WO2003103322A1

WO2003103322A1 - Wireless communication system, apparatus and method

Info

Publication number: WO2003103322A1
Application number: PCT/EP2003/050147
Authority: WO
Inventors: Mark Shahaf; Salomon Serfaty; Nimrod Glazer
Original assignee: Motorola Inc; Motorola Limited
Priority date: 2002-06-01
Filing date: 2003-05-07
Publication date: 2003-12-11
Also published as: ES2326472T3; AU2003240784A1; AU2003240784A8; ATE431051T1; GB0212840D0; EP1514444B1; EP1514444A1; GB2389276A; GB2389276B; DE60327524D1

Abstract

A wireless communication system (100) includes at least one wireless serving communication unit (122) having a processor (320), operably coupled to a transmitter (220), encrypting network identification data (330) for transmission to a remote communication unit (112). A remote communication unit (112) includes a receiver (210) for receiving encrypted network identification data (330) from at least one of the serving wireless communication units (122-132), and a processor (360) to decrypt the encrypted network identification data (340) in order to determine whether the serving wireless communication unit (122) is a valid serving wireless communication unit (122). A remote communication unit (112), a broadcast message, a wireless serving communication unit (122) and method for obtaining network identification data (330) 20 are also provided. In this manner, fraudulent wireless serving communication units or fraudulent networks can be more readily detected.

Description

WIRELESS COMMUNICATION SYSTEM, APPARATUS AND

METHOD

Field of the Invention

This invention relates to a wireless communication system, and apparatus and a method for use in such a system. In particular, it relates to obtaining valid identification data in a wireless communication network. The invention is applicable to, but not limited to, a procedure for obtaining valid network identification data, in order to prevent fraudulent networks or fraudulent base stations disrupting communications.

Background of the Invention

Wireless communication systems, for example cellular or trunked telephony or private mobile radio communication systems, typically provide for radio telecommunication links to be arranged between a network infrastructure including a plurality of base transceiver stations (BTSs) and a plurality of subscriber units, often termed mobile stations, (MSs) and between mobile stations via the infrastructure. The term ^ΛMS' generally includes both hand-portable and vehicular mounted terminals capable of wireless communication of user information, e.g. one or more of speech, data, picture or video information, by radio. Thus, in the context of the present invention, the term ^MS' is used to encompass any remote wireless communication unit, such as a pager, cellular phone, personal digital assistant (PDA) , mobile radio, portable or mobile telephone, or mobile data terminal requiring a wireless link in order to communicate.

In a wireless communication system, each BTS has associated with it a particular geographical coverage area (or cell) . The coverage area defines a particular range that the BTS can maintain acceptable communications with MSs operating within its serving cell. Often these cells combine to produce an expanded system coverage area.

Multiple access techniques permit simultaneous transmissions from several MSs to a single BTS over a plurality of communications channels. Some channels are used for carrying traffic communications, whilst other channels (which may be logical or dedicated channels) are used for transferring control information, such as call paging, between the base transceiver stations and subscriber units. Examples of multiple access techniques include: frequency division multiple access (FDMA) , time division multiplexing/ multiple access (TDM, TDMA) and code division multiple access (CDMA) .

In the field of this invention, it is known that wireless cell-based telecommunication systems employ authorised access and access security protocols, designed for wireless environments, which are shared by many users and systems. In contrast to a wireline communication system, where access to a communication resource (channel) is via a physically connected node, a wireless resource is available to any appropriately configured communication equipment implementing physical layer communication functionality.

It is known that a MS needs to access a valid communication network and that the MS has to be permitted to access the network. The present inventors have appreciated a problem relating to such network access, which is particularly severe in cellular networks due to their widespread coverage and rapidly growing population of systems, users, services and applications.

The infrastructures of cellular systems use their so- called broadcast channels monitored by all MS to inform all potential users of the network-specific parameters. For example, in a Global System for Mobile (GSM) communication system the Broadcast Control CHannel (BCCH) continually broadcasts on the downlink specific system information, including: base station identity, frequency allocations, frequency-hopping sequences, system timing, mobile network identifier, known as a combination of the mobile country code and mobile network code (MNI), etc. In GSM systems the MNI determines whether a cellular subscriber unit is able to access a particular network.

However, the inventors have recognised that such wireless systems are inefficient in supporting protocols to enable network validation. As most cellular standards are driven by commercial market requirements, there exists a significant risk that an unauthorized or ^Λcloned' transmitting terminal purporting to be a base transceiver station could be established to ^Λ capture' communications by the MSs of the system and thereby influence access to the correct wireless network.

In particular, from the moment an MS has been ^captured' by the fraudulent network, the user may be either blocked or provided with a false service, thereby making him/her vulnerable to receiving misleading information, etc.

A further problem recognised by the inventors of the present invention relates to known enhanced authentication procedures that enable MSs to validate the network as being legitimate. This enhancement mechanism has the disadvantage that it requires a MS firstly to access and camp on the target cell, which may include a fraudulent BTS, and perform the signalling exchange comprising the authentication procedure. This will eventually result in the MS leaving the legitimate network to communicate on the fraudulent network. Although, the known authentication procedure may identify the BTS/network as fraudulent, such identification is likely to require a significant period of time in which the user is unable to access a desired communication resource/service. This is unacceptable for mission- critical users such as public safety and governmental organisations.

A further disadvantage of known authentication procedures is that they are limited to trunked radio communication systems. The procedure of network authentication does not exist in the widely deployed commercial systems such as GSM, CDMA 2000, and future 3^rd generation cellular communication systems (3G) . The introduction of authentication functionality into these systems would require significant modifications to the air interface specifications as well as a major impact on the system components .

Thus, there currently exists a need to provide an improved communication system, a communication unit and method for obtaining network identification data in a wireless communication system, wherein the abovementioned disadvantages may be alleviated.

Summary of the Invention

In accordance with a first aspect of the present invention, there is provided a wireless communication system. The wireless communication system includes at least one wireless serving communication unit serving a plurality of remote units with a communication resource. The at least one wireless serving communication unit includes a transmitter for transmitting data to at least one remote unit and a processor, operably coupled to the transmitter, encrypting network identification data. The encrypted network identification data is transmitted to a remote communication unit. The remote communication unit includes a receiver for receiving encrypted network identification data from the at least one serving wireless communication unit, and a processor, operably coupled to the receiver, decrypting the encrypted network identification data to determine whether the serving wireless communication unit is a valid serving wireless communication unit.

In accordance with a second aspect of the present invention, there is provided a wireless serving communication terminal, e.g. a base transceiver station, operable in the system according to the first aspect described above.

In accordance with a third aspect of the present invention, there is provided a wireless communication terminal, e.g. a mobile station, operable as the remote terminal as described above.

In accordance with a fourth aspect of the present invention, there is provided a broadcast transmission message broadcast from a wireless serving communication terminal to a plurality_.of remote communication terminals in a wireless communication system. The broadcast transmission message includes encrypted network identification data.

In accordance with a fifth aspect of the present invention, there is provided a method of obtaining network identification data on a wireless communication system having at least one wireless serving communication terminal serving a plurality of remote communication terminals with a communication resource. The method includes the steps of encrypting network identification data at a wireless serving communication unit and transmitting the encrypted network identification data to a remote communication unit. The remote communication unit receives the encrypted network identification data and decrypts the encrypted network identification data to determine whether the serving wireless communication terminal is a valid serving wireless communication terminal .

In accordance with a sixth aspect of the present invention, there is provided a storage medium storing processor-implementable instructions or data for controlling a processor used in a method according to the fifth aspect.

Further features of the invention are defined in the accompanying claims .

In summary, the inventors of the present invention have recognised that a fraudulent infrastructure or a fraudulent transmitting station may be set up to attract wireless subscriber units away from their desired network. Therefore, one aspect of the present invention introduces an encryption/decryption procedure to encrypt/decrypt network or infrastructure identification data to minimise the risks associated with such fraudulent network or fraudulent transmitter activity.

The invention eliminates the possibility of a mobile station camping on a transmitting station which is a false station. By having the data identifying each valid base transceiver station encrypted, preferably dynamically encrypted, e.g. through the use of time, geographical information, frame or multiframe, etc., the mobile station can detect from the received signal that the appropriate encrypted identity data is not included in the signal, and that the transmitting station is a false one. This procedure is beneficial when the mobile station is undertaking a cell selection or reselection procedure. In such a procedure, the mobile station may scan neighbouring transmitting stations to select possible candidates as serving base transceiver stations. The mobile station may for example measure one or more parameters of a signal received from each candidate serving station, e.g. the received signal strength and/or quality, as known in the art, and thereby form a list of the selected stations in preference order. If a transmitting station is determined by the mobile station to be false, by not including its encrypted identity information in the signal transmitted by it, it can be rejected from the list of possibilities included in the list of preferred candidate serving base stations before any two way communications are established.

This cell selection or re-selection procedure taking advantage of the invention is especially important in mission critical applications where camping onto a false transmitting station and then further determining that the base station is false may cause a waste of precious time. Thus, the invention beneficially allows detection of a transmitting station to be false to be made before the mobile station camps on the transmitting station and thereby saves valuable operational time. When it has been determined that a base station is not a false one and when a mobile station has then camped onto that base station, then other challenge/response authentication measures as are known in the prior art may be undertaken.

GB-A-2297016A, WO-A-01/91503 and WO-A-00/35223A1 describe procedures for authentication of the user of a mobile station by the system infrastructure. These procedures are carried out when the user is already camped on the base station. This is in contrast to the invention in which the user of a mobile station is able initially to identify that a base station is a valid base station, and not a fraudulent one. In WO- -00/35223 a mutual authentication procedure is proposed. For this, every user would need to authenticate himself and to authenticate the base station using one-to-one challenge/response transmissions .

EP-A-1005244 describes a procedure which prevents a user's mobile station from transmitting data to a false base-station or network, by using a challenge/response procedure that involves a trusted third party. However, this procedure is to be carried out when the mobile station has already camped on that particular base- station .

Exemplary embodiments of the present invention will now be described, with reference to the accompanying drawings, in which: Brief Description of the Drawings

FIG. 1 is a schematic block diagram of a trunked radio communication system that can be adapted to support the various inventive concepts of an embodiment of the present invention;

FIG. 2 is a schematic block diagram of a wireless communication unit adapted to support the various inventive concepts of an embodiment of the present invention; and

FIG. 3 shows an encryptographic/ decryptogaphic configuration adapted to support the various inventive concepts of an embodiment of the present invention.

Detailed description of embodiments of the invention

FIG. 1 shows, in outline, a trunked radio communications system 100 supporting a TErrestrial Trunked RAdio (TETRA) air-interface in accordance with a preferred embodiment of the invention. The European Telecommunications Standards Institute (ETSI) has defined the TETRA air interface. Generally, the air-interface protocol is administered from base sites that are geographically spaced apart - one base site supporting a cell or sectors of a cell .

A plurality of subscriber units, such as a plurality of MSs 112-116 and fixed terminals (not shown) , communicate over a selected air-interface 118-120 with a plurality of serving base transceiver stations (BTS) 122-132. The BTSs 122-132 may be connected to a conventional public- switched telephone network (PSTN) 134 through base station controllers (BSCs) 136-140 and mobile switching centres (MSCs) 142-144. Each BTS 122-132 is principally designed to serve its primary cell, with each BTS 122-132 containing one or more transceivers.

Each BSC 136-140 may control one or more BTSs 122-132, with BSCs 136-140 generally interconnected through MSCs 142-144. Each BSC 136-140 is therefore able to communicate with one another, if desired, to pass system administration information therebetween, with BSCs responsible for establishing and maintaining control channel and traffic channels to serviceable MSs affiliated therewith. The interconnection of BSCs therefore allows the trunked radio communication system to support handover of the MSs between cells.

Each MSC 142-144 provides a gateway to the PSTN 134, with MSCs interconnected through an operations and management centre (OMC) 146 that administers general control of the trunked radio system 100, as will be understood by those skilled in the art. The various system elements, such as BSCs 136-138 and OMC 146, will include control logic 148- 152, with the various system elements usually having associated memory element 154 (shown only in relation to BSC 138 for the sake of clarity) . The memory element 154 typically stores historically compiled operational data as well as in-call data, system information and control algorithms .

In the context of the present invention, one or more BTS(s) 122-132 have been adapted to implement the inventive concepts hereinafter described. The one or more BTS(s) 122-132 include a cryptographic function arranged to apply encryption to network identification data to be broadcast from the BTS, as described with respect to FIG. 3.

It is within the contemplation of the invention that one or more MSC 142-144 or BSC 136-140 may also be adapted to perform the encryption process, such that encrypted network identification data is provided to the respective BTS(s) . This alternative embodiment is in contrast to the preferred embodiment where the BTS(s) encrypt the network identification data.

By encrypting the network identification data, a fraudulent BTS that appears on the system will transmit unencrypted, or falsely encrypted network identification data. In such a scenario, a receiving MS is able to easily determine that the transmitting BTS is a fraudulent BTS, or supporting a fraudulent network. As a consequence, the MS will not register with the fraudulent BTS.

Turning now to FIG. 2, a block diagram of a wireless communication unit, for example BTS 122, is shown, where the BTS 122 is adapted to support preferred embodiments of the present invention. For the sake of clarity, the BTS 122 is shown as divided into two distinct portions - a receiver portion 210 and a transmit portion 220.

The BTS 122 includes an antenna 202 preferably coupled to an antenna switch 204 that provides signal control of radio frequency (RF) signals in the BTS 122, as well as isolation between receiver chain 210 and transmit chain 220. Clearly, the antenna switch 204 could.be replaced with a duplex filter or circulator, as known to those skilled in the art.

The receiver chain 210 further includes scanning receiver front-end circuitry 206 (effectively providing reception, filtering and intermediate or base-band frequency conversion) . The scanning front-end circuit 206 scans for signal transmissions from a MS wishing to communicate with the BTS 122 or a MS wishing to communicate with another MS via BTS 122. The scanning front-end circuit 206 is serially coupled to a signal processor 208 (generally realised by at least one digital signal processor (DSP) ) .

A controller 214 is operably coupled to the scanning front-end circuitry 206 so that the receiver can calculate receive bit-error-rate (BER) or frame-error- rate (FER) or similar link-quality measurement data from recovered information via a received signal strength indication (RSSI) function 212. The RSSI function 212 is operably coupled to the scanning front-end circuitry 206. The memory device 216 stores a wide array of data and programs, such as decoding/encoding functions and the like, as well as link quality measurement information to enable an optimal communication link to be selected. In accordance with one embodiment of the present invention, the memory device 216 also stores cryptographic data and/or one or more cryptographic keys.

A timer 218 is operably coupled to the controller 214 to control the timing of operations, namely the transmission or reception of time-dependent signals, within the BTS 122.

As regards the transmit chain 220, this essentially includes a processor 228 (which may be the same processor as the processor 208) transmitter/ modulation circuitry 222 and a power amplifier 224. The processor 228, transmitter/modulation circuitry 222 and the power amplifier 224 are operationally responsive to the controller 214, with an output from the power amplifier coupled to the antenna switch 204, as known in the art.

In accordance with a preferred embodiment of the invention, the controller 214 or the signal processor 228 (each in practice may be one or more programmed microprocessors) has been adapted to encrypt one or more network or BTS specific messages or data, such as the MNI.

Alternatively, it is envisaged that a separate cryptographic function 240 may be provided, operably coupled to the processor 228 (as shown in FIG. 2) or the controller 214 as appropriate, to perform the encryption process. The cryptographic data and/or keys may be provided by the cryptographic function 240 or provided to the cryptographic function 240 for encrypting a network identifier .

The BTS transmitter then transmits an encrypted network identifier to its remote wireless communication units operating within its coverage range. Notably, this transmission is distinguished over the current known mechanism of transmitting an unencrypted identifier.

A skilled artisan will appreciate that substantially the same configuration of elements will be found in the MS 112, albeit with lower performance, reduced power, bandwidth constraints, battery power consumption considerations, etc.

In accordance with a preferred embodiment of the invention, the MS 112 may comprise a transceiver having a similar construction to the BTS 122 shown in FIG.2. In particular, the MS 112 may include a processor similar to the processor of the BTS 122 (again in practice one or more programmed microprocessors) has similarly been adapted to decrypt one or more network or BTS specific messages or data, such as the MNI. Alternatively, it is envisaged that a separate cryptographic function may be provided in the MS 112, operably coupled to the processor to perform the decryption process. Again, cryptographic data and/or keys may be provided by a cryptographic function or provided to the cryptographic function for decrypting a network identifier.

The MS receiver thus receives the message broadcast by the BTS 122, which includes one or more encrypted network identifiers, to determine whether the BTS is a valid BTS or is supporting a valid network. The MA 112 may thus have a processor which carries out the required decryption and BTS identity recognition functions similarly to the processor 228, the controller 214 or the cryptographic function 240 as appropriate in the BTS 122. The MS processor, e.g. similar to the controller 214, may also carry out a cell selection or re-selection procedure as described earlier wherein signals received from transmitters not including when decrypted an identity recognised by the processor are not included as preferred candidate BTSs in a list of preferred BTSs produced by the processor.

Advantageously, the inventive concepts of the present invention require minimal additional implementation complexity to air interface components. The preferred embodiment of the present invention preferably encrypts one or more of the broadcasted network identification parameters, e.g. Mobile Country Code (MCC) , the Mobile

Network Code (MNC) as specified within the GSM and TETRA standards. MNC and MCC are good examples as they determine in unique way the network identity.

Furthermore, the length of their combined codes shall be sufficient for crypto protection. It is envisaged that alternative embodiments may use alternative parameters, for example subscriber class (a type of subscribers that are legitimate on that network) , or a location area parameter that can be used only within certain range of values. In summary, any parameters will suffice if it has the following characteristics:

(i) Provide sufficient unification of the network identity, and

(ii) The length of the data is sufficient for an adequate crypto" protection process to be used, dependent upon the selected crypto algorithm.

Referring to FIG. 3, the encryption/decryption procedure 300 is illustrated in more detail. The controller 214, within the BTS 122, processes unencrypted network identification parameters 330 by a cryptographic function 320. The cryptographic (encryption processing) function 320 may be included within the BTS controller 214, or performed by a separate function 240 operably coupled to the BTS controller 214. Another input to the cryptographic function 320 is one or more cryptographic parameters 310, as known to those skilled in the art of encryption/decryption. This data preferably includes crypto key information required by a cryptographic algorithm run by function 320. The cryptographic (encryption/decryption) algorithm may be either a customised algorithm provided to a specific user or user class, or it may be based on one or more known algorithms, for example digitally encrypted signalling (DES) standard, or 3DES or a proprietary standard, etc.

Processing of the network parameters 330 by cryptographic function 320 using the cryptographic data 310, results in an encrypted version of the network identification data 340.

5 The encrypted network identification data 340 is broadcast over the air interface 168, where it is received and processed by any MS 112 that acquires the network signal. The received encrypted network information 340 is applied within the MS 112 into a

10. corresponding cryptographic function 360. The cryptographic function 360 may comprise a distinct element 370 operably coupled to a MS processor, e.g. corresponding to the BTS controller 214, or a cryptographic function performed by the MS processor.

15 The cryptographic function 360 may be similar to, or different from, the cryptographic function 320 in the BTS 122, dependent upon the specific cryptographic technology being used. The aim of the cryptographic function 360 is to process and decrypt the received encrypted information

20 340. The decryption process uses the same crypto parameters 350, used in the BTS 122, in order to obtain the decrypted version of the network identification data 330.

25 Only MSs that are allowed/configured to access the network, i.e. pre-programmed with correct cryptographic parameters 350, have the ability to decrypt correctly the network identification data 340. Moreover, the network identification data 330 may only be recovered correctly

30 if the data 330 has been encrypted with the correct cryptographic parameters 310 at the BTS 122. The correct cryptographic parameters 310 are known only to approved BTS 122-132 operating on the real network.

Any attempt to construct a fraudulent transmitter, for example a fraudulent BTS to broadcast over the air interface, will result in a false or unencrypted network ID being transmitted by the BTS. Hence, a false or unencrypted network ID would be received by decryption function 360 in the MS 112 and the fraudulent BTS would in consequence be recognised as such.

Thus, the MSs will reject this fraudulent network without any attempt to register or communicate with the fraudulent BTS, e.g. in a cell selection or re-selection procdure.

In order to avoid such a fraudulent network capturing (recording) a broadcast of the real network and using the captured information within the fraudulent network, using a so-called "replay attack", the encryption algorithm may beneficially be dynamically (in contrast to statically) generated.

For example, the encryption algorithm operation may be made time-dependent. This can be achieved if the encryption/decryption algorithm in functions 320 and 360 are based on unique parameters, for example with reference to time and/or geographical location. One example is for the encryption/decryption algorithm to be made dependent upon the system time at any given xnstant, which is broadcast by the network. Alternatively, the encryption/decryption algorithm may, in the case of a Time Division Multiple Access (TDMA) system, be made dependent upon a number of particular slots/ frames/ multi-frames/ hyper-frames/ etc.

In a yet further alternative embodiment, in the case of a Code Division Multiple Access (CDMA) system, the encryption/decryption algorithm may be made dependent upon a particular code identification.

If geographical location information is used to dynamically change the crypto parameters, the cell identity, Location Area identity, and/or any other geographical-related information may be used. The dynamic generation of crypto parameters provides uniqueness in time and/or space to the encrypted network identification data and will help to further protect the cryptographic feature against replication of network identification data by the fraudulent network.

The various adapted components, within BTS 122 or MS 112, may be realised in discrete or integrated component form. More generally, the functionality associated with generating, administering and utilising an encryption/decryption process on network identification data, may be implemented in a respective communication unit (BTS 122, MS 112) in any suitable manner. For example, a new processor or cryptographic function may be added to a conventional communication unit, or alternatively an existing processor or cryptographic function of a conventional communication unit may be reprogrammed. As such, the required adaptation, for example the cryptographic algorithm used in the processor 208, may be implemented in the form of processor- implementable instructions stored on a storage medium, such as a floppy disk, hard disk, PROM, RAM or any combination of these or other storage multimedia.

Although the invention has been described in general with reference to the TETRA communication specification, utilising a TDMA access protocol, the inventive concepts contained herein are clearly suitable to alternative radio communication system technologies, such as GSM, UMTS 3GPP, GPRS, CDMA 2000, etc. operating similar or alternative access protocols .

Furthermore, the inventive concepts described herein do not require any specific negotiation between the network and the wireless communication (subscriber) unit. Therefore, there is no requirement for any new messages to be added to the existing air interface protocol. In addition, and advantageously, it does not expand (in its simplest implementation) the existing information. Thus, there is no requirement for any modification to the existing structure of the air protocol messages. The information that provides network identity exists in all modern cellular standards. Advantageously, the inventive concepts described herein propose to encrypt this data without expanding it, or adding additional information to enable it to fit into the existing structure. A more complicated solution would be to provide additional information. This would require a far more complex implementation, where the actual identity fields will need to have certain values that indicate that the real information is securely delivered via a short data broadcast service. Such a facility is available in all modern cellular standards (GSM, CDMA, TDMA, 3GPP) and provides a capability to broadcast custom information. It is envisaged that some users/operators may employ the inventive concepts hereinbefore described to include additional protection information such as key-ID, crypto- algorithm-ID, crypto checksum, etc. as known in the art. Again, such a more complex solution would not require a radical change to the standard air interface and message structure, but it would require values being introduced in the network ID field of a standard message. Such a modified message would instruct subscribers to extract the information from a custom broadcast message.

It is also within the contemplation of the invention that alternative message formats, and/or associated data, can be accommodated . for within the inventive concepts described herein. The invention is therefore not to be considered as being limited to the encryption of the mobile network identifier (MNI) . For example, other network or BTS specific messages may be encrypted, such that intended MSs are able to recover and decrypt the message to determine whether it was a valid transmission.

It will be understood that the wireless communication system, wireless communication units and method for obtaining network identification data, as described above, provides at least the following advantages:

(i) That little/no change is required to the communication standard's air interface, in order to minimise the risk posed by fraudulent BTS or fraudulent networks .

(ii) The encryption/decryption process is achieved by processing readily available and accessible information. (iii) The wireless communication (subscriber) unit does not expose itself to the fraudulent network, namely the unit excludes the fraudulent network without making any transmission and without performing any negotiation. This ensures that security is maintained and no time is wasted.

Whilst specific, and preferred, implementations of the present invention are described above, it is clear that one skilled in the art could readily apply further variations and modifications of such inventive concepts.

Thus, a wireless communication system, a communication unit and method for obtaining network identification data have been provided that address the above-mentioned fraudulent BTS or fraudulent network problems .

Claims

1. A wireless communication system (100) comprising: a system infrastructure (142, 138, 122) including at least one serving wireless communication terminal (122); and a plurality of remote terminals (112, 114) ; the at least one serving terminal (122) being operable to serve a plurality of the remote terminals (112, 114) with a communication resource, the at least one wireless serving communication terminal (122) including: a transmitter (220) for transmitting signals to at least one of the plurality of remote terminals; and a processor (320) operably coupled to the transmitter; and at least one of the remote communication terminals (112) including: a receiver (210) for receiving signals transmitted from the at least one serving wireless communication terminal, and a processor (360) , operably coupled to the receiver; wherein the processor (320) of the at least one serving terminal is operable to produce in encrypted form for transmission in said signals data giving its identity and/or the identity of infrastructure in which it is included; and wherein the processor (360) of the at least one remote terminal is operable to decrypt the encrypted identity data included in signals received from the at least one serving terminal and to determine from the decrypted data that the serving terminal is a valid serving terminal and/or the infrastructure in which the serving terminal is included is a valid infrastructure.

2. - A system according to claim 1 and wherein the at least one remote terminal is operable to determine that a signal received from a transmitting terminal which does not include encrypted data giving the identity of the transmitting terminal is not from a valid serving terminal .

3. A system according to claim 2, wherein the at least one remote terminal is operable, when it determines that the signal received from the transmitting terminal is not from a valid serving terminal, not to communicate further with the transmitting terminal.

4. A system according to any one of the preceding claims wherein the or each serving terminal comprises a base transceiver station and the or each remote communication terminal comprises a mobile station and the base transceiver station and the mobile station are operable to provide radio communication with one another.

5. A system according to any one of the preceding claims, wherein the processors of the at least one serving terminal and of the at least one remote terminal in operation receive cryptographic data from a cryptographic function in order to encrypt or decrypt the identification data.

6. A system according to claim 5, wherein the cryptographic data includes key information for use in a cryptographic algorithm run by the processor.

7. A system according to claim 6, wherein the cryptographic algorithm has been customised for a particular use, or is based on an encryption standard.

8. A system according to claim 6 or claim 7, and wherein in operation the cryptographic algorithm is dynamically generated.

9. A system according to claim 8 and wherein in operation the cryptographic algorithm is dynamically generated using one or more of the following:

(i) a plurality of particular time slots or time frames or multi-frames or hyper-frames, associated with a transmission on said wireless communication system; (ii) a particular code identification; (iii) geographical location information.

10. A wireless serving communication terminal operable to serve a plurality of remote terminals with a communication resource in a system according to any one of the preceding claims, the wireless serving communication unit comprising: a transmitter for transmitting signals to at least one of the plurality of remote units, and a processor, operably coupled to the transmitter, for including in the transmitted signals encrypted data giving the identity of the serving terminal and/or an infrastructure in which it is included.

11. A serving terminal according to claim 10 and which comprises a base transceiver station and wherein the at least one remote communication terminal comprises a mobile station and the base transceiver station and the remote terminal are capable of radio communication with one another.

12. A wireless communication terminal for use as a remote terminal in a system according to any one of claims 1 to 9 and including: a receiver for receiving signals from a serving wireless communication terminal, and a processor, operably coupled to the receiver, for decrypting encrypted data included in the received signals data identifying the serving terminal and/or an infrastructure in which it is included, to determine that the serving wireless communication unit is a valid serving wireless communication terminal.

13. A terminal according to claim 12 which is operable to determine that signals received from a transmitting terminal which do not include encrypted data giving the identity of the transmitting terminal are not from a valid serving terminal.

14. A terminal according to claim 13 which is operable, when it determines that a signal received from a transmitting terminal is not from is not a valid serving terminal, not to communicate further with the transmitting terminal.

15. A terminal according to claim 14 which is operable to undertake a cell re-selection procedure wherein the signals from candidate serving terminals are measured to select one or more preferred serving terminals, wherein only one or more terminals transmitting a signal including encrypted identity data decrypted by the receiving terminal to identify the transmitting terminal as a valid serving terminal are selected as preferred serving terminals .

16. A terminal according to claim 15 which is operable to produce a list in preference order of the valid serving terminals.

17. A terminal according to any one of claims 12 to 16 and which comprises a mobile station and wherein the or each serving terminal comprises a base transceiver station and the mobile station and the at least one base transceiver station are capable of radio communication with one another.

18. A method for obtaining signals including network identification data on a wireless communication system according to any one of claims 1 to 9, the method comprising the steps of: encrypting network identification data (330) at a wireless serving communication unit; transmitting a signal including the encrypted network identification data to at least one remote communication terminal; receiving the signal including the encrypted network identification data at the remote communication terminal; and decrypting the encrypted network identification data to determine that the serving wireless communication terminal is a valid serving wireless communication terminal.