GSM Technology

GSM Technology: The Global Standard That Connected the World

The Global System for Mobile Communications (GSM) was the first digital cellular standard to achieve worldwide adoption, connecting over 5 billion people at its peak. Developed in Europe during the 1980s and launched commercially in 1991, GSM standardized mobile telephony across national borders for the first time — a European traveler could use the same phone in any GSM country. Its well-designed architecture, robust security, and the innovative SIM card concept became the foundation upon which all subsequent mobile generations were built.

GSM System Architecture

The GSM network consists of three main subsystems:

Mobile Station (MS):

• Mobile Equipment (ME): The phone hardware
• SIM card: Stores subscriber identity (IMSI), authentication keys, phonebook
• SIM separates identity from hardware — swap SIM, keep your number in any phone

Base Station Subsystem (BSS):

• Base Transceiver Station (BTS): Radio equipment and antennas at cell site
• Base Station Controller (BSC): Manages multiple BTSs, handles handover decisions, radio resource management
• Typical: 1 BSC controls 20-50 BTSs

Network Switching Subsystem (NSS):

• Mobile Switching Center (MSC): Routes calls, manages mobility
• Home Location Register (HLR): Permanent database of all subscribers
• Visitor Location Register (VLR): Temporary database for roaming subscribers
• Authentication Center (AuC): Security keys and algorithms
• Equipment Identity Register (EIR): Tracks stolen/banned phones by IMEI

TDMA Frame Structure

GSM uses a combination of FDMA and TDMA:

Frequency allocation:

• GSM 900: 890-915 MHz (uplink), 935-960 MHz (downlink) — 124 carriers
• GSM 1800 (DCS): 1710-1785 MHz (uplink), 1805-1880 MHz (downlink) — 374 carriers
• Each carrier: 200 kHz bandwidth

TDMA structure:

• Each 200 kHz carrier divided into 8 time slots
• One time slot = one physical channel for one user
• Time slot duration: 577 μs (156.25 bit periods)
• Frame duration: 8 × 577 μs = 4.615 ms

Burst structure within a slot:

The 26-bit training sequence enables the receiver to estimate the channel and equalize multipath distortion.

Multiframe and superframe hierarchy:

• 26-frame multiframe (120 ms): For traffic channels (24 traffic + 1 SACCH + 1 idle)
• 51-frame multiframe (235 ms): For control channels
• Superframe: 1326 frames (6.12 seconds)
• Hyperframe: 2048 superframes (3 hours 28 minutes) — encryption counter

Speech Coding

GSM uses sophisticated voice compression:

Full-Rate codec (FR): 13 kbps — Regular Pulse Excited Linear Predictive Coding (RPE-LPC) Half-Rate codec (HR): 5.6 kbps — Vector Sum Excited Linear Prediction (VSELP) Enhanced Full-Rate (EFR): 12.2 kbps — Algebraic CELP (significantly better quality) Adaptive Multi-Rate (AMR): 4.75-12.2 kbps — switches rate based on channel conditions

The codec extracts speech parameters (formant frequencies, pitch, energy) 50 times per second, transmitting only these parameters rather than the raw audio waveform. This achieves telephone quality at just 13 kbps — compared to 64 kbps for uncompressed PCM.

Channel Coding and Interleaving

GSM protects speech bits with varying levels of coding based on importance:

Class 1a bits (50 most important): Protected by 3-bit CRC + convolutional coding Class 1b bits (132 important): Protected by convolutional coding only Class 2 bits (78 least important): No protection — errors tolerable

After channel coding, 260 speech bits become 456 coded bits per 20 ms frame.

Interleaving: These 456 bits are spread across 8 time slots (8 different TDMA frames) so that a burst error in one slot corrupts at most 1/8 of the speech frame — survivable by the decoder.

Security: Authentication and Encryption

Authentication (proving identity):

1. Network sends random number RAND to mobile
2. SIM computes response SRES = A3(Ki, RAND) using secret key Ki
3. Network computes same SRES independently
4. Match → identity confirmed; mismatch → access denied

Encryption (privacy):

1. Both sides compute session key Kc = A8(Ki, RAND)
2. A5 cipher encrypts all traffic using Kc
3. A5/1 (strong version) or A5/2 (export version — now broken)

The SIM card's secret key Ki never leaves the SIM — even the network stores it only in the AuC. This elegant design means cloning a SIM requires physical access and sophisticated attacks.

Handover (Handoff)

GSM uses hard handover — the mobile switches from one cell to another in a brief interruption:

1. Mobile continuously measures signal quality from serving and neighboring cells
2. Reports measurements to BSC every 480 ms (SACCH)
3. BSC algorithm decides when handover is needed
4. BSC commands mobile to switch to new frequency/time slot
5. Interruption: ~60 ms (barely perceptible in voice)

Types: Intra-BSC (most common), Inter-BSC, Inter-MSC (roaming)

Key Takeaways

1. GSM combines FDMA (200 kHz carriers) and TDMA (8 slots per carrier) to serve 8 users per 200 kHz channel — a significant improvement over analog systems.
2. The SIM card innovation separates subscriber identity from phone hardware, enabling easy device changes and international roaming.
3. Speech coding at 13 kbps (RPE-LPC) achieves acceptable voice quality at 1/5 the rate of uncompressed PCM through parametric modeling.
4. Three-tier channel coding protects important speech bits while leaving less critical bits unprotected — optimizing the protection-to-overhead ratio.
5. Authentication using challenge-response with secret keys stored in the SIM prevents identity theft without ever transmitting the secret key.
6. GSM's clean architecture and standardized interfaces enabled a global ecosystem of interoperable equipment and services that connected billions of people.