TETRA MoU TTR 002-04 Technical Ver 1.0.1 Report July 2004 Source: TETRA MoU Technical Forum Keywords: Interoperability, DMO Air Interface, DM Type 1 Repeater, DM Gateway TETRA Memorandum of Understanding (TETRA MoU); DMO TETRA Interoperability Profile (TIP) Part 4: End-to-end Encryption TETRA MoU Postal address: P.O. Box 88, St Ives, PE27 6PD, England Internet: http//www.tetramou.com E-mail: secretary@tetramou.com Tel: +44 1480 370640 - Fax: +44 1480 370641 Copyright Notification: Reproduction is only permitted for the purpose of standardisation work undertaken within TETRA MoU. The copyright and the foregoing restrictions extend to reproduction in all media. Liability Notification: TETRA MoU can not be made liable for the contents of this document. TETRA MoU has no liability for any direct or indirect loses and damages this document may cause. TETRA MoU 2004. All rights reserved.
Page 2 July 2004 Empty Page
July 2004 Page 3 Contents 1 Scope... 5 2 References... 5 3 Definitions and abbreviations... 6 3.1 Definitions... 6 3.2 Abbreviations... 6 4 Introduction... 7 5 General... 7 5.1 Notation... 7 6 End-to-end encryption... 7 6.1 Service Overview... 7 6.2 End-to-end encryption synchronisation... 8 6.3 Format of DMAC-U-SIGNAL... 8 6.4 Basic DMO operation... 8 6.4.1 Call set-up... 8 6.4.2 End to end call set-up rejection cases... 8 6.4.2.1 Unacceptable encryption mode in group call... 9 6.4.2.2 Unacceptable encryption mode in individual call without presence check... 9 6.4.2.3 Unacceptable encryption mode in individual call with presence check... 9 6.4.3 Call maintenance procedures... 10 6.5 DMO operation with DM-REP... 10 6.5.1 Call set-up... 10 6.5.2 End to end call set-up rejection cases... 10 6.5.2.1 Unacceptable encryption mode in individual call with presence check... 11 6.5.2.2 Unacceptable encryption mode in individual call without presence check... 12 6.5.2.3 Unacceptable encryption mode in group call... 12 6.5.3 Call maintenance procedures... 12 6.6 DMO operation with DM-GATE... 13 6.6.1 Call set-up... 13 6.6.2 End to end call set-up rejection cases... 13 6.6.2.1 Unacceptable encryption mode in group call from TM-MS to... 13 6.6.2.2 Unacceptable encryption mode in an individual call from TM-MS to... 14 6.6.2.3 Unacceptable encryption mode in Individual Call from to TM-MS... 15 6.6.3 Call maintenance procedures... 15 6.6.4 Transmit request procedures... 15 6.7 Random access procedures... 16
Page 4 July 2004 List of Figures Figure 1: Called ignores call set-up...9 Figure 2: End-to-end encryption call disconnection during call set-up (called party)...10 Figure 3: Called party disconnection during call set-up...11 Figure 4: Called ignores call set-up...12 Figure 5: group member ignores the call setup...13 Figure 6: rejects the call setup...14 Figure 7: TM-MS rejects the call setup...15 Foreword This technical report has been produced by the Technical Forum DMO working group of the TETRA MoU organisation. The purpose of the report is to specify protocols for basic TETRA services in order to ensure interoperability of these services for equipment produced by different manufacturers. The contents of this report are subject to continuing work within the Technical Forum and may change following TETRA MoU approval. Should Technical Forum modify the contents of this report, it will then be republished by TETRA MoU with an identifying change of release date and an increase in revision number as follows: Revision 1.x.y where y x the third digit is incremented when editorial only changes have been incorporated; the second digit is incremented for other changes, i.e. technical enhancements etc.
July 2004 Page 5 1 Scope This TETRA MoU Technical Report defines the requirements for TETRA direct mode end-to-end encryption interoperability. The required features are defined and functional descriptions of these features are specified. The scope of this document is the specification for interoperability in Direct Mode Operation (DMO). Only the End-to-end encryption functionality for basic DMO operations and operations of with a DM- REP or DM-GATE are considered within this document. TIP requirements related to other features and services available on TETRA systems are the subject of separate documents. Each item of functionality is accompanied by a figure illustrating the signalling between engaged MSs. Only the names of the Protocol Data Units (PDUs) are shown, together with the salient elements of the PDUs. This document does not replace or supersede the TETRA DMO air interface standard but simply indicates the profile of implemented functionality from the standard. This profile, together with the standard protocol specification, provides the necessary information for a terminal manufacturer skilled in TETRA to implement terminal equipment that will inter-operate with other manufacturers terminals. 2 References [1] ETS 300 396-3 Terrestrial Trunked Radio (TETRA); Technical requirements for Direct Mode Operation (DMO); Part 3: Mobile Station to Mobile Station (MS-MS) Air Interface (AI) protocol, ed. 2 draft 0.8, 2003-03. [2] ETSI EN 300 396-4 Terrestrial Trunked Radio (TETRA); Technical requirements for Direct Mode Operation (DMO); Part 4: Type 1 repeater air interface, V1.2.1, 2000-12. [3] ETS 300 396-5 Terrestrial Trunked Radio (TETRA); Technical requirements for Direct Mode Operation (DMO); Part 5: Gateway air interface, 2000-01. [4] ETSI ES 202 109 Terrestrial Trunked Radio (TETRA); Security; Synchronisation mechanism for end-to-end encryption, v0.0.2, 2002-07 [5] TETRA MoU SFPG, Rec 02 End-to-end encryption [6] TTR 002-01 TETRA MoU TETRA Interoperability Profile (TIP), Part 1 DMO Core, May 2002 [7] TTR 002-03 TETRA MoU, DMO TETRA Interoperability Profile (TIP), Part 3: Operation with Type 1 repeater, ver. 0.1.6, June 2003, Working Draft [8] TTR 002-02 TETRA MoU, DMO TETRA Interoperability Profile (TIP), Part 2: Gateway, ver. 0.0.6, May 2003, Working Draft [9] TTR 001-10 TETRA MoU, TETRA Interoperability Profile (TIP), Part 10: End-to-end encryption with Clear Voice Override, November 2001, Working Draft
Page 6 July 2004 3 Definitions and abbreviations 3.1 Definitions None 3.2 Abbreviations For the purposes of this report, the following abbreviations apply: DM-GATE DMO DM-REP DNB DSB IOP MS PDU SwMI TETRA TIP TM-MS TMO Direct Mode Gateway Direct Mode Mobile Station Direct Mode Operation Direct Mode Repeater Direct mode Normal Burst Direct mode Normal Burst Inter-Operability Mobile Station Protocol Data Unit Switching and Management Infrastructure TErrestrial Trunked RAdio TETRA Inter-operability Profile Trunked Mode Mobile Station Trunked Mode Operation
July 2004 Page 7 4 Introduction This report documents the TETRA interoperability requirements. The purpose of the report is to define the features required to conform to the TETRA Interoperability Profile in the context of the end-to-end encryption functionality in DMO. This report only deals with the features of end-to-end encryption for basic DMO operation and for while a DM-REP or a DM-GATE is present on the same carrier. The set of features required for the TIP is a limited, but basic set of features likely to be required in all TETRA systems. The interoperability requirements are extended requirements from the conformance and type approval requirements. These requirements are primarily derived from the TETRA standard with additional constraints on parameter variations for some PDUs and mandatory requirements for support on some optional protocol functions, the TIP shall not be in conflict with the TETRA standards unless it is to incorporate a change foreseen to be implemented in the TETRA standards. In case it is identified that there is a market need for functionality which has not been addressed by the TETRA standards then the interoperability requirements of the TIP may include such requirements. 5 General 5.1 Notation The following sections describe the TIP services and functionality accompanied by figures illustrating the signalling between (s), DM-REP(s), DM-GATE(s), TM-MS(s) and SwMI. PDU names are shown in the figures, together with their most relevant contents. The following conventions are adopted in pictures. Text in single quotes refers to specific element values and italics are used to indicate elements that can take any value. Optional PDU elements are enclosed in square brackets. In the diagrams, a message shown with a dashed arrow is optional. In DMO with DM-REP operation section, parameters of the repeated transmissions, which are generated by the DM-REP either on the master link or on the slave link, are omitted. There is one single exception to this last convention: parameters that may be changed by the DM-REP are shown together with the repeated PDU. 6 End-to-end encryption 6.1 Service Overview This specification for Direct Mode Operation describes the end-to-end encryption functionality applied to basic communications between Direct Mode capable radio units, communications of Direct Mode MSs with the intervention of a type 1 repeater and communications of s with TM-MS through the intervention of a Direct Mode gateway. This report describes synchronisation operation for end-to-end encryption algorithms that employ streaming ciphers for voice according to [4]. End-to-end encryption algorithms and key management are outside the scope of the present document. This TIP covers the following features: Synchronisation of encryption units (initial synchronisation and re-synchronisation) End-to-end group call set-up rejection End-to-end individual call set-up rejection Call maintenance Random access This TIP does not cover: Algorithms for end-to-end encryption
Page 8 July 2004 Key management procedure 6.2 End-to-end encryption synchronisation The end-to-end encryption service is recognised by a flag within call control starting and maintaining PDUs, indicating an end to end ciphered call. At the end of call set-up PDUs transmission, and for the whole call transaction, the master shall provide end to end synchronisation by stealing traffic slot for U-plane synchronisation frames included in DMAC-U-SIGNAL PDUs. The DMAC-U-SIGNAL shall be sent by stealing an half slot from U-plane traffic on slot 1 and should be repeated for reliability. The DMAC-U-SIGNAL should be also transmitted periodically during occupation to provide end to end synchronisation information to late entrants. For the distribution of the stolen half slots synchronisation frames refer to [4]. Key management procedure it is not covered in this TIP document. It is described in [5]. 6.3 Format of DMAC-U-SIGNAL The synchronisation mechanism of the end to end ciphering procedure is addressed by stealing traffic for U-plane DMAC-U-SIGNAL PDUs whose internal format is shown in [4] (subclause 4.4.5). For a detailed description of the signalling data block field contained in the DMAC-U-SIGNAL refer to [5] (subclause 8.5.2). 6.4 Basic DMO operation 6.4.1 Call set-up The same scenarios for call set-up described in [6], clause 9.1, shall apply. The signalling exchange and rules described in [6], clause 9 and relative subclauses, are the same, apart from the fact that the field End to end encryption flag shall be set to the value With TETRA end to end encryption in the DM- SETUP, DM-SETUP PRES and DM-CONNECT ACK PDU. A called able to support end-to-end encryption may accept both group and individual incoming clear calls. 6.4.2 End to end call set-up rejection cases In the following are shown the relevant PDUs and information elements when a recipient not supporting the end to end encryption service rejects an incoming call.
July 2004 Page 9 6.4.2.1 Unacceptable encryption mode in group call Since a called in a group call cannot signal its rejection, if it is not able to support end-to-end encryption it shall ignore the set-up PDUs including the unacceptable encryption flag. Calling DMgroup DM-SETUP Channel timing change not allowed TN3 of FN3 available for LCH Pre-emption allowed Power Class Power Control Flag TETRA encoded speech Priority level With TETRA end-to-end encryption Group call Null value group member ignores the setup Figure 1: Called ignores call set-up 6.4.2.2 Unacceptable encryption mode in individual call without presence check The same signalling and rules as those for group call set-up apply, except for the fact that the Call type flag of DM-SETUP PDUs is set to `Indivi dual call rather than to `Group call. 6.4.2.3 Unacceptable encryption mode in individual call with presence check On receipt of a DM-SETUP PRES PDU containing as informative element the field End to end encryption flag set to the value With TETRA end to end encryption, a non supporting end to end encryption shall reject the incoming call as shown in Figure 2. The DM-DISCONNECT PDU shall be sent in timeslot 1 and 3 of up to DN210 consecutive frames containing the Disconnect cause flag set to Called party does not support end to end encryption.
Page 10 July 2004 Calling Called DM-SETUP PRES Power Class Power Control Flag TETRA encoded speech Priority level With TETRA end-to-end encryption Individual call Null value DM-DISCONNECT Called party does not support end to end encryption DM-RELEASE Called party rejected calls Figure 2: End-to-end encryption call disconnection during call set-up (called party) 6.4.3 Call maintenance procedures The same rules and signalling exchange described in [6], clause 9.2, shall apply also in the case of an end to end ciphered call. As for the call set-up PDUs, also the DM-OCCUPIED PDUs sent during the call transaction shall have the field End to end encryption flag set to value With TETRA end to end encryption. This allows an enabled to late enter the end to end ciphered ongoing call even if it has missed the initial call set-up. 6.5 DMO operation with DM-REP 6.5.1 Call set-up The same scenarios for call set-up described in [7], clause 9.1, shall apply. The signalling exchange and rules described are the same apart from the fact that the field End to end encryption flag shall be set to With TETRA end to end encryption in the DM-SETUP, DM-SETUP PRES, DM-CONNECT and DM- CONNECT ACK PDUs. A called able to support end-to-end encryption signalling may accept both group and individual incoming clear calls. 6.5.2 End to end call set-up rejection cases In the following are shown the relevant PDUs and information elements when a recipient not supporting the end to end encryption service rejects an incoming call.
July 2004 Page 11 6.5.2.1 Unacceptable encryption mode in individual call with presence check On receipt of a DM-SETUP PRES PDU containing as informative element the field End to end encryption flag set to With TETRA end to end encryption, a not supporting end to end encryption shall reject the incoming call as shown in Figure 3. The DM-DISCONNECT PDU shall be sent in timeslot 1 and 3 of up to DN210 consecutive frames containing the Disconnect cause flag set to Called party does not support end to end encryption. Calling DM-REP Called DM-SETUP PRES Via DM-REP Power Class Power Control Flag TETRA encoded speech Priority level With TETRA end to end encryption Individual call Null value DM-SETUP PRES Power Class Power Control Flag Called rejects DM-DISCONNECT Via DM-REP Called party does not support end to end encryption DM-DISCONNECT DM-RELEASE Via DM-REP Called party rejected call DM-RELEASE Figure 3: Called party disconnection during call set-up
Page 12 July 2004 6.5.2.2 Unacceptable encryption mode in individual call without presence check Since a called in an individual call without presence check cannot signal its rejection, if it is not able to support end-to-end encryption it shall ignore the set-up PDUs including the unacceptable encryption flag. Calling DM-REP Called DM-SETUP Via DM-REP `Channel timing change not allowed `TN3 of FN3 available for CLCH `Pre-emption allowed Power Class Power Control Flag TETRA encoded speech Priority level With TETRA end to end encryption Individual call Null value DM-SETUP Power Class Power Control Flag Called ignores the setup Figure 4: Called ignores call set-up 6.5.2.3 Unacceptable encryption mode in group call The same signalling and rules as those for individual call set-up without presence check apply, except for the fact that the Call type flag of DM-SETUP PDUs is set to `Group call rather than to `Indivi dual call. 6.5.3 Call maintenance procedures The same rules and signalling exchange described in [7], clause 9.2, shall apply also in the case of an end to end ciphered call. As for the call set-up PDUs, also the DM-OCCUPIED PDUs sent during the call transaction shall have the field End to end encryption flag set to the value With TETRA end to end encryption. This allows an enabled to late enter the end to end ciphered ongoing call even if it has missed the initial call setup. In order to allow a to correctly late enter an ongoing ciphered call, the DM-REP should not substitute the re-transmission on the slave link of DM-OCCUPIED PDUs with presence signal PDUs.
July 2004 Page 13 6.6 DMO operation with DM-GATE 6.6.1 Call set-up The same scenarios for call set-up described in [8], clause 9, shall apply. The signalling exchange and rules described in clause 9 and relative subclauses are the same apart from the fact that the encryption flag shall be set accordingly. In DMO call set-up PDUs such as DM-SETUP, DM-SETUP PRES, DM-CONNECT and DM-CONNECT ACK the field End to end encryption flag shall be set to the value With TETRA end to end encryption. In TMO call set-up PDUs such as U-SETUP, D-SETUP, D-CONNECT and D-CONNECT ACK the field Encryption flag shall be set to the value TETRA end to end encryption. A called able to support end-to-end encryption may accept both group and individual incoming clear calls. 6.6.2 End to end call set-up rejection cases In the following are shown the relevant PDUs and information elements when a recipient MS not supporting the end to end encryption service rejects an incoming call. 6.6.2.1 Unacceptable encryption mode in group call from TM-MS to Since a group member cannot signal its rejection, it shall ignore the incoming setup with unacceptable encryption flag. DM- GATE SwMI TM-MS U-SETUP TETRA end to end encryption DM-SETUP With TETRA end to end encryption D-SETUP TETRA end to end encryption D-CONNECT TETRA end to end encryption group members ignore the setup Figure 5: group member ignores the call setup
Page 14 July 2004 6.6.2.2 Unacceptable encryption mode in an individual call from TM-MS to In this case the call setup is rejected since the called party does not support encryption. DM-GATE SwMI TM-MS U-SETUP TETRA end to end encryption D-SETUP TETRA end to end encryption D-CALL PROCEEDING TETRA end to end encryption DM-SETUP PRES With TETRA end to end encryption rejects DM-DISCONNECT Called party does not support end to end encryption U-DISCONNECT Called party does not support encryption DM-RELEASE Called party rejected call D-RELEASE Called party does not support encryption D-RELEASE Called party does not support encryption Figure 6: rejects the call setup The DM-DISCONNECT PDU shall be sent in timeslot 1 and 3 of up to DN210 consecutive frames containing the Disconnect cause field set to the value Called party does not support end to end encryption.
July 2004 Page 15 6.6.2.3 Unacceptable encryption mode in Individual Call from to TM-MS In this case the call setup is rejected since the TM-MS called party does not support encryption. DM-GATE SwMI TM-MS DM-GSETUP With TETRA end to end encryption DM-GACK DM-GACK indicates that channel is now in a reserved state U-SETUP TETRA end to end encryption D-SETUP TETRA end to end encryption U-DISCONNECT TM-MS rejects call Called party does not support encryption D-RELEASE Called party does not support encryption DM-RELEASE Called party rejected call 6.6.3 Call maintenance procedures Figure 7: TM-MS rejects the call setup As for the call set-up PDUs, also the content of the DM-OCCUPIED PDUs sent during the call shall have the field End to end encryption flag set to the value With TETRA end to end encryption. This allows an enabled to late enter the end to end ciphered ongoing call even if it has missed the initial call setup. In order to allow a to correctly late enter an ongoing ciphered call, the DM-GATE should not substitute the transmission of DM-OCCUPIED PDUs with presence signal PDUs. 6.6.4 Transmit request procedures For TM-MS transmit request procedures refer to [9].
Page 16 July 2004 6.7 Random access procedures Since in DMO the random access PDUs requesting a pre-emption or a changeover does not contain the End to end encryption flag, the encryption state of any speech item can solely be selected through the information contained in the call set-up PDUs. A call set-up procedure activated by a slave after the acceptance of a random access request for the ongoing call may either keep unchanged the end to end encryption settings of the previous master or adopt the end to end encryption settings of the new master. In case encryption mode is changed and not supported by the called parties involved in the call transaction, called parties may apply the same rules described for call setup rejections due to unacceptable encryption mode. A call set-up procedure activated by a slave or an idle after the acceptance of a random access request for a new call shall adopt the end to end encryption settings of the new master.
July 2004 Page 17 History Document history Date Version Comment July 2004 1.0.0 Final version for publication July 2004 1.0.1 Minor editorial prior to publication