GSM

What is GSM? GSM (Global System for Mobile communication) is a digital mobile telephony system that is widely used in Europe and other parts of the world. GSM is a second generation cellular standard developed to cater voice services and data delivery using digital modulation. GSM uses a variation of time division multiple access (TDMA) and is the most widely used of the three digital wireless telephony technologies (TDMA, GSM, and CDMA).

What is GSM? GSM digitizes and compresses data, then sends it down a channel with two other streams of user data, each in its own time slot. It operates at either the 900 MHz or 1800 MHz frequency band

GSM Services TELE SERVICES : Includes mobile phones, emergency calling etc. DATA SERVICES : Includes SMS (Short message service), fax, voicemail, electronic mail. SUPPLYMENTARY SERVICES : I/C & O/G calls, call forwarding, call hold, call waiting, conference, etc.

GSM Subscriber Service Dual-Tone MultiFrequency (DTMF)—DTMF is a tone signaling scheme often used for various control purposes via the telephone network, such as remote control of an answering machine. facsimile group III—GSM supports CCITT Group 3 facsimile. As standard fax machines are designed to be connected to a telephone using analog signals, a special fax converter connected to the exchange is used in the GSM system. short message services—A convenient facility of the GSM network is the short message service. A message consisting of a maximum of 160 alphanumeric characters can be sent to or from a mobile station.

GSM Subscriber Services cell broadcast—A variation of the short message service is the cell broadcast facility. A message of a maximum of 93 characters can be broadcast to all mobile subscribers in a certain geographic area. Typical applications include traffic congestion warnings and reports on accidents. voice mail—This service is actually an answering machine within the network, which is controlled by the subscriber. Calls can be forwarded to the subscriber's voice-mail box and the subscriber checks for messages via a personal security code. fax mail—With this service, the subscriber can receive fax messages at any fax machine. The messages are stored in a service center from which they can be retrieved by the fax subscriber via a personal security code to the desired number.

GSM Supplwewwm.Vidyaerthipnlus.tcomary Services call forwarding—This service gives the subscriber the ability to forward incoming calls to another number if the called mobile unit is not reachable, if it is busy, if there is no reply, or if call forwarding is allowed unconditionally. barring of incoming calls—This function allows the subscriber to prevent incoming calls. The following two conditions for incoming call barring exist: baring of all incoming calls and barring of incoming calls when roaming outside the home network. advice of charge (AoC)—The AoC service provides the mobile subscriber with an estimate of the call charges. There are two types of AoC information: one that provides the subscriber with an estimate of the bill and one that can be used for immediate charging purposes. 9

GSM Supplwewwm.Vidyaerthipnlus.tcomary Services call hold—This service enables the subscriber to interrupt an ongoing call and then subsequently reestablish the call. The call hold service is only applicable to normal telephony. call waiting—This service enables the mobile subscriber to be notified of an incoming call during a conversation. The subscriber can answer, reject, or ignore the incoming call. Call waiting is applicable to all GSM telecommunications services using a circuit-switched connection. multiparty service—The multiparty service enables a mobile subscriber to establish a multiparty conversation— that is, a simultaneous conversation between three and six subscribers. This service is only applicable to normal telephony. 10

GSM Subscriber Service Calling line identification presentation/restriction— These services supply the called party with the integrated services digital network (ISDN) number of the calling party. The restriction service enables the calling party to restrict the presentation. The restriction overrides the presentation. Closed user groups (CUGs)—CUGs are generally comparable to a PBX. They are a group of subscribers who are capable of only calling themselves and certain numbers. Barring of outgoing calls—This service makes it possible for a mobile subscriber to prevent all outgoing calls.

Architecture GSM Network sub-system Radio sub-system Operation and maintenance sub-system

Architecture GSM GMSC-Gateway Mobile Switching Centre PSTN – Public Switched Telephone Network PLMN – Public Land Mobile Network

Mobile Station (MS) The Mobile Station is made up of two entities: Mobile Equipment (ME) Subscriber Identity Module (SIM) Portable, vehicle mounted, hand held device  Uniquely identified by an IMEI (International Mobile Equipment Identity) Voice and data transmission Monitoring power and signal quality of surrounding cells for optimum handover Power level : 0.8W – 20 W 160 character long SMS.

Mobile Station (MS) Subscriber Identity Module(SIM) Smart card contains the International Mobile Subscriber Identity (IMSI) Allows user to send and receive calls and receive other subscribed services Protected by a password or PIN Can be moved from phone to phone – contains key information to activate the phone

Network Sub-System/Switching System  Home location register (HLR) —The HLR is a database used subscriptions. for storage and management of The HLR is considered the most important database, as it stores permanent data about subscribers, including a subscriber's service profile, location information, and activity status.  Mobile services switching center (MSC) —The MSC performs the telephony switching functions of the system. It controls calls to and from other telephone and data systems. It also performs such functions as toll ticketing, network interfacing, common channel signaling, and others. 16

Network Sub-System/Switching System Visitor location register (VLR) —The VLR is a database that contains temporary information about subscribers that is needed by the MSC in order to service visiting subscribers. The VLR is always integrated with the MSC. Authentication center (AUC) —A unit called the AUC provides authentication and encryption parameters that verify the user's identity and ensure the confidentiality of each call. The AUC protects network operators from different types of fraud found in today's cellular world.

Network Sub-System/Switching System Equipment identity register (EIR) —The EIR is a database that contains information about the identity of mobile equipment that prevents calls from stolen, unauthorized, or defective mobile stations. The AUC and EIR are implemented as stand-alone nodes or as a combined AUC/EIR node.

Base Station System/Radio Sub-System  BSC —The BSC provides all the control functions and physical links between the MSC and BTS. It is a high-capacity switch that provides functions such as handover, cell configuration data, and control of radio frequency (RF) power levels in base transceiver stations. A number of BSCs are served by an MSC.  BTS —The BTS handles the radio interface to the mobile station. The BTS is the radio equipment (transceivers and antennas) needed to service each cell in the network. A group of BTSs are controlled by a BSC.

Base Station System/Radio Sub-System 20

MAINTENANCE SUBSYSTEM OPERATION AND MAINTENANCE SUBSYSTEM Dynamic monitoring and controlling of network. Operation and maintenance data function. Configuration management. Fault report and alarm handling. Performance supervision. Storage of software and data. Stores data for minimum one year.

Security in GSM On air interface, GSM uses encryption and TMSI instead of IMSI. SIM is provided 4-8 digit PIN to validate the ownership of SIM 3 algorithms are specified A3 algorithm for authentication A5 algorithm for encryption A8 algorithm for key generation

GSM SecuritywDww.Viedyarsthipilugs.comn Requirements Add significant overhead on call set up Increase bandwidth of the channel Increase error rate Add expensive complexity to the system Cost effective scheme Define security procedures Generation and distribution of keys Exchange information between operators Confidentiality of algorithms 23

GSM Sewwcw.uVidyrartihiptluys.com Features Key management is independent of equipment Subscribers can change handsets without compromising security Subscriber identity protection not easy to identify the user of the system intercepting a user data Detection of compromised equipment - Detection mechanism whether a mobile device was compromised or not Subscriber authentication - The operator knows for billing purposes who is using the system Signaling and user data protection- Signaling and data channels are protected over the radio path 24

Authentication awnww.dVidyarEthipluns.cocm ryption Scheme Mobile Station Radio Link GSM Operator Challenge RAND SIM Ki SRES A3 A3 K i Signed response (SRES) SRES A8 Authentication: are SRES A8 values equal? Kc Kc mi A5 Encrypted Data A5 mi 25

A3 – MS Authwwew.nVidytarithcipluas.cotmion Algorithm Goal Generation of SRES response to MSC’s random challenge RAND RAND (128 bit) A3 Ki (128 bit) SRES (32 bit) 26

A8 – Voice Priwvwwa.Vidcyartyhiplus.Kcom ey Generation Algorithm Goal Generation of session key Kc A8 specification was never made public RAND (128 bit) A8 Ki (128 bit) KC (64 bit) 27

Logical Implemwewwn.Vidtyaarthiptluis.coom n of A3 and A8 Both A3 and A8 algorithms are implemented on the SIM Operator can decide, which algorithm to use. Algorithms implementation is independent of hardware manufacturers and network operators. COMP128 is used for both A3 and A8 in most GSM networks. COMP128 is a keyed hash function 28

A5 – Encrwywwp.Vidytarithioplusn.com Algorithm A5 is a stream cipher Implemented very efficiently on hardware Design was never made public Leaked to Ross Anderson and Bruce Schneier Variants A5/1 – the strong version A5/2 – the weak version A5/3 GSM Association Security Group and 3GPP design Based on Kasumi algorithm used in 3G mobile systems 29

A5 Ewwwn.Vidcyarrthipylus.cpom tion Mobile Stations Base Station Subsystem Network Management Subscriber and terminal equipment databases OMC BTS Exchange System VLR BTS BSC MSC HLR AUC BTS EIR A5 Encryption 30