The computer-implemented method according to claim 20, wherein the certificate is decrypted using the trusted authority'"'"'s public key.

22. The computer-implemented method according to claim 20, wherein the shared session key is encrypted with the public key of the first site.

23. The computer-implemented method according to claim 19, wherein the certificate is transmitted by the first site for at least one of receipt, authentication, and decryption by other sites in the LMR system.

24. The computer-implemented method according to claim 19, wherein the group of sites in the LMR system is a multicast group.

25. The computer-implemented method according to claim 19, wherein transmitting the multicast message encrypted with the shared session key comprises multicasting the encrypted multicast message.

26. A system for authenticating a plurality of sites in a land mobile radio (LMR) system and for encrypting messages exchanged by the sites, the plurality of sites being connected by an IP network, the system utilizing a plurality of method steps comprising:

transmitting, by a first site, a certificate of the first site;

generating a shared session key that is valid across a group of sites in the LMR system;

receiving, by the first site, the shared session key, wherein the shared session key is encrypted;

decrypting, by the first site, the encrypted shared session key with a private key of the first site; and

transmitting, by the first site, a multicast message encrypted with the shared session key.

27. The system according to claim 26, wherein the certificate is created by a trusted authority by encrypting at least a public key of the first site with the trusted authority'"'"'s private key.

28. The system according to claim 27, wherein the certificate is decrypted using the trusted authority'"'"'s public key.

29. The system according to claim 27, wherein the shared session key is encrypted with the public key of the first site.

30. The system according to claim 26, wherein the certificate is transmitted by the first site for at least one of receipt, authentication, and decryption by other sites in the LMR system.

31. The system according to claim 26, wherein the method steps further comprise multicasting the multicast message encrypted with the shared session key.

32. The system according to claim 26, wherein the encrypted multicast message is transmitted by the first site for receipt and decryption by other sites in the LMR system, wherein the encrypted multicast message is decrypted with the shared session key.

33. The system according to claim 26, wherein the group of which the sites in the LMR system are members is a multicast group.