The widespread availability of police "scanners" and other inexpensive consumer radio receivers has created significant security problems for law enforcement and other radio users. For example, it is now possible for criminals to monitor police radio communications in order to discover police whereabouts and activities--and thereby elude the police. Although some police forces have adopted the practice of talking in "code" to make their communications less understandable, these codes often make informative conversation more difficult--and the "codes" typically are relatively easy to "decode" after listening to police conversations for a few weeks.
Modern state-of-the-art mobile radios are digital. They convert the user's voice into a digitized data stream consisting of "bits" having "1" and "1" values before sending the "bits" over the radio channel--and similarly they receive communications in digitized data stream form and convert the received "bits" into analog voice signals for reproduction by a loud speaker. Although the use of digitized speech transmission prevents most police "scanners" from receiving intelligible signals, more advanced "digital" radio receivers available to consumers or criminals may still allow eavesdropping. Moreover as the cost of "digital" scanning receivers comes down, this type of receiver will become more widespread. In addition, a certain class of radio users (e.g., people associated with the FBI, CIA, military and other highly sensitive organizations) require an extremely high degree of communications security. Thus, there is need for communications that provide greater security and protection against eavesdropping than can be achieved using digitized speech.
In response to this need for greater security, major manufacturers of land-mobile radio equipment in the United States have for many years incorporated "encryption" into their radio products. The state of radio electronics technology has advanced such that it is now practical and cost-effective to have the radio equipment automatically electronically "code" ("encrypt") and "decode" ("decrypt") communications electronically.
Briefly, "encryption" and "decryption" are part of "cryptography," the art of communicating securely in the presence of an "enemy" or "attacker". "Encryption" takes a "clear" text message and transforms it into unintelligible form ("cipher text"). "Decryption" reverses the process, transforming the cipher text back into the original "clear" text. In modern "cryptosystems" such as "DES" ("Data Encryption Standard"), it is computationally infeasible to derive the "clear" text from the cipher text unless one knows beforehand the particular transformation that should be employed. So long as the decryption transformation remains a closely guarded secret, parties to an encrypted communication can feel safe knowing that only authorized people (i.e., the people who know the specific decryption transformation to use) will be able to decrypt the encrypted communications. That is, even if an attacker successfully intercepts an encrypted message, the attacker will be unable to decrypt the message to recover the "clear" text.
Because of the difficulty of designing and verifying the security of a cryptosystem, it has become commonplace to define encryption and decryption transformations with two components: (a) an algorithm that defines a family of transformations; and (b) a cryptographic "key" that specifies a particular one of many (usually a very large number of) transformations within the family. The cryptographic algorithm can be contained in standard, readily available integrated circuit chips and may even be widely published (e.g., the details of the "DES" algorithm is published in Federal FIPS Publication No. 46). However, before the algorithm is used by, for example, Steve and Carole to encrypt and decrypt messages, Steve and Carole select and agree upon at least one cryptographic "key" they intend to use with the algorithm. Steve and Carole keep this cryptographic key a closely guarded secret. Since the cryptographic key determines the particular encryption/decryption transformation(s), an attacker who knows the basic cryptographic algorithm but doesn't know the key will be unable to decrypt intercepted encrypted communications. Moreover Carole and Tim can agree to use a different cryptographic key for their secure encrypted communication, and Steve intercepting the communication will be unable to decrypt it successfully. To provide increased security against long-term cryptographic attacks, "traffic analysis," etc., parties can agree to periodically change their agreed-upon cryptographic keys--or they may agree to use a different key if they feel the security of their communications has been compromised.
Ericsson-GE Mobile Radio Communications Inc. ("EGE") of Lynchburg Virginia has for many years sold products under the trade name VOICE GUARD which include a digitized voice encryption/decryption capability. Motorola Inc. of Schaumberg Illinois has similarly for many years sold "SECURE NET" land-mobile radio equipment including digitized voice encryption. Although prior radio products were limited to only a single encryption technique, more recent digital voice radios (i.e., EGE's AEGIS/VG digital radio products) currently use any one of three conventional key-based encryption o algorithms (DES, VGE or VGS) for securely transmitting digitized voice over an RF channel.
In using such systems, there arises a practical problem of how to load the secret cryptographic key(s) into all radio transceivers intended to participate in secure communications. In EGE's prior systems, the "key" information is loaded into each radio individually using a device called a "key loader." This keyloader device communicates with the radio over a serial data cable, and downloads "key" data into the radio for use in defining the particular encryption/decryption transformation to be used. The user may download "keys" to the radio at any time by connecting up the key loader to the radio and specifying the new key data. When the radio receives new "keys" from the key loader, it must store and retain the "keys" so that they can be retrieved every time the radio is subsequently turned on.
In prior radio products, the key storage method depended on the type of encryption algorithm in the radio. Prior EGE radio designs using DES encryption transferred the "key" data to a special-purpose DES encryption/decryption integrated circuit "chip" for storage. This DES "chip" is connected to a small battery (e.g., a lithium cell) that continually supplied power to the DES chip even when the rest of the radio is turned off. The solution of storing the "keys" in the DES chip is very secure since the radio microcontroller never "sees" (and cannot access) the key information once it is loaded, and any attempts to read the key information out of the DES chip will almost certainly result in erasure of the key information before it can be successfully read. However, this arrangement requires the existence of a battery-backed device to maintain the "keys" throughout the power cycle. Moreover, commercially-available DES chips have a limited key storage capacity whereas in the context of a mobile radio communications system it may be necessary for a given mobile radio to select between a number of different keys corresponding to, for example, a number of different secure communications recipients. In prior VGE encrypted radios sold by EGE, the key information was simply stored in a table in EEPROM ("Electrically Erasable Programmable Read Only Memory"). This storage solution removed the requirement for a battery-backed device, but was not very secure since the key information is simply in a table in EEPROM and thus can be read out by someone willing to take the time to "dump" the contents of EEPROM--a relatively simply process that can be performed using readily available, relatively inexpensive equipment. Because of this "reverse engineering" possibility, the security of the entire radio communications system becomes compromised if even a single radio transceiver falls into the wrong hands. Of course, it is always possible in such a system to change encryption keys on a system-wide basis--but the logistical difficulty of reprogramming each individual radio transceiver at a service depot using a key loader would cause secure communications to be disrupted for hours, days or even longer.
There have been prior attempts to securely store encryption keys within a mobile radio transceiver. See, for example, U.S. Pat. No. 5,150,412 to Maru, which discloses a mobile radio telephone including a single chip microcomputer (security module) including an internal non-volatile EEPROM encryption/decryption key store. Whenever external access of the EEPROM key store is attempted (e.g., in order to test the function of the key store), circuitry automatically clears the EEPROM contents--thereby preserving the secrecy of the encryption/decryption keys. This technique has the drawback of requiring a specially designed security module with special-purpose circuitry for destroying key store contents when external access is attempted.
It would be highly desirable to provide an arrangement for safeguarding the secrecy of encryption/decryption keys stored by a mobile/portable radio transceiver that does not require any additional hardware components or other costly additions to the transceiver architecture and yet provides flexibility in securely storing a large number of selectable different cryptographic keys.
The present invention provides a digital radio having a table in non-volatile memory such as EEPROM for "key storage" as in prior VGE products, but the "keys" are stored in an "encrypted" form such that their identities are not readily revealed by a "dump" of memory contents. Additional security is provided in accordance with the present invention by extracting the "keys" from the stored table and re-"encrypting" the entire table each time a key loader device is attached to the radio. This re-encryption adds another level of complexity to the process should someone attempt to "break" the cryptosystem by repetitively loading different "keys" into the radio.
In somewhat more detail, a digital radio provided by the present invention "hides" or "shrouds" its key store information by in some sense "encrypting" the key information before storing it in the radio's internal EEPROM memory. A pseudo-random function is used as part of the shrouding technique. This use of a pseudo-randomization factor means that the keys are shrouded differently from one radio to the next--and that the same radio shrouds the keys differently from one shrouding operation to the next. An unauthorized person trying to gain access to the keys will presumably "dump" the entire contents of the EEPROM including the key store, but this information will be useless unless she also knows the particular shrouding transformation used. To learn the shrouding technique, the attacker would have to dump the entire program store and reverse engineer the control program software in detail--an extremely expensive and time-consuming process exposing the attacker to copyright infringement liability.
A mobile or portable digital radio provided by the present invention first constructs and writes a table containing pseudo-random data into a key store section of internal EEPROM. The radio's cryptographic keys are written "over" the random data, and are written at locations which can change from one key loading operation to the next--thereby "hiding" the cryptographic keys by "burying" them somewhere in a "sea" of pseudo-random data. As an additional protection in the preferred embodiment, the keys before being stored are first "encrypted" in a sense that they are transformed based at least in part on random data stored in other parts of the table. As a result, the stored cryptographic keys are hidden among a series of random data values, and the stored key data itself "looks" like random data. As a result, an attacker would be unable to learn the identity of the stored cryptographic keys from a dump of the EEPROM table unless she knew where to find the stored keys within the table, and unless she also knew what particular transformation should be used to decrypt and thereby recover the keys.
In accordance with a further feature provided by the present invention, the entire table randomization and transformation process is repeated every time a key loader device is connected to the radio transceiver. The actual key data is extracted by performing an inverse transformation, and a random number generator is used to re-randomize the table. The key data is transformed using the newly randomized table and the cryptographic keys along with the associated (new) index are redeposited into the table. This means that the keys typically end up being stored in a different place within the table, and that a different decryption/extraction transformation based on the information stored in the table must be used to recover them.
In accordance with a further feature provided by the present invention, multiple key banks are used to provide enhanced voice security by increasing the number of encryption keys available for use by a radio. This feature provides the additional advantages that the number of times a radio must be key loaded is reduced, and the number of personality configurations for groups, channels, and systems is greatly increased.
Prior portable or mobile two-way radios store only a limited number of encryption keys (e.g., seven encryption keys for EGE's Voice-Guard private voice operation, and six encryption keys for EGE's AEGIS private voice operation). Different keys can be selected for channels, groups and special calls. The number of keys to choose from is very limited. Also, if the user feels private voice calls are no longer secure using the programmed key, the only choice the user has is to discontinue communications until the radio can be key loaded with new encryption keys. Key loading the radio can be very time consuming because each radio must be individually connected to the key loader.
The preferred embodiment provided by the present invention solves this problem by using multiple banks of encryption keys--all stored in the same random-data EEPROM table described above. The radio can store multiple banks of keys with n (e.g., six or seven) keys per bank to maintain compatibility with existing radios. The key bank to use can be specified on a per system basis using a radio personality. The radio personality can contain the same system data repeated multiple times with only the key bank changing. The following illustrates an exemplary radio personality:
______________________________________ System Key Key Bank Group Key ______________________________________ SYS1 3 1 Fire 1 SYS2 3 2 Fire 1 ______________________________________ (with key banks 1 and 2 containing different sets of cryptographic keys).
If users feel trunked calls on the group "fire" are no longer secure on system "SYS1," the users can instantly change to the other system "SYS2" and continue encrypted communications using different encryption keys stored in key bank 2. Increasing the number of keys available to the user provides for more configurations on the radio personality. For example, conventional (non-trunked) operation could use the first four banks of keys, and trunked operation could use the second four banks. Different banks and/or keys can be used for different cryptographic modes (e.g., VGS, VGE or DES). In addition, increasing the number of encryption keys that can be stored in the radio can reduce how often the radio needs to be key loaded.