WO2011155879A1

WO2011155879A1 - Method and arrangement for resource allocation in radio communication

Info

Publication number: WO2011155879A1
Application number: PCT/SE2010/050627
Authority: WO
Inventors: Magnus Almgren; Mats NÄSLUND; Göran SELANDER; Per Skillermark
Original assignee: Telefonaktiebolaget Lm Ericsson (Publ)
Priority date: 2010-06-07
Filing date: 2010-06-07
Publication date: 2011-12-15
Also published as: US20130203454A1; US9137785B2; EP2578048A4; EP2578048A1

Abstract

A method and arrangement in a first mobile terminal (600) for determining allocation of radio resources for DMO communication amongst a group of mobile terminals. M the first mobile terminal, a first determining module 600a determines a communication (Sout, Sin) with a second mobile terminal (602) of the group. A second determining module (600b) determines a resource element (RE) for communication by applying a predefined cryptographic function Pbased on a terminal identification (K)). Tne cryptographic function has been configured in the mobile terminals of the group to provide terminal-specific resource elements for different mobile terminals within respective radio frames. A communication module (600c) then communicates with the second mobile terminal (602), either by transmission or reception of the data, on the determined resource element (RE).

Description

MEIHOD AND ARRANGEMENT K)R RESOURCE AIM) CATION EST RADIO

COMMUNICATION

Tbchnical field

[0001] The invention relates generally to a method and arrangement for

detenmning allocation of radio resources by a mobile terminal communicating directly with other mobile terminals without being controlled by a network infrastructure.

Background

[0002] In civilized societies of today, various functions and organisations for mamtaining security and safety, referred to as "National Security and Rjblic Safety" (NSPS) organisations, are often dependent on wireless communication for their operation. His desirable or even a requirement, sometimes, that if the wireless network infrastructure normally used for the communication becomes unavailable, for whatever reason, the mobile terminals used shall still be able to communicate in a so-called direct mode operation (DMO), i.e. communicating directly with each other with no or very limited support and control by the wireless network This situation may occur during a warlike scenario, or as a resultof sabotage or some natural disaster, when the wireless network cannot operate to transmit or receive data to or from the terminals and allocate radio resources for the mobile

communication.

[0003] Eg. 1 illustrates an example of the normal operation of a mobile wireless access network 100 having various nodes and mechanisms for allocating radio resources to different mobile teminals Tl, Ί2, Ί3... for either transmission or reception of data over a specific carrier frequency when connected to a base station, not shown, in the network 100. The radio resources are separated in the time domain and arranged as resource elements in basically consecutive time slots ISO, TBI, TS2,... of a radio frame structure, e.g. in the manner of an LIE system Although only one carrier frequency is illustrated here, it can be easily understood that the resource allocation can be differentiated in the frequency domain as well, depending on the frequency bandwidth used.

[0004] In this example, the network 100 instructs terminal TL to transmit or receive data m timeslotlSO of a current radio frame. likewise, terminal 12 is instructed to transmit or receive in timeslotTS3 and terminal 13 is instructed to transmit or receive in timeslotT35 of the radio frame. The network 100 may employ various scheduling mechanisms for allocating the resource elements, in this case time slots and specific carrier frequencies, to the terminals over time, e.g. by taking into account various factors such as the type of communication, services, priorities and the available capacity in the network, among other things.

[0005] Assuming that terminals 11-13 constitute a group of terminals used by an NSPS organisation and the network 100 would get out of order, e.g. in any of the above situations, the terminals 11-13 are configured to switeh into the DMO in order to maintain important communication within the group of terminals 11-13. A network type called " ΙΕΙΚΑ" is known today that can be used for NSES communication operating both in "infiastructure mode", i.e. resembling a conventional mobile network controlling the communication, and in DMO. 1E1KA uses 25 kHz carriers in four simplex channels and the resource allocation in DMO is made according to a quite rigid, pre-defined and thus predictable scheme for determiriing when and how terranals should transmit and receive data.

[0006] However, at least in some of the situations above, the communication may be very sensitive and/ or crucial, and it is often desirable that the communication between two terranals cannot easily be tracked by an illicit eavesdropper and/ or that an adversary is unable to disturb or "jam" the communication, at least not without great difficulty. Thus, robustness to interference and protection against eavesdropping is often of great importance in NSES networks. Confidentiality protection can to some extentbe achieved by standard encryption techniques.

However, a relatively high level of privacy may require that the identity of the tansmitting terminal is not disclosed, and/ or similarly, that the radio resources used by any specific terminal is unknown.

[0007] These issues above have notbeen solved properly today for mobile terminals when in DMO. The rigid resource allocation scheme of ΊΕ1ΚΑ., as well as other similar network systems known in the art, is predictable and therefore possible to interpret for an illicit parly such that eavesdropping and jamming of a particular communication session can be performed without too much difficulty. Conventional techniques such as frequency hopping may be used, but they usually only protect against random, "natural" disruptions in radio propagation and not against adversarial behavior. Moreover, if the network infrastructure is unavailable, there is no entity that can control and co-ordinate the resource usage, which may lead to conflicts, e.g. devices accidentally using the same radio resource, causing

interference.

Summary

[0008] It is an object of the invention to address at least some of the limitations, problems and issues outlined above. It is also an object to provide for allocation of radio resources for DMO cornmunication by means of a mobile terminal in a way that the communication of that terminal is difficult to track, and also making it mo re difficult, or "costly", for an adversary to disturb, or jam, the communication. It is possible to achieve these objects and others by using a method and an arrangement as defined in the attached independent claims.

[0009] According to one aspect, a method is provided in a first mobile terminal of detemining allocation of radio resources for cornmurncating amongst a group of mobile terminals in direct mode operation, when the radio resources are generally divided into resource elements in different time slots of a radio frame structure. In this method, when a communication with a second mobile terminal of the group is determined, the first mobile terminal determines a resource element for

communicating data with the second mobile terminal by applying a predefined cryptographic function Pbased on a terminal identification. The function P has been configured in the mobile terminals of the group to provide terminal-specific resource elements for different mobile terminals within respective radio frames.

[00010] Then, the data is communicated with the second mobile terminal on the determined resource element, either by transmission to or reception from the second mobile terminal. The communication above may thus be either outgoing or mcoming relative the first terminal. Thereby, the resource allocation is made practically unpredictable and the DMO communication can be carried out with a minimum of resource conflicts due to the terminal-specific resource allocation while also making eavesdropping and jamming of individual communications more difficult or costly as compared to more predictable allocation schemes.

[00011] According to another aspect, an arrangement is provided in a first mobile terminal operative for detemining allocation of radio resources for communicating amongst a group of mobile terminals in direct mode operation, the radio resources being generally divided into resource elements in different time slots of a radio frame structure. The first mobile terminal comprises a first determining module adapted to determine a communication with a second mobile terminal of the group, and a second detemtining module adapted to determine a resource element for communicating data with the second mobile terminal by applying a predefined cryptographic function Pbased on a terminal identification. As above, the cryptographic function P has been configured to provide terminal-specific resource elements within respective radio frames. The first mobile terminal also comprises a communication module adapted to communicate the data with the second mobile terminal on the determined resource element [00012] The above method and arrangement may be configured and implemented according to different embodiments. In one embodiment, tracking or jamming of the communication is made even more difficult by the first mobile terminal detemtining the resource element by applying the cryptographic function P further based on a shared predefined group key configured in the mobile terminals of the group, which key is kept secret to outsiders. The first mobile terminal may further determine the resource element by applying the cryptographic function P further based on a current frame identity to provide radio frame specific resource elements such that the allocation will basically change from frame to frame. In thatcase, the cryptographic function P may further be chosen from a set of different radio frame specific cryptographic functions PCI) used by the first mobile terminal to determine the radio frame specific resource elements.

[00013] In further possible embodiments, determining the resource element may include first detemining a virtual resource element by means of the cryptographic function P and then mapping the determined virtual resource element into the resource element for communication by means of a first preset mapping scheme. Alternatively, a "virtual" resource element may firstbe determined by means of a second preset mapping scheme and then the determined virtual resource element is translated into the resource element for communication by means of the

cryptographic function P. In either case, the number of available virtual resource elements is preferably more or less equal to the number of available resource elements for communication, in order to utilise the available bandwidth yet avoiding resource conflicts.

[00014] According to one alternative situation, the first mobile terminal determines the resource element for transmission of data to the second mobile terminal, and in that case the terminal identification is an identification of the first mobile terminal. In that case, the first mobile terminal may first check whether the determined resource element is already used in a current radio frame by a third mobile terminal of the group, and if so the first mobile terminal will determine a new resource element in a subsequent radio frame by applying the cryptographic function P based on a first alias for the terminal identification. The first mobile terminal may generate the first alias based on the terminal identification, ff the new resource element is likewise used by a third mobile terminal of the group, the first mobile terminal may repeat the determination of new resource elements for subsequent radio frames based on further aliases for the terminal identification, until an unused resource element is obtained.

[00015] The first mobile terminal may further determine one or more additional resource elements for transmission in a radio frame based on one or more aliases for the terminal identification. When different protocol layers are employed, e.g. according to the well-known O SI model, a physical protocol layer in the first mobile terminal may receive the data to transmit from a MAC layer.

[00016] According to another alternative situation, the first mobile terminal determines the resource element for reception of data from the second mobile terminal, and in that case the terminal identification is an identification of the second terminal. Further, the first mobile terminal may receive the communication from the second terminal on a dedicated resource element used for sigralling to announce a forthcoming data transmission from the second terminal, and reads the identification of the second terminal in the communication.

[00017] If the radio resources are further separated in the frequency or code domain, the cryptographic function Pmay comprise a component!^ in the time domain and a component!^ in the frequency or code domain, thereby determining a time component and a frequency or code component of the resource element independently. [00018] Rjrther possible features and benefits of this solution will become apparent from the detailed description below.

Bief description of drawings

[00019] The invention will now be described in more detail by means of exemplary embodiments and with reference to the accori anying drawings, in which:

[00020] Jig. 1 is illustrates a communication scenario with conventional network- controlled resource allocation, according to the prior art

[00021] Jig. 2 is a flow chart instatin a method performed by a transmitting mobile terminal, according to an exemplary embodiment

[00022] Jig. 3 is a flow chart iHustra ting a method performed by a receiving mobile terminal, according to another exemplary embodiment

[00023] Jig. 4 is a schematic diagram illustrating how the solution can be used to determine resource elements for communication, according to one example.

[00024] Jig. 5 is a schematic diagram illustrating how the solution can be used to determine resource elements for communication, according to another example.

[00025] Jig. 6 includes a block diagram illustrating in more detail an arrangement in a first mobile terminal when communicating in DMO with a second mobile terminal amongst a group of mobile terminals, according to further exemplary embodiments.

Detailed description

[00026] Eriefly described, a solution is provided in a first mobile terminal for using allocated radio resources for radio communication amongst a group of mobile terminals in DMO, i.e. when the mobile terminals communicate data directly with each other without the support of base stations and resource allocation in a mobile network infrastnicture. lis thus assumed that me group of mobile terminals has been formed and well defined in beforehand, e.g. as a function for maintaining security and safety as described above, which allows for certain parameters and functions to be preconfigured in the terminals for the DMO communication within the group as follows.

[00027] The first mobile terminal determines, or calculates, a resource element"RE' for communication of data directly with a second mobile terminal, by applying a predefined cryptographic function, denoted P, based on a terminal identification "ΠΤ, where the cryptographic function P has been configured in the mobile terminals of the group to provide terminal-specific EEs for different mobile terminals within respective radio frames. The RE may be determined either for transmission or reception of data, which will be described in more detail below.

[00028] R>r transmission of data to the second mobile terminal, the first mobile terminal uses its own terminal ID as input to function P to determine which resource elements) to use. On the other hand, when data is received from the second mobile terminal, the first mobile terminal may be able to use the terminal ID of the second mobile terminal as input to function P to determine which resource elements) to "listen to". R>r example, the first terminal may firstly listen to basically all EEs in a radio frame to detect the communication of interest from the second terminal, and then read the terminal ID of the sending second terminal if included in the data sent by the second mobile terminal. Alternatively, the terminal ID of the second mobile terminal may already be preconfigured and known in the first terminal and can thus be used by the first terminal for the calculation without first reading it in received data, e.g. providing the advantage that the second terminal does not need to disclose its identity over the air.

[00029] With this solution, and by proper choice of the function P, it is possible to achieve more or less "conflict-free" resource allocation for the terminals within the group basically without the support from a network infrastructure, i.e. each terminal will be able to transmit on its own RE within respective radio frames without colliding with other transmission(s). Further, if the cryptographic function Pis strong and preferably also based on a key kept secret within the group, it is also very difficult for an adversary to track an individual communication in order to eavesdrop or jam the communication by generating interference. On the other hand, an adversary that wants to jam the communication can always generate interference over the entire radio spectrum, however resulting in great costs for the adversary, e.g. in terms of required disturbing equipment and consumed power.

[00030] An exemplary procedure, basically performed by a first mobile terminal, of using allocated radio resources for its radio cornmunication amongst a group of mobile terminals in DMO , will now be described with reference to the flow chart in Jig. 2. lis assumed that the radio resources are generally divided into EEs in different time slots of a radio frame structure. In addition to time slots, the radio resources may further be divided into REs in different frequencies within a given frequency spectrum available for the communication in this group, which is quite common for conventional radio communication using different carriers. This description will however be directed to the division of radio resources into REs in different time slots for simplicity, although it can be understood that the division in different frequencies may be employed as well for this solution. In the latter case, the cryptographic function P can be configured to provide a specific frequency for the RE allocation in addition to a specific timeslot, e.g. by having a time component and a frequency component which will be further described later below.

[00031] The group of mobile terminals may have been defined for an NSPS organisation or the like to cornmunicate in DMO if a mobile network normally used for cornmunication in "infrastructure mode" would become unavailable for some reason, e.g. in any of the situations described above. In this example, the first mobile terminal will transmit data to a second mobile terminal of the group and therefore uses its own terminal identity ID to determine an RE for coinmunication of data with the second mobile terminal as follows.

[00032] h a first shown action 200, the first mobile terminal basically determines that a communication is to be executed with a second mobile terminal, e.g. when a physical layer of a protocol stack receives data from a higher layer, such as a MAC (Media/ Medium Access Control) layer, to be transmitted to the second mobile terminal. A next action 202 accordingly illustrates that the data is obtained for transmission to the second mobile terminal, basically according to a conventional procedure.

[00033] h a further action 204, the first mobile terminal determines an REthatcan be used for transmission of data to the second mobile terminal, by applying a predefined cryptographic function P based on a terminal ID of the first terminal. The cryptographic function P has been configured in the first mobile terminal as well as other mobile terminals of the group in beforehand for calculation of EEs using a terminal ID as input, to provide terminal-specific REs for different mobile terminals within respective radio frames.

[00034] In the transmitting case of ilg. 2, the first terminal thus uses at least its own terminal ID as input to the cryptographic function P to hopefully obtain a terminal- specific RE not used by any other mobile terminal in the group, since using other terminal IDs as input to function P provide other terminal-specific REs for respective mobile terminals. However, if the number of available REs in the given radio frame structure is limited and several terminals in the group are currently in

communication, it may still happen that two or more mobile terminals arrive at the same RE even though different terminal IDs are used as input to the function P.

[00035] Therefore, in this example, the first terminal examines if the used terminal ID results in a resource allocation conflict or collision in the group by checking for transmissions in the determined RE in a current radio frame, in a next action 206, that is to see whether that RE is already used by another "third" mobile terminal of the group. The first terminal is thus able to check, or "tes , the terminal ID used in function P by listening to the determined RE in the current radio frame. In this context, the third mobile terminal could be one or more terminals in the group other than the first and second mobile terminals.

[00036] Fit is determined in a nextaction 208 thatthe determined RE is already used by another terminal for transmission of data, i.e. if the RE is already occupied and thus notunused, the first mobile terminal moves on to a nextaction 210 and determines a new RE for transmission in a subsequent radio frame by applying the cryptographic function P based on a first alias for the previously used terminal ID. In other words, the first alias is used instead of the originally used terminal ID as input to the function P to calculate the new RE

[00037] The procedure then retums to action 206 to check again for transmissions in the newly calculated RE, i.e. to check if the RE determined from the first alias is used by any other third mobile terminal by listening to the RE in a current radio feme. Actions 210, 206 and 208 may thus be repeated for further aliases until an alias results in an unused RE Then, if it is thus determined in action 208 thatthe last checked alias results in an unused RE, the first mobile terminal transmits data to the second mobile terminal on an unused RE calculated for the next radio frame based on thatalias, in a final shown action 212. In practice, it may be reasonable to repeat actions 210, 206 and 208 for further aliases until a preset counter or time limit expires, which is however somewhat outside the scope of this solution

[00038] In some possible embodiments, the first mobile terminal may have a set of preconfigured aliases to check, one by one, in the above manner, or the first terminal may generate the first alias based on its terminal ID and then, if the first alias Ag^ did not result in an unused RE, generate each following alias A_new based on me previous alias A_prev^_ous. ibr mis calculation, a function Fmay be used such that Ag^ = FID), and A_new = FlA_previous).

[00039] Another exemplary procedure, again performed by a first mobile terminal, of detemtining allocated radio resources for reception of data, will now be described with reference to the flow chart in Hg. 3. In this example, the first mobile terminal will thus receive data from a second mobile terminal of the group and therefore uses the terminal ID of the second mobile terminal to determine an RE for reception of data from the second mobile terminal, since the latter terminal determines EEs for its transmissions basically according to the above-described procedure of Hg. 2, i.e. using its own terminal ID.

[00040] In a first shown action 300, the first mobile terminal starts by receiving data in multiple REs of the radio frame in order to look for and detect whether any data transmitted from any other mobile terminal should be received and used by the first mobile terminal. In this action, the first mobile terminal may thus listen for useful data in practically all REs of the radio frame, or at least those in REs which are intended for transmission of data. a next action 302, the first mobile terminal basically determines thata communication is coming from a second mobile terminal, e.g. by detecting thatdata or control signalling from the second mobile terminal is addressed to the first terminal or otherwise intended for reception, such as broadcasted or multicasted data or the like. The communication from the second mobile terminal may thus be either directed exclusively to the first terminal or broadcasted to plural terminals. So far in the procedure, actions 300 and 302 can be performed by means of conventional technique.

[00041] In this example, the first mobile terminal then reads the terminal ID of the second mobile terminal in the received communication, i.e. control sigralling, in a following action 304. This transmission from the second terminal may preferably use one of a set of fixed and dedicated EEs, used exclusively as a signalling RE to announce a forthcoming data transmission from the second terminal. The second mobile terminal will in that case include its terminal ID in the transmission on the sigralling RE and the first mobile terminal will listen on that RE to detect any incoming communications. In further variants, it is also possible that the first terminal uses a fixed "signalling ID" or the like as input to the cryptographic function Pto determine which sigmlling RE to listen to, and then use the read terminal ID for reception of data as described above.

[00042] In a next action 306, the first mobile terminal uses the read or retrieved terminal ID of the second mobile terminal to determine which RE is used by the second mobile terminal for transmission of data in the communication, by applying the predefined cryptographic function P based on the terminal ID of the second terminal. Alternatively, the first mobile terminal may be configured to listen specifically for communications from the second mobile terminal and may already know the terminal ID of the second mobile terminal, which may have been preconfigured and stored in the first mobile terminal. In the latter case, the first mobile terminal may retrieve the terminal ID of the second mobile terminal from a suitable storage, and use the retrieved terminal ID in function Pto determine in which RE to receive data from the second mobile terminal.

[00043] Once the RE s been determined, the first mobile terminal can listen to that RE and receive data, in a final shown action 308. Thus, in both the transmitting case of Jig. 2 and the receiving case of Jig. 3, this solution allows the first mobile terminal to determine and use a terminal-specific RE for the DMO communication with the second mobile terminal.

[00044] The solution described above for either the transmitting case ofilg. 2 and the receiving case of Hg. 3, respectively, can be carried out according to different possible embodiments. As mentioned above, the function P may be a cryptographically "strong" function, such as e.g. any of the existing functions AES, HMAC and SHA-256 which are known per se in the art In order to further increase the protection against eavesdropping and jamming, the cryptographic function P may also be configured such that the RE is determined further based on a shared predefined group key "HGr" as input to the function P. In thatcase, the HGr has been configured in the mobile terminals of the group but is kept secret within the group.

[00045] In addition, the cryptographic function P may also be configured such that the RE is determined further based on a current frame identity "T' or other suitable system time identity, to provide REs that are also radio frame specific and may vary in successive radio frames for the same communication Thereby, Pwill, in consecutive frames, appear "random" to an outsider which will make

eavesdropping and/ or jamming even more difficult In this context, "system time" indicates any agreed periodic time framework or scheme jointly used by all mobile terminals on the group to separate their communications from one another.

[00046] Thus, the cryptographic function P may be configured to use a terminal ID, the group key HGr and a current frame identity or other system time identity Tas input, i.e. P = P(ID, HGr, Ί). Still further, the cryptographic function P may be chosen from a set of different predefined radio frame specific cryptographic functions such that different functions P are used by the first mobile terminal on a per radio frame basis to determine the radio frame specific REs for communication within respective radio frames. Thereby, the allocation of RE will change randomly or "pseudo^andomly" for every radio frame or corresponding system time period.

[00047] Further, if a higher transmission rate is wanted, the first mobile terminal may determine one or more additional REs for transmission in a radio frame based on one or more aliases for its terminal ID, such that the first mobile terminal can transmit data in mo re than one RE per radio frame. [00048] ff a resource scheme is used where the radio resources are further separated in the frequency or code domain, the cryptographic function Pmay comprise a component!^ in the time domain and a component Fy in the frequency or code domain, such thata time component and a frequency or code component of the RE are determined independently. Thus, the RE allocation can in this way be both time specific and frequency or code specific. Using differentiated frequencies or codes in the RE allocation will of course further reduce the risk of resource conflicts which could be helpful particularly if the number of ongoing

communications is close to or even exceeds the number of available timeslots in a given radio frame structure.

[00049] In order to make the tracking of a particular communication even more difficult, the RE to be used for the communication may be determined by first determining a virtual resource element "VRE' by means of the cryptographic function P. The determined VRE is then mapped into the RE for communication by means of a first preset mapping scheme. Alternatively, a VRE is first determined by means of a second preset mapping scheme and the VRE is then translated into the RE for communication by means of the cryptographic function P.

[00050] The use of an intermediate VRE for determining the RE for communication will be described in more detail below with reference to Jig's 4 and 5. a protocol stack with multiple layers where a physical layer receives data from a MAC layer, e.g. an T E stack according to the O SI model, the VREs can be seen as an intermediate "shim" layer dividing the physical layer into an upper physical layer and a lower physical layer.

[00051] Jig. 4 thus illustrates one example of how REs can be determined for DMO communication within a group of mobile terminals according to the above-described solution and using a number of predefined intermediate VREs. In this example, determining an RE for communication includes first determining a VRE by means of the cryptographic function HID, KG, 1) and then mapping the determined VRE into the RE for communication by means of a first preset mapping scheme. In this example, the number of available VREs is R, and the number of REs available for communication according to the radio frame scheme used, is r. In this case, the cryptographic function P may be applied to determine the VKEs by a MAC scheduler in the MAC layer and no further modifications are necessary in the higher layers of the protocol stack

[00052] In Jig. 4, a scheme is shown for a case with N terminals in the group, where different terminal IDs: ID 1 , ID 2 , ID 3..., ID N are used as input to the function P to calculate corresponding VKEs: VRE 1, VRE 2, VRE 3,..., VRER Here, 1D 1 results in VRER, ID 2 results in VRE 3, ID 3 results in VRE 1, and ID N results in VRE 2. Then, each determined VRE is mapped into an RE for communication by means of a first preset mapping scheme.

[00053] As mentioned above, the cryptographic function Pis preferably a relatively strong function that provides a certain degree of randomisation when converting from terminal ID to VRE, while the first mapping scheme may be a relatively simple mapping scheme, in this example a trivial "one-to-one" function where VRE 1 is mapped into RE 1, VRE 2 is mapped into RE 2, and so forth. Another useful simple mapping scheme could be mapping the first VRE 1 into the last REN, mapping the next VRE 2 into the nextREN-1, and so forth. Preferably, the number R of available VREs is equal, or near equal, to the number r of available REs for communication to achieve good utilisation of the available RE spectrum in the radio frames yet enabling unique allocation of REs to avoid resource conflicts as far as possible. In fact, the fewer REs are used of the available REs, the more difficult or costly it is to jam the ongoing communications, and reduced b and width utilisation results in increased robustness against jamming and vice versa. [00054] In the example shown in Hg. 5, deteraiining an RE for communication includes first detemtining a VRE by means of a second preset mapping scheme and then translating the determined VRE into the RE for communication by means of the cryptographic function HID, HGr, 1). Thus, the second mapping scheme may likewise be a relatively simple mapping scheme, in this example a trivial one-to-one function where ID 1 is mapped into VRE 1, ID 2 is mapped into VRE 2, and so forth. Then, each VRE is used as input to the function P to calculate corresponding REs. In the example shown here, VRE 1 results in RE r, VRE 2 results in RE 3 , VRE 3 results in RE 1, and VREN results in RE 2, hence in a "pseudorandom" manner.

[00055] An arrangement in a first mobile terminal will now be described in mo re detail with reference to the block diagram shown in Jig. 6. The first mobile terminal 600 may be used to accomplish any of the above-described features and

embodiments such as in the exemplary procedures of Jig. 2 and Jig. 3. Various functional entities therein are called "modules" in this description, although they could also be seen as units, blocks, elements, components, as for example. The mobile terminal 600 is operative for using radio resources for communication in DMO amongst a group of mobile terminals of which two are shown in Hg. 6, where the radio resources are generally divided into REs in different time slots of a radio frame structure.

[00056] The first mobile terminal 600 comprises a first detern±iing module 600a adapted to determine a communication with a second mobile terminal 602 of the group, in the figure schematically denoted C-outfor the case of transmission of data to terminal 602 and Cin for the case of reception of data from terminal 602.

Terminal 600 further comprises a second detemtining module 600b adapted to determine a resource element"RE' for communication of data with terminal 602 by applying a predefined cryptographic function P based on a terminal ID of either the first terminal 600 or the second terminal 602, depending on the direction of the communication. [00057] As in the previous examples, the cryptographic function Phas been configured in the mobile terminals of the group to provide terminal-specific EEs for different mobile terminals within respective radio frames and may also use a group key KG and/ or a frame identity Tas input, as described for the above

embodiments. The first mobile terminal 600 also comprises a communication module 600c adapted to communicate the data with the second mobile terminal 602 on the determined RE.

[00058] The different modules in the first mobile terminal 600 may be configured and adapted to provide further optional features and embodiments. In one exemplary embodiment, the second detenmning module 600b is further adapted to determine the RE by applying the cryptographic function P further based on a shared predefined group key KG configured in the mobile terminals of the group.

[00059] The second detemtining module 600b may be further adapted to determine the RE by applying the cryptographic function P further based on a current frame identity Tto provide radio frame specific REs. The second detemtining module 600b may be further adapted to choose the cryptographic function Pfrom a set of different radio frame specific cryptographic functions used to determine the radio frame specific REs for communication within respective radio frames.

[00060] The second detemining module 600b may be further adapted to determine the RE by first detenmning a VREby means of the cryptographic function Pand then mapping the determined VREinto the RE for communication by means of a first preset mapping scheme SI. The second detemtining module 600b may be further adapted to determine the RE by first determining a VREby means of a second preset mapping scheme S2 and then translating the determined VREinto the RE for communication by means of the cryptographic function P. [00061] The second detemiining module 600b may be further adapted to determine me RE for transmission of data to me second mobile terminal 602 and me terminal ID is an identification of me first mobile terminal 600. In mat case, me communication module 600c may be further adapted to check whether me determined RE for transmission is used in a current radio frame by a third mobile terminal of the group, and if so, the second determining module 600b is further adapted to determine a new RE for transmission in a subsequent radio frame by applying the cryptographic function Pbased on a first alias for the terminal ID. The second deterinining module 600b may be further adapted to generate the first alias based on the terminal ID.

[00062] The second deterinining module 600b may be further adapted to repeat the determination of new REs for subsequent radio frames based on further aliases for the terminal ID until an unused RE is obtained. I^" a higher data rate is wanted, the second deterinining module 600b may be further adapted to determine one or more additional REs for transmission in a radio frame based on one or more aliases for the terminal ID.

[00063] The first mobile terminal may further comprise a data manager 600d in which a physical protocol layer receives the data to transmit from a MAC layer. The second deterinining module 600b may be further adapted to determine the RE for reception of data from the second mobile terminal, and in that case the terminal ID is an identification of the second terminal. In this case, the first mobile terminal may be adapted to receive the communication fro m the second terminal on a dedicated resource element used for signalling to announce a forthcoming data transmission from the second terminal, and to read the identification of the second terminal in the communication

[00064] It should be noted thatilg. 6 merely illustrates various functional units or modules in the mobile terminal 600 in a logical sense, although the skilled person is free to implement these functions in practice using suitable software and hardware means. Thus, the invention is generally not limited to tiie shown structure of the mobile terminal 600, while its functional modules 600a-c may be configured to operate according to the methods and procedures described above for Jig's 2-5, where appropriate.

[00065] The functional modules 600a-d described above can be implemented as program modules of a computer program comprising code means which when run by a processor in the terminal 600 causes the terminal to perform the above- described functions and actions. The computer program may be carried by a computer program product comprising a computer readable medium on which the computer program is stored, ibr example, the computer program product may be a flash memory, RDM (Itead-Only Memory) or an EEPKOM (Electrically leasable

Ogrammable RDM), and the computer program modules described above could in alternative embodiments be distributed on different computer program products in the form of memories within the terminal 600.

[00066] Ey implementing the above-described mechanism for resource allocation in the mobile terminals within the group, DMO communication can be accomplished without support from a network infrastructure, where eavesdropping and jamming are made more difficult as compared to more predictable allocation schemes. Still, resource conflicts can be avoided to a great extent by making the resource aUocation tem inal-specific in the manner described above.

[00067] While the invention has been described with reference to specific exemplary embodiments, the description is generally only intended to illustrate the inventive concept and should not be taken as limiting the scope of the invention, ibr example, the terms "mobile terminal", "radio resource", "resource element', "radio frame" and "time slot' have been used throughout this description, although any other corresponding functions, parameters, modules and/ or units may be used having the features and characteristics described here. The invention is defined by the appended claims.

Claims

CIA S

1. A method in a first mobile terminal (300a) of detemtining allocation of radio resources for communicating amongst a group of mobile terminals in direct mode operation (DMO), the radio resources being generally divided into resource elements (REfe) in different time slots of a radio frame structure, the method comprising:

- detemtining (200, 302) a communication with a second mobile terminal of the group,

- detenmning (204, 306) a resource element (RE) for communicating data with the second mobile terminal by applying a predefined cryptographic function P based on a terminal identification (ID), the cryptographic function P being configured in the mobile terminals of said group to provide terminal-specific resource elements for different mobile terminals within respective radio frames, and

- communicating (212, 308) said data with the second mobile terminal on the determined resource element

2. A method according to claim 1, wherein the first mobile terminal determines said resource element by applying the cryptographic function P further based on a shared predefined group key (HGr) configured in the mobile terminals of said group.

3. A method according to claim 1 or 2, wherein the first mobile terminal determines said resource element by applying the cryptographic function P further based on a current frame identity (1) to provide radio frame specific resource elements.

4. A method according to claim 3, wherein the cryptographic function Pis chosen from a setof different radio frame specific cryptographic functions used by the first mobile terminal to determine said radio fiame specific resource elements.

5. A method according to any of claims 14, wherein detemtining said resource element includes first determining a virtual resource element (VRE) by means of the cryptographic function P and then mapping the determined virtual resource element into said resource element for communication by means of a first preset mapping scheme.

6. A method according to any of claims 14, wherein detemtining said resource element includes first detemtining a virtual resource element (VKE) by means of a second preset mapping scheme and then translating the determined virtual resource element into said resource element for communication by means of the cryptographic function P.

7. A method according to claim 5 or 6, wherein the number of available virtual resource elements (R) is approximately equal to the number of available resource elements for communication (r).

8. A method according to any of claims 1-7, wherein the first mobile terminal determines (204) said resource element for transmission of data to the second mobile terminal and said terminal identification (ID) is an identification of the first mobile terminal.

9. A method according to claim 8, wherein the first mobile terminal checks (206) whether the determined resource element for transmission is used in a current radio fiame by a third mobile terminal of said group, and if so, the first mobile terminal determines (210) a new resource element for transmission in a subsequent radio fiame by applying the cryptographic function Pbased on a first alias for said terminal identification.

10. A method according to claim 9, wherein the first mobile terminal generates the first alias based on said terminal identification.

11. A method according to claim 9 or 10, wherein the firstmobile terminal repeats said determination of new resource elements for subsequent radio frames based on further aliases for said terminal identification until an unused resource element is obtained.

12. A method according to any of claims 8-11, wherein the first mobile terminal determines one or more additional resource elements for transmission in a radio frame based on one or more aliases for said terminal identification.

13. A method according to any of claims 8-12, wherein a physical protocol layer in the firstmobile terminal receives the data to transmit from a MAC layer.

14. A method according to any of claims 1-7, wherein the firstmobile terminal determines (306) said resource element for reception of data from the second mobile terminal, and said terminal identification (ID) is an identification of the second terminal.

15. A method according to claim 14, wherein the firstmobile terminal receives said cornmurncation from the second terminal on a dedicated resource element used for sigmlling to announce a forthcoming data transmission from the second terminal, and reads the identification of the second terminal in said communication.

16. A method according to any of claims 1-15, the radio resources being further separated in the frequency or code domain, wherein the cryptographic function P comprises a component P_x in the time domain and a component P_y in the frequency or code domain, thereby determining a time component and a frequency or code componentof said resource element independently.

17. An arrangement in a first mobile terminal (600) operative for determining allocation of radio resources for communicating amongst a group of mobile terminals in direct mode operation (DMO), the radio resources being generally divided into resource elements (REfe) in different time slots of a radio frame structure, the first mobile terminal comprising:

- a first determining module (600a) adapted to determine a communication (S-out, S- in) with a second mobile terminal (602) of the group,

- a second determining module (600b) adapted to determine a resource element (RE) for communicating data with the second mobile terminal (602) by applying a predefined cryptographic function P based on a terminal identification (ID), the cryptographic function P being configured to provide terminal-specific resource elements within respective radio frames, and

- a communication module (600c) adapted to communicate said data with the second mobile terminal (602) on the determined resource element (RE).

18. An arrangement according to claim 17, wherein the second determining module (600b) is further adapted to determine said resource element (RE) by applying the cryptographic function P further based on a shared predefined group key (KG) configured in the mobile terminals of said group.

19. An arrangement according to claim 17 or 18, wherein the second determining module (600b) is further adapted to determine said resource element (RE) by applying the cryptographic function P further based on a current frame identity (1) to provide radio frame specific resource elements.

20. An arrangement according to claim 19, wherein the second determining module (600b) is further adapted to choose the cryptographic function Pfrom a set of different radio frame specific cryptographic functions used to determine said radio frame specific resource elements.

21. An arrangement according to any of claims 17-20, wherein the second detemtining module (600b) is further adapted to determine said resource element (RE) by first detemtining a virtual resource element (VRE) by means of the

cryptographic function P and then mapping the deterained virtual resource element into said resource element for communication by means of a first preset mapping scheme.

22. An arrangement according to any of claims 17-20, wherein the second detemtining module (600b) is further adapted to determine said resource element (RE) by first detemtining a virtual resource element (VRE) by means of a second preset mapping scheme and then translating the determined virtual resource element into said resource element for communication by means of the cryptographic function P.

23. An arrangement according to claim 21 or 22, wherein the number of available virtual resource elements (R) is approximately equal to the number of available resource elements for communication (r).

24. An arrangement according to any of claims 17-23, wherein the second detemtining module (600b) is further adapted to determine said resource element (RE) for transmission of data to the second mobile terminal (602) and said terminal identification (ID) is an identification of the first mobile tenninal.

25. An arrangement according to claim 24, wherein the communication module (600c) is further adapted to check whether the deterained resource element (RE) for transmission is used in a current radio frame by a third mobile teminal of said group, and if so, the second detemtining module (600b) is further adapted to determine a new resource element for transmission in a subsequent radio frame by applying the cryptographic function Phased on a first alias for said terminal identification.

26. An arrangement according to claim 25, wherein the second detenmning module (600b) is further adapted to generate the first alias based on said terminal identification.

27. An arrangement according to claim 25 or 26, wherein the second detemtining module (600b) is further adapted to repeat said determination of new resource elements for subsequent radio frames based on further aliases for said terminal identification until an unused resource element is obtained.

28. An arrangement according to any of claims 24-27, wherein the second detemtining module (600b) is further adapted to determine one or more additional resource elements for transmission in a radio frame based on one or more aliases for said terminal identification.

29. An arrangement according to any of claims 24-28, wherein the first mobile terminal further comprises a data manager (600d) in which a physical protocol layer receives the data to transmit from a MAC layer.

30. An arrangement according to any of claims 17-23, wherein the second detemtining module (600b) is further adapted to determine said resource element (KE) for reception of data from the second mobile terminal, and said terminal identification (ID) is an identification of the second terminal.

31. An arrangement method according to claim 30, wherein the firstmobile terminal is adapted to receive said communication from the second terminal on a dedicated resource element used for sigmlling to announce a forthcoming data transmission from the second terminal, and to read the identification of the second terminal in said communication.

32. An arrangement according to any of claims 17-31, the radio resources being further separated in the frequency or code domain, wherein the cryptographic function P comprises a component P_x in the time domain and a component P_y in the frequency or code domain, such that a time component and a frequency or code component of said resource element are determined independently.