System Key question

[novascotian]

I am not a technician and do not have a trunking radio. I am looking for a clarification regarding the system key. The system I monitor is a Smartzone system. I have done some reading and it sounds like the system key is what allows a radio to connect to a particular system and would be provided by the system owner or manager. But once connected to the system and therefore a legitimate user how is it determined who has access to what talk group. The basic part of the question is, I guess that a user requests lets say 5 talk groups and the system administrator comes up with five that are available (a sub question is, does it matter if they are consecutive or all over the map so to speak?) and then what happens? Is the permission to program in these five talk groups part of the system key or is there something else?
The extension to the basic question is this: If lets say the Emergency Management department says they would like to have the talk group for the County PD in their radios I am assuming that they cannot technically just add it. They need the same "thing" they need as if they were being initially permitted to put in their own new talk groups, but the question is more like who makes these decisions. I am guessing that the system administrators would not just say Okay and here it is. Typically would there need to be permission in writing from the other user to allow someone else to use that TG? And then that brings up the question, that ultimately someone who runs the system could behind the scenes have whatever talk group they want since they run the system, is that correct?

In my area a division of the telephone utility (Bell) operates the system but it is heavily or mostly used by government, EMS and police. There is a concept floating around among scanner listeners that some agencies can just put in whatever talk groups they want to suit any situation without asking for any permission, but my thought is more that it really only "someone" at Bell that can do or authorize such things. I am not speaking here of any kind of hacking, just the legitimate process.

 

[N4DES]

Simply put, the System Key is a small file that allows a programmer/technician to program or modify a trunking system/personality sections of a radio. It is just like the unlock code that allows a piece of software, such as Office 7, to operate on your computer except there is nothing to type.

There is also a newer system key called the Advanced System Key (ASK) that is utilized on Motorola radios that gives the System Admin. a lot of tools to manage exactly what functions and features can be locked out or allowed that include ranges of ID's and talkgroups. Also most radios that are touched by and ASK can't go back the software key so YMMV on secondhand procurement.

In many instances the system key is considered intellectual system property, so having it or using it could be a violation of local laws.

 

[mmckenna]

Any changes to the individual radios requires a system key. The system key is just a little data file and it can be copied and shared.

The individual radios have a 6 digit ID number that is programmed into them. The trunking controller is programmed to allow or deny that radio id. Each individual ID is programmed into the trunking controller, there is an ENA = y or n field. Whoever has control of the system controller can enable or not enable individual ID's. An individual ID for a specific radio (or group of radios if someone programmed them with the same id) would look like: i700468 for example. The part of the controller software that does this is called SAC or subscriber access control. My example may be a bit out of date, I only ever used the system controller terminal connection to make these changes, or by terminal program via modem.

As for the talk groups, it's just a number that's programmed into the radio. A talkgroup is just a unique number in the system. A talk group ID in the system terminal interface would look like t800111, for example. Individual talk groups are controlled in the system controller and would require having those talkgroup ID's programmed into the system and enabled, just like the individual subscribers above.

The system I ran I kept locked down pretty well. Any individual ID's that were not actually assigned were disabled. I did the same thing with talk groups, also. If I didn't want the talk group used, I made sure it was disabled in the software.

Used to be that we were the only ones that had the systems keys, but at one point one of my predecessors let one of the radio installers use a copy while installing a mobile radio. After that we could never assure full control over the system, so I was very careful to keep it locked down. We do know that there were at least a couple of radios out there that had duplicate ID's.

As for individual groups setting up their own talk groups and adding them to the radios at will, the only way to do this, that I know of, would require a copy of the system key, programming software, and of course those talk group ID's being turned on in the system. I would be very surprised if this was happening as it would indicate a number of security failures on behalf of the provider. If they were really managing the system well, and there were much better tools to do this than what I had, the system manager would know when stuff like this happened.

 

[novascotian]

I am not sure if I have the gist of this right. The system key gives a radio an ID that allows access to the system as a whole, and identifies on that system. As for particular talk groups being allowed to that radio, is that done by a technician physically working on the radio, or is it done by the central system administrator from afar... as in the user agency asks for their talk group XYZ to be accessed by that radio and that would be done centrally. I am guessing not as the radio itself has to have the particular t g put in a dial position with a tag.

The ultimate question not answered yet is not so much technical as it is a protocol one. Someone must have to approve whether or not User X will get access to a particular tg. The feeling around here is that this government public safety office, I guess due to what it is, can simply add other agencies' talk groups whenever it wants but I maintain that because it really is just another user of the system it would have to ask for permission from the system administrator, and presumably the actual "owner" of the desired talk group.

 

[KE4ZNR]

Simply put, the System Key is a small file that allows a programmer/technician to program or modify a trunking system/personality sections of a radio. It is just like the unlock code that allows a piece of software, such as Office 7, to operate on your computer except there is nothing to type.

There is also a newer system key called the Advanced System Key (ASK) that is utilized on Motorola radios that gives the System Admin. a lot of tools to manage exactly what functions and features can be locked out or allowed that include ranges of ID's and talkgroups. Also most radios that are touched by and ASK can't go back the software key so YMMV on secondhand procurement.

In many instances the system key is considered intellectual system property, so having it or using it could be a violation of local laws.

Mark is 100% correct. And he has had more experience dealing with the above than most other folks here at RR.
As he says a copy of the System Key just "unlocks" parts of RSS or CPS (Moto radio programming software) that allows changes to be made to the radio then lets the tech write those changes back to the radio. Without that system key you can look but not modify programmed contents in a radio and you can't write any info back to the radio.

And the ASK allows system admins far more control than regular SKs. As he alludes to ASKs allow system admins to define Radio ID (RID) ranges and Talkgroup ID (TGID) Ranges which can be programmed by a radio shop. So a system admin could allow
a radio shop to only program RIDs and TGIDs between a certain range keeping better control over how many radios are on the system.

And whether or not is legal/illegal in a jurisdiction to fake a system key most system admins don't take kindly to "rogue" radios on their system and will inhibit them in a heartbeat if noticed.
Marshall KE4ZNR

 

[wa8pyr]

I am not sure if I have the gist of this right. The system key gives a radio an ID that allows access to the system as a whole, and identifies on that system. As for particular talk groups being allowed to that radio, is that done by a technician physically working on the radio, or is it done by the central system administrator from afar... as in the user agency asks for their talk group XYZ to be accessed by that radio and that would be done centrally. I am guessing not as the radio itself has to have the particular t g put in a dial position with a tag.

Not quite; the system key is simply the dongle (software or hardware) that allows a programmer to add a particular trunked system to a radio, or to make changes to that system when it's already in a radio. Talkgroups and Radio IDs are added to a radio by the technician doing the programming, and with the proper system key a programmer can pretty much do or add anything to a radio that it's possible to do or add. This means that any talkgroup could be programmed into the radio and any radio ID used as desired.

A software system key allows unlimited access, while the newer Advanced System Key is a hardware dongle which can be set up with particular restrictions on what talkgroups or radio IDs can be used. The ASK can also be set up with an expiration date, after which the dongle is utterly useless and cannot be reused.

More and more agencies are switching over to write-protected radios requiring ASK-only access, while newer radios are being shipped write-protected from Motorola as the default condition (unless otherwise specified by the buyer), in order to reduce the risk of unauthorized programming. Some system owners are even going as far as to issue an Advanced System Key to approved agencies or shops only as needed, with expiration dates of as little as two weeks, and the receiving agency being required to pay for the necessary hardware.

The ultimate question not answered yet is not so much technical as it is a protocol one. Someone must have to approve whether or not User X will get access to a particular tg. The feeling around here is that this government public safety office, I guess due to what it is, can simply add other agencies' talk groups whenever it wants but I maintain that because it really is just another user of the system it would have to ask for permission from the system administrator, and presumably the actual "owner" of the desired talk group.

It varies by system and locality, but generally permission to use any particular talkgroups must be granted by the agency who "owns" those talkgroups. In the case of systemwide interoperability talkgroups it might be the system administrator, while permission to use dispatch and tactical talkgroups "owned" by a specific agency must be granted by that agency.

Assuming that the agency desiring access has the proper permissions and has either a) approved access to a system key which allows them to program the desired talkgroups into their radios or b) a good radio shop which will do it for them, they could put anything they want into their radios. Most reputable and responsible radio shops and/or agencies which program radios will not program talkgroups or frequencies the customer does not have permission to use, else they run the risk of losing approved access to the system key.

A certain few agencies may be assumed to have unrestricted access to any talkgroup on the system, but this is generally reserved to the agency in control of the radio system, and then usually for service and troubleshooting purposes only.

 

[mmckenna]

I am not sure if I have the gist of this right. The system key gives a radio an ID that allows access to the system as a whole, and identifies on that system. As for particular talk groups being allowed to that radio, is that done by a technician physically working on the radio, or is it done by the central system administrator from afar... as in the user agency asks for their talk group XYZ to be accessed by that radio and that would be done centrally. I am guessing not as the radio itself has to have the particular t g put in a dial position with a tag.

The ultimate question not answered yet is not so much technical as it is a protocol one. Someone must have to approve whether or not User X will get access to a particular tg. The feeling around here is that this government public safety office, I guess due to what it is, can simply add other agencies' talk groups whenever it wants but I maintain that because it really is just another user of the system it would have to ask for permission from the system administrator, and presumably the actual "owner" of the desired talk group.

The others have covered it well. The system key is just that, a key. You have to have a key to open the door. In this case, you have to have a key to allow changes to the trunked personalities on the radios as well as the specific trunked system parameters for that radio. Without the key you cannot add anything to the radio.

The system manager, traditionally, would assign each radio a unique ID number. These are either expressed as a hexadecimal number or a regular decimal number. My old hand held radio (MTS2000 mdl 2) ID was 700468, the MCS2000 in my truck was 700469. Those numbers were specific to those radios and not found anywhere else on the system. If one of my radios was stolen, I could go into the system and tell it to disable that subscriber access control account. Once that was done, that radio ID would no longer be allowed to access my specific trunked system.

Talk groups were the same way. Each talk group was set up in the system to have specific attributes, priority, etc. That talk group would need to be programmed into the radio using it's specific talk group number. On a smart net system it would be 8xxxxx. Our primary talk group for me and my techs was 800143. That would be programmed into the radio and given a text ID, in my case PBX/Radio since it served my PBX and radio techs. Since this talk group had a unique ID, I would only program in to radios that I wanted to access that talk group, in this case, only my techs. No one else on the system would be able to talk or listen on that talk group with their own radios.

So, the second part of your question, the person who programmed the radios would have to add the talk groups to the radio. If one agency wanted to talk to another on their own talk groups, say ambulance wanting to talk on a police talk group, what we did, for example, was require the ambulance company to get written approval from the police chief stating exactly what the police chief wanted. Without that document in my hand, signed by the chief of police, no one would get their radio programmed to access something that wasn't specifically theirs.
"I guess due to what it is, can simply add other agencies' talk groups whenever it wants but I maintain that because it really is just another user of the system it would have to ask for permission from the system administrator, and presumably the actual "owner" of the desired talk group."
Exactly.

It gets a little fuzzy when you are looking from the outside. As with a lot of things, you may find that different system administrators require different ways of doing things. I would occasionally get someone who felt they "needed to talk or listen to the PD". My answer was always, "get it in writing signed by the chief of police and I'll be happy to give you that". Not once did that signed paper every show up.
Since the system you are talking about is run by your local Bell operating company, it would be their system, and they would make the rules, but it's very likely there were some specific memorandums of understanding between Bell and the individual public safety agencies about who had access to what.

 

[novascotian]

Thanks so much for all of these extensive answers. I have listened to this large system for more than 10 years and never really had a good understanding of how some of these things work. I am sure it varies some from system to system. I am thinking that in the case of this Bell system, that the system administrator has overall responsibility but for within one agency, lets say the City of Centerville, that there is a radio tech office or a civic administrator who then can control who gets what within the city's overall set of talk groups and radios.... at least that is what I am getting from what has been said. Also that concept of memorandums of agreement was interesting. The newer ASK with time limits I bet can be annoying to even legitimate users but seems like a great advance. A friend here was pointing out that there are ways around SK's all over the internet so I can see that something better is very useful.

Anyway, thanks again for all the generous time spent in answering .

 

[mmckenna]

A friend here was pointing out that there are ways around SK's all over the internet so I can see that something better is very useful. .

Exactly, which is why I kept the talk groups locked down in the system, to prevent someone from coming along with a hacked system key and setting up their own stuff on my system. That had happened in the past on other systems, and unless you have the right monitoring gear, it goes on without knowledge. I never had the right monitoring gear (can you say "Value Engineering"?) so I settled for a Uniden 895 trunk tracker scanner, or at least I did until we rebanded the system. We never did the ASK's but if I'd replaced the system with a similar, I would have.

Now I've replaced it with a Kenwood NexEdge system, and I've got it controlled with the system key, plus the radio ID and ESN numbers all need to match, not completely secure, but much better than what we had, and I managed to hide all this from the value engineering.

 

[ronenp]

My 2 cents on the subject
the system key allow you to change add or remove talk groups to the radio with the software
without it the software will not allow you to make any change to the particular system the system key is system depended it mean that even if you have a system key for one system and the radio have two systems it will allow you to do changes for the particular system that the system key belong to ..
as for the site if it will allow this talk group to go through it it depend on the site configuration
there are sites that allow any talk group to talk and there are that will not allow even a valid talk group with a non registered radio to talk .... or even to listen

 

[GregCarttar]

So, I'm guessing that's what happened to me yesterday:
I have an APX7500 that is registered on a system with a specific set of talkgroups.
Another organization that I am connected with also is registered on the same system with a set of talkgroups with their specific organization in addition to the set that I have.
Using THEIR system key, I tried to add their talkgroups to my existing codeplug by importing them to my codeplug, and I lost affiliation with the whole system. My groups and theirs.
I rewrote the original codeplug into the radio and it came back to life with my talkgroup set working as before.
So I'm guessing that to do this, I need an ASK that is programmed for their talkgroups AND my talkgroups.
I have been given verbal authorization to do this, I just need to purchase my own personal ASK device and the sysadmin will load it appropriately.
What is the correct part number to order from Motorola for an APX family ASK?

 

[RKG]

. . .

The system manager, traditionally, would assign each radio a unique ID number. These are either expressed as a hexadecimal number or a regular decimal number. My old hand held radio (MTS2000 mdl 2) ID was 700468, the MCS2000 in my truck was 700469. . . . .

Just a small correction: for analog systems (e.g., SmartZone), the Radio ID is a 4-digit hexadecimal number in the range 0001 through FFFF. These translate into decimal equivalents in the range 1 to 65,535. Typically, Radio IDs will be segregated into "blocks."

The six-digit decimal numbers beginning with "7" referred to are the sum of the decimal equivalent of the Radio ID and 700000. This summation is done in a radio receiving at PTT-ID from the data stream in order to pad out the display. A true UserID of decimal 700468 wouldn't be possible in a SmartZone system because it is above hexadecimal FFFF.

For digital trunking systems (AstroTrunking), things are a bit different: the Radio ID is a six-digit hexadecimal number in the range 000001 through FFFFFB, which translate to decimal numbers in the range 1 to 16,777,211 (at least in theory). (Since most Astro25 systems are migrations from SmartZone systems, I've actually never seen or programmed a Radio ID higher than FFFF.)

 

[N4KVE]

Also, the system key only controls trunking parameters. If you have the CPS, you can change scan lists, menu configurations, button, & switch functions, display settings, any non trunking freq's, & channel names etc without having the key. It's strictly for trunking settings.

 

[talviar]

unless it has been programmed using an advanced system key, then u need the ASK dongle in place to even write the codeplug back to the radio . . . .

 

[wa8pyr]

Also, the system key only controls trunking parameters. If you have the CPS, you can change scan lists, menu configurations, button, & switch functions, display settings, any non trunking freq's, & channel names etc without having the key. It's strictly for trunking settings.

Not 100% correct. If the radio has been write protected using an advanced system key, a codeplug cannot be written to it unless one has an ASK dongle for the trunked system(s) in the radio.

 

[N4DES]

Not 100% correct. If the radio has been write protected using an advanced system key, a codeplug cannot be written to it unless one has an ASK dongle for the trunked system(s) in the radio.

Yes that is correct and that does include the default trunking system #1 that ships with the radio that most do not know about. I have a work-around on the Master ASK that I have locked into the safe at my office.

 

[N4KVE]

I guess I was lucky. The last few years I picked up some UHF Astro radios that belonged to the Feds, & I had no problems with any of them setting up some 440-450 freq's.