# US 2014/0195801 A1 · Method and system for encryption of messages in land mobile radio systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0195801 A1 - Document ID: US20140195801A1 - Status: Published application - Kind: A1 - Application number: 14/200,812 - Filed: 2014-03-07 - Published: 2014-07-10 - Earliest claimed: 2007-07-19 - Assignees: E.F. Johnson Company - Applicants: E.F. Johnson Company - Inventors: Jeffery E. Benshetler; Arindam Roy - Web page: https://patentgrep.com/patent/US20140195801A1 ## CPC - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/321: {involving a third party or a trusted authority} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04W 12/069: using certificates or pre-shared keys - H04L 9/00: {Cryptographic mechanisms or cryptographic} arrangements for secret or secure communications; Network security protocols - H04L 2209/80: Wireless - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method and system for authentication of sites in a land mobile radio (LMR) system and encryption of messages exchanged by the sites. In some embodiments, the method includes transmitting a certificate created by a trusted authority by applying a function to a first site public key using the trusted authority's private key to generate a reduced representation, which is encrypted with the trusted authority's private key. Other sites may receive the certificate, decrypt it using the trusted authority's public key, and authenticate the first site. The method may further include generating a session key, encrypting it with the public key of the first site, and transmitting the encrypted session key to the first site. The first site decrypts the encrypted session key with the first site's private key, and transmits a message encrypted with the shared session key to other sites for decryption using the session key. ## Claims ### Claim 1 A method for authenticating a plurality of sites in a land mobile radio (LMR) system and encrypting messages exchanged by the sites, the plurality of sites being connected by a data network, the method comprising: receiving, by one or more of the plurality of sites in the LMR system, a certificate transmitted by a first site, wherein the certificate is encrypted; decrypting, by the one or more of the plurality of sites, the certificate transmitted by the first site; authenticating the first site; generating a shared session key that is valid across a group of sites in the LMR system; encrypting the shared session key; and transmitting the encrypted shared session key to the first site for use by the first site to encrypt a message for multicast transmission. ### Claim 2 (depends on 1) The method according to claim 1, wherein the certificate is created by a trusted authority by encrypting at least a public key of the first site with the trusted authority's private key. ### Claim 3 (depends on 2) The method according to claim 2, wherein the certificate is decrypted using the trusted authority's public key. ### Claim 4 (depends on 2) The method according to claim 2, wherein the shared session key is encrypted with the public key of the first site. ### Claim 5 (depends on 2) The method according to claim 2, further comprising: applying a hash function to the public key of the first site to create a reduced representation, wherein a certificate of the first site is generated by encrypting the reduced representation with the private key of the trusted authority. ### Claim 6 (depends on 5) The method according to claim 5 further comprising: decrypting the certificate with the trusted authority's private key; and comparing the decrypted certificate with a locally calculated hash of the public key and authenticating the site. ### Claim 7 (depends on 1) The method according to claim 1, wherein the encrypted shared session key is transmitted to the first site for decryption by the first site using a private key of the first site. ### Claim 8 (depends on 1) The method according to claim 1, wherein the group of sites in the LMR system is a multicast group. ### Claim 9 (depends on 1) The method according to claim 1, wherein the message encrypted by the first site is transmitted by multicasting the encrypted message to the group of sites in the LMR system. ### Claim 10 (depends on 1) The method according to claim 1, wherein the message encrypted by the first site is transmitted by multicasting the encrypted message on an IP network. ### Claim 11 (depends on 1) The method according to claim 1, wherein the message encrypted by the first site is transmitted by multicasting the encrypted message on a packet switched network. ### Claim 12 (depends on 1) The method according to claim 1 further comprising: receiving, by the one or more of the plurality of sites in the LMR system, the message encrypted by the first site; and decrypting the encrypted message with the shared session key. ### Claim 13 (depends on 1) The method according to claim 1, wherein the certificate is a digital certificate of the first site. ### Claim 14 (depends on 1) The method according to claim 1 further comprising: transmitting, by each of the one or more of the plurality of sites, its respective certificate when the site intends to communicate with other sites; and receiving an updated shared session key after the site is authenticated. ### Claim 15 (depends on 1) The method according to claim 1, wherein the shared session key is a symmetric session key. ### Claim 16 (depends on 1) The method according to claim 1, wherein the shared session key is a secret symmetric session key. ### Claim 17 (depends on 1) The method according to claim 1 further comprising transmitting a new shared session key after a predetermined time interval. ### Claim 18 (depends on 1) The method according to claim 1 further comprising transmitting a new shared session key when a site intends to exchange messages. ### Claim 19 A computer-implemented method for authenticating a plurality of sites in a land mobile radio (LMR) system and for encrypting messages exchanged by the sites, the plurality of sites being connected by an IP network, the computer-implemented method comprising: transmitting, by a first site, a certificate of the first site; generating a shared session key that is valid across a group of sites in the LMR system; receiving, by the first site, the shared session key, wherein the shared session key is encrypted; decrypting, by the first site, the encrypted shared session key with a private key of the first site; and transmitting, by the first site, a multicast message encrypted with the shared session key. ### Claim 20 (depends on 19) The computer-implemented method according to claim 19, wherein the certificate is created by a trusted authority by encrypting at least a public key of the first site with the trusted authority's private key. ### Claim 21 (depends on 20) The computer-implemented method according to claim 20, wherein the certificate is decrypted using the trusted authority's public key. ### Claim 22 (depends on 20) The computer-implemented method according to claim 20, wherein the shared session key is encrypted with the public key of the first site. ### Claim 23 (depends on 19) The computer-implemented method according to claim 19, wherein the certificate is transmitted by the first site for at least one of receipt, authentication, and decryption by other sites in the LMR system. ### Claim 24 (depends on 19) The computer-implemented method according to claim 19, wherein the group of sites in the LMR system is a multicast group. ### Claim 25 (depends on 19) The computer-implemented method according to claim 19, wherein transmitting the multicast message encrypted with the shared session key comprises multicasting the encrypted multicast message. ### Claim 26 A system for authenticating a plurality of sites in a land mobile radio (LMR) system and for encrypting messages exchanged by the sites, the plurality of sites being connected by an IP network, the system utilizing a plurality of method steps comprising: transmitting, by a first site, a certificate of the first site; generating a shared session key that is valid across a group of sites in the LMR system; receiving, by the first site, the shared session key, wherein the shared session key is encrypted; decrypting, by the first site, the encrypted shared session key with a private key of the first site; and transmitting, by the first site, a multicast message encrypted with the shared session key. ### Claim 27 (depends on 26) The system according to claim 26, wherein the certificate is created by a trusted authority by encrypting at least a public key of the first site with the trusted authority's private key. ### Claim 28 (depends on 27) The system according to claim 27, wherein the certificate is decrypted using the trusted authority's public key. ### Claim 29 (depends on 27) The system according to claim 27, wherein the shared session key is encrypted with the public key of the first site. ### Claim 30 (depends on 26) The system according to claim 26, wherein the certificate is transmitted by the first site for at least one of receipt, authentication, and decryption by other sites in the LMR system. ### Claim 31 (depends on 26) The system according to claim 26, wherein the method steps further comprise multicasting the multicast message encrypted with the shared session key. ### Claim 32 (depends on 26) The system according to claim 26, wherein the encrypted multicast message is transmitted by the first site for receipt and decryption by other sites in the LMR system, wherein the encrypted multicast message is decrypted with the shared session key. ### Claim 33 (depends on 26) The system according to claim 26, wherein the group of which the sites in the LMR system are members is a multicast group.