Abstract
P
ublic Safety agencies are highly invested and dependent on their Land Mobile Radio (LMR) systems. They are also somewhat discontent with the high cost of maintenance and the lack of interoperability. The Public Safety associations would like nothing better than to reduce costs by moving some of their subscribers to mobile broadband commercial devices. However, LMR communication is critical for certain aspects of operation such as crisis management, secure tactical operations, and its reliability and availability. Therefore, there is a critical need for a Public Safety radio system that can support both LMR and Secure Cellular Push-to-Talk (PTT) users.This paper discusses how interoperability can be achieved between Secure Cellular PTT and LMR.
Law enforcement and first responders’ ability to securely communicate is revolutionized with Secure Cellular PTT and the interoperability with LMR systems. With a standard cell phone, whether within the RF footprint of the LMR system or not, managers, agents and officers can communicate with their LMR system users, providing a great tactical advantage.
This ability, using commercial cellular networks, provides enhanced coverage and access for routine daily use. It is recognized that LMR systems will continue to be necessary for tactical use and their security, reliability and availability in a crisis or tactical situation. To address the reliability and availability of
broadband services to the Public Safety community, the Federal Communications Commission (FCC) is in the process of creating a Public Safety Nationwide Wireless Broadband Communications Network, which is funded by grants from the U.S. Department of Commerce.
This new network will allow first responders nationwide to communicate with each other quickly and efficiently, providing mobile access to information systems. The network is based on Long Term Evolution (LTE) technology, the same technology that cellular operators are now deploying as the next generation (4G) of their commercial networks. The Public Safety network will operate in the 700 MHz band. While this new nationwide mobile broadband network will solve many issues, it introduces another challenge, that of interoperability with existing LMR systems. This paper discusses interoperability between the new generation of Secure Cellular PTT radio systems and existing LMR systems. Such interoperability is independent of the cellular network provider, whether it is a commercial network or private Public Safety network.
Introduction
Secure Cellular PTT
Coverage Challenge
Allowing users to communicate with each other and with one-to-many when outside their LMR system RF footprint has resulted in the offering of cellular PTT technology. However, security and voice quality have been less than desirable.
Covertness Challenge
When conducting certain types of law enforcement operations, the use of tactical radios is inappropriate because of the difficulty in maintaining discreteness. This challenge is created by the mere size of a radio, as well as its necessity to emit power during use. Both factors make the tactical radio detectible by the subjects of investigation.
Solution
The introduction of the high-speed wireless Internet Protocol (IP) packet data service has given rise to a number of new Voice over IP applications; one such application is Secure Cellular PTT. Secure Cellular PTT is delivering a host of capabilities to mobile broadband subscribers that were only recently available on dedicated LMR systems. Such capabilities include:
• AES Voice Encryption
• Half-Duplex Person-to-Person Calls • Half-Duplex Person-to-Group Calls • Dynamic Regrouping
• Priority Emergency and Broadcast Calling • Over the Air Provisioning
• Over the Air Re-Keying • User and Group Priority • Dispatch Capabilities • Text Messaging
Secure Cellular PTT is a data application and as such is not dependent on a specific radio system transport mechanism. It can execute on any radio system that provides the right level of performance (e.g., TD-CDMA, CDMA-EVDO, W-CDMA, HSPA, 802.11). This means that Secure PTT applications can execute on a commercial cellular infrastructure. This is particularly attractive to Public Safety agencies as it makes it less expensive to construct new networks on the back of existing cellular infrastructure. Also, as commercial carriers converge on the LTE mobile broadband standard, it is envisaged that in the future Public Safety personnel will be able to make use of a variety of commercial and private cellular networks.
A typical Secure Cellular PTT application usually consists of a PTT client that resides on the end-user device (smart phone), a set of application servers (that are reached over the Internet), a dispatch console and a radio gateway (see Figure 1. Secure Cellular PTT Architecture).
Mobile
Broadband
Network
Application Servers Dispatch Console Secure PTT Client Radio GatewayLMR Interoperability
In the absence of a radio device with a dual air control interface that can operate on both a mobile broadband and an LMR network, interoperability must be achieved through interoperability gateways. These gateways are usually part of a conferencing system and organized in a hub-and-spoke type architecture (see Figure 2. Hub-and-Spoke Conferencing System).
Conferencing System Interop Gateway LMR Network LMR Network
Mobile Broadband Network
Interop Gateway Interop Gateway Interop Gateway Mobile Broadband Network
Interoperability gateways usually come in two forms: Radio Gateways or Network Gateways.
Radio Gateway
At present, the Radio Gateway (RGW) is by far the most common method of interoperability. It works by connecting two radio systems together via an analog four-wire ear and mouth interface.
There are three types of commonly used configurations: tactical, strategic and hybrid.
Tactical Configuration
In a Tactical Configuration, a donor radio for each radio system is connected to the RGW via the radio’s microphone and speaker ports (usually with a special cable). When a subscriber on one radio system presses PTT and talks, the donor radio on that network receives the RF communication and plays it out through its speaker port to the RGW. The RGW then feeds the incoming audio to the other donor radio through the radio’s microphone input. The donor radio then transmits the received voice into its home radio network (see Figure 3. RGW Tactical Configuration).
Radio System 1
Radio System 2
Donor Donor
PTT
RGW
Figure 3. RGW Tactical Configuration
Donor
Conferencing or
Radio System
Radio System 1
RGW
Figure 4. RGW Strategic Configuration
Hybrid Configuration
In a Hybrid Configuration, two radio gateway devices are attached together to connect the radio systems via an analog bridge. There are no donor radios (see Figure 5. RGW Hybrid Configuration).
Conferencing or Radio System Radio System 1 PTT Voice Switch RGW RGW PTT E & M
Figure 5. RGW Hybrid Configuration
Strategic Configuration
In a Strategic Configuration, the donor radio is also connected to the RGW through its microphone and speaker ports. When a subscriber on the donor radio’s home network selects PTT and talks, the donor radio receives the RF communication and plays it out through its speaker port into the RGW. The RGW then converts the analog signal to digital Voice over IP and transmits it into the radio or conferencing system. Conversely, when the RGW receives a voice stream from the radio or conferencing system, it converts it to analog and feeds it into the donor radio microphone. The donor radio then transmits it into its home network (see Figure 4. RGW Strategic Configuration).
Network Gateway
A Network Gateway (NGW) connects two radio systems together over an IP connection. The voice streams that pass through the gateway are kept in IP packet format. This provides a much higher level of integration than an RGW.
The NGW is the interface between the conferencing system and the foreign radio system. It is usually specialized to interface with a specific type of radio system (e.g., P25, USCG Rescue 21). It can adapt an incoming voice stream to its local format or adapt an outgoing voice stream to the format of the foreign radio system.
NGWs can also sit between two radio systems in a point-to-point type architecture (e.g., P25 inter-RF subsystem interface (ISSI)), but they provide the most value when connected to a centralized conferencing system in a hub-and-spoke architecture.
An NGW provides the following functions: • Voice Trans-Coding
• Floor Control
• Encryption/Decryption
• Caller Information Pass Through
• Prioritization for Emergencies or Quality of Service (QOS) • Scalability
Voice Trans-Coding
Heterogeneous radio systems often use different codecs for encoding their voice streams. For example, P25 uses improved multi-band excitation (IMBE), whereas mobile broadband uses adaptive multi-rate (AMR). In order to pass voice streams between different systems, the voice stream must be adapted to the target format.
Floor Control
Heterogeneous radio systems often handle floor control differently. In a P25 system, floor control is embedded in the IMBE voice stream. In a PTT Over Cellular system, floor control is achieved via real-time transport control protocol (RTCP) signaling. In order to synchronize floor control between different systems, the floor control must be adapted to the target system.
When multiple PTT radio systems are connected together, floor control may become an issue, as there are multiple PTT arbitrators. Protocols like ISSI solve this problem by mandating that the floor control arbitrator is the owner of the talk group. In this way, a P25 radio system will defer floor control arbitration to another radio system if it is not the owner of the talk group. A conferencing system must honor this relationship. In order to simplify things, some conferencing systems will own the interoperability talk group and provide arbitration.
Encryption/Decryption
An NGW may be required to encrypt or decrypt a voice stream as it enters or leaves the conferencing system. Voice streams are encrypted by the gateway as they are transferred into the foreign radio system. Voice streams are decrypted by the NGW as they are received from the foreign radio system.
If the communicating radio systems are compatible and share encryption keys, the voice stream can be passed encrypted through the network gateways, providing end-to-end encryption.
Caller Information Pass Through
An NGW can pass caller information transparently through to the target radio system. This may include a subscriber ID or alias name.
Prioritization for Emergencies or Quality of Service (QOS)
An NGW is capable of preserving the emergency status of a call. It can also pass through QOS information and prioritize resources based on the caller’s priority.
Scalability
An NGW can be scaled to simultaneously handle multiple voice streams. This is quite different from an RGW which can only handle one voice stream at a time and is often bound to a specific talk group or channel.
Voice Conferencing System
The voice conferencing system ties the radio and network gateways together and manages the media relationships between the different radio access networks.
The conferencing system provides the following capabilities: • Conference Management
• Agency Privacy
• Consolidated Dispatch Console • Access to Radio Access Networks • Management of Key Information • Virtual Radio
• Asset Normalization and Presence • Conference Security
Conference Management
The conferencing system enables the dynamic creation, deletion and modification of voice conferences. The voice conferencing system manages the signaling and voice communication between its members. Conference members are usually assets from connected radio access networks (i.e., radio talk groups, radio subscribers, radio channels, PSTN users, etc.).
Agency Privacy
The conferencing system must maintain privacy between the agencies that it hosts. For example, an FBI operator should not have visibility to a CBP asset, unless permitted to do so.
Consolidated Dispatch Console
Most conferencing systems provide an agency consolidated dispatch console. This dispatch console has visibility to all agency assets available for conferencing. These assets represent channels, talk groups and subscribers on different radio access networks that need to interoperate. The dispatch console can monitor and participate in the voice conferences.
Access to Radio Access Networks
The conferencing system ties the radio and network gateways together. A conference membership may be made up of voice assets from multiple radio access networks that are accessed through multiple gateways.
Management of Key Information
A conferencing system network gateway often holds keys for the radio access network with which it interfaces. For example, a Secure PTT Cellular gateway may hold the keys for the groups with which it interfaces. If implemented correctly, the gateway would automatically receive key updates when the radio access network updates its radios. This way the radio gateways always have the current keys.
Virtual Radio
Most conferencing systems have a virtual radio implementation. This is a data application that runs on an end-user device (i.e., laptop, desktop, smart phone, tablet PC, etc.). The application functions as a radio device and, at a minimum, allows the user to talk and listen to voice over the conference.
Asset Presence and Normalization
The conference system detects when a radio system asset is available (connected). It provides presence information to other conference system assets. It is also able to take assets from heterogeneous radio access networks and normalize them so they appear as homogeneous assets within the conference system. This way the conference system can manipulate objects that have similar attributes.
Conference Security
Conference Systems support different levels of security: • Unsecure Mode
• Secure Mode
• End-to-End Secure Mode • Mixed Mode
Unsecure Mode
Unsecure conferences are not encrypted. The members are assets who do not encrypt their voice. Therefore there are no keys involved.
Secure PTT Cellular Conferencing System POC GW ISSI GW P.25 LMR Legacy LMR Donor Radio Key 1 Key 2 Key 3 Legacy GW
Figure 6. Secure Mode Encryption
Secure Mode
In a Secure mode of operation, the end-user voice stream is decrypted when it enters the conference system and encrypted when it leaves the conference system. Secure mode allows end users with different keys to communicate because the voice streams are decrypted within the conference system. Figure 6. Secure Mode Encryption shows three radio systems, each using a different key: Secure Cellular PTT, P25 LMR and legacy LMR. Internet Protocol Security (IPsec) protocols are used between gateways as the voice stream is in the clear. The ISSI and Push-to-Talk Over Cellular (POC) gateway encrypts and decrypts voice as it enters and leaves the conference system. The Legacy System is accessed through a donor radio connected to a Legacy Gateway. The donor radio encrypts and decrypts the voice as it enters and leaves the legacy network. The interface between the donor radio and the Legacy Gateway is analog (and in the clear) but is digitized at the Legacy Gateway.
Secure PTT Cellular Conferencing System POC GW ISSI GW P.25 LMR Key 1 Key 1
Figure 7. End-to-End Encryption
End-to-End Encrypted Mode
In End-to-End Encryption mode, the voice is encrypted by the source radio and is only decrypted at the destination radio. The voice stream remains encrypted from end to end, over both the wireless and wire line connections as shown in Figure 7. End-to-End Encryption. This is only possible between endpoints that have the same vocoder and encryption scheme. For this to work between a Secure Cellular PTT endpoint and P25 LMR endpoint, the cellular device would have to have a P25 vocoder and share the same keys. While this is possible, it is very unlikely as the secure mode of operation should be satisfactory for most applications.
Secure PTT Cellular Conferencing System POC GW ISSI GW P.25 LMR Legacy LMR Donor Radio Key 1 Encrypted Clear No key Legacy GW
Figure 8. Mixed Mode Encryption
Mixed Mode
Mixed Mode operation enables an encrypted talk group to participate in a clear conference, as shown in Figure 8. Mixed Mode Encryption. The voice stream is encrypted and decrypted as it enters and leaves the conference system. The voice stream is un-encrypted (clear) within the conference system and with the other members of the conference.
This type of conference would only be used under special circumstances, and would be enabled through a system policy and permissions with confirmation by an agency administrator.
Conclusion
Commercial mobile devices and commercial networks can greatly reduce costs and enhance
communications capabilities for law enforcement and first responders. These commercial assets will not replace the need for LMR systems, but their interoperability with those systems will revolutionize the way law enforcement and first responders communicate with each other.
For routine daily use, there are many circumstances where Secure Cellular PTT is preferred over the use of LMR. For instance, LMR systems have a specific coverage area and at times people who need to communicate are outside that coverage. With the ever-increasing coverage of commercial cellular networks and interoperability with LMR, coverage limitations are greatly diminished. Secondly, agents and officers require discretion in their work when conducting surveillance, but also need to be able to communicate with their partners on tactical radios on foot, in cars, on boats or in planes. Talking on a cell phone is much more discrete than a police radio. Additionally, the power emitted from a cell phone is within the same range of all other commercial users and, thus, indiscernible as law enforcement. Finally, LMR systems typically are not designed for in-building coverage. Cellular networks provide superior in-building coverage. LMR systems are required for their security, reliability and availability during crisis management or other tactical use. Private Public Safety broadband networks may eventually provide the same level of security, reliability and availability, but their coverage will never equal that of commercial networks.
Interoperability between these networks is paramount to achieve the most effective communication for law enforcement and first responders. Several configuration options are available to achieve this interoperability. General Dynamics C4 Systems is uniquely qualified to develop and integrate secure communication and information systems and technology. The company specializes in command and control, communications networking, computing and information assurance for defense, government and select commercial customers in the United States and abroad.
Acronyms
Acronym Meaning
AES Advanced Encryption Standard CBP Customs and Border Protection
CDMA Code Division Multiple Access – Refers to cellular systems offered by Verizon E&M Ear and Mouth
FBI Federal Bureau of Investigation FCC Federal Communications Commission G.711 64 kbps voice encoding scheme G.729 16 kbps voice encoding scheme
GD General Dynamics
IMBE Improved Multiband Excitation
IP Internet Protocol
IPSEC Internet Protocol Security
ISSI P25 Inter-RF Subsystem Interface (ISSI). See reference [2]
LMR Land Mobile Radio
LTE Long Term Evolution
MHz Megahertz
OFDMA Orthogonal Frequency-Division Multiple Access OTAR Over the air rekeying
PTT Push-To-Talk Over Cellular. Standard for cellular PTT operation over digital channels. See reference [3] below
PSTN Public Switched Telephone Network
RF Radio Frequency. Refers to a communication medium physical layer that modulates electro- magnetic waves
RTP Real Time Protocol
SIP Session Initiation Protocol. An open extensible messaging protocol for managing sessions TD-CDMA Time Division-Code Division Multiple Access
TG Talkgroup
UDP Unit Datagram Protocol. An IP packet with ports and non-guaranteed delivery UHF Ultra High Frequency
VHF Very High Frequency VoIP Voice over Internet Protocol
Definitions
Term Definition
4G Fourth Generation of cellular wireless standards
CrossComm® A conferencing system from General Dynamics that provides custom interoperability features specifically applicable to mobile broadband and LMR. This product requires development. CrossComm is a registered trademark of General Dynamics.
Full Duplex A form of communications where multiple parties in a conversation can speak simultaneously. Half Duplex A form of communications where only one party in a conversation can speak any given time. Floor Control Floor control in the context of PTT voice groups is an arbitration mechanism that grants
temporary permission to group participants in order to guarantee that when one talks the others listen.
Push-to-Talk A two way communications method that uses the Half Duplex mode of operation. To use PTT, users must press a button on the PTT device while speaking, then release it when done. The listener must then do the same to respond.
Reference Documents
[1] 99-P56480P, General Dynamics IWN Interoperability Architecture White Paper [2] TIA-102.BACA-A – Project 25 Inter-SubSystem Interface
