1. GSM

2. What is GSM?
GSM (Global System for Mobile communication) is a digital mobile telephony system that is widely used in Europe and other parts of the world.
GSM is a second generation cellular standard developed to cater voice services and data delivery using digital modulation.
GSM uses a variation of time division multiple access (TDMA) and is the most widely used of the three digital wireless telephony technologies (TDMA, GSM, and CDMA).

3. What is GSM?
GSM digitizes and compresses data, then sends it down a channel with two other streams of user data, each in its own time slot.
It operates at either the 900 MHz or MHz frequency band

4. GSM Services
TELE SERVICES : Includes mobile
phones, emergency calling etc.
DATA SERVICES : Includes SMS (Short message service), fax, voic , electronic mail.
SUPPLYMENTARY SERVICES : I/C
& O/G calls, call forwarding, call hold,
call waiting, conference, etc.

5. GSM Subscriber Service
Dual-Tone MultiFrequency (DTMF)—DTMF is a tone signaling scheme often used for various control purposes via the telephone network, such as remote control of an answering machine.
facsimile group III—GSM supports CCITT Group 3 facsimile. As standard fax machines are designed to be connected to a telephone using analog signals, a special fax converter connected to the exchange is used in the GSM system.
short message services—A convenient facility of the GSM network is the short message service. A message consisting of a maximum of 160 alphanumeric characters can be sent to or
from a mobile station.

6. GSM Subscriber Services
cell broadcast—A variation of the short message service is the cell broadcast facility. A message of a maximum of 93 characters can be broadcast to all mobile subscribers in a certain geographic area. Typical applications include traffic congestion warnings and reports on accidents.
voice mail—This service is actually an answering machine within the network, which is controlled by the subscriber. Calls can be forwarded to the subscriber's voic box and the subscriber checks for messages via a personal security code.
fax mail—With this service, the subscriber can receive fax messages at any fax machine. The messages are stored in a
service center from which they can be retrieved by the
fax
subscriber via a personal security code to the desired
number.

7. GSM Supplwewwm.Vidyaerthipnlus.tcomary Services
call forwarding—This service gives the subscriber the ability to forward incoming calls to another number if the called mobile unit is not reachable, if it is busy, if there is no reply, or if call forwarding is allowed unconditionally.
barring of incoming calls—This function allows the subscriber to prevent incoming calls. The following two conditions for incoming call barring exist: baring of all incoming calls and barring of incoming calls when roaming outside the home network.
advice of charge (AoC)—The AoC service provides the mobile subscriber with an estimate of the call charges. There are two types of AoC information: one that provides the subscriber with an estimate of the bill and one that can be used for immediate
charging purposes. 9

8. GSM Supplwewwm.Vidyaerthipnlus.tcomary Services
call hold—This service enables the subscriber to interrupt an ongoing call and then subsequently reestablish the call. The call hold service is only applicable to normal telephony.
call waiting—This service enables the mobile subscriber to be notified of an incoming call during a conversation. The subscriber can answer, reject, or ignore the incoming call. Call waiting is applicable to all GSM telecommunications services using a circuit-switched connection.
multiparty service—The multiparty service enables a mobile subscriber to establish a multiparty conversation— that is, a simultaneous conversation between three and six subscribers. This service is only applicable to normal telephony. 10

9. GSM Subscriber Service
Calling line identification presentation/restriction— These services supply the called party with the integrated services digital network (ISDN) number of the calling party. The restriction service enables the calling party to restrict the presentation. The restriction overrides the presentation.
Closed user groups (CUGs)—CUGs are generally comparable to a PBX. They are a group of subscribers who are capable of only calling themselves and certain numbers.
Barring of outgoing calls—This service makes it possible for a mobile subscriber to prevent all outgoing calls.

10. Architecture GSM Network sub-system Radio sub-system
Operation and maintenance sub-system

11. Architecture GSM GMSC-Gateway Mobile Switching Centre
PSTN – Public Switched Telephone Network
PLMN – Public Land Mobile Network

12. Mobile Station (MS) The Mobile Station is made up of two entities:
Mobile Equipment (ME)
Subscriber Identity Module (SIM)
Portable, vehicle mounted, hand held device 
Uniquely identified by an IMEI (International Mobile Equipment Identity)
Voice and data transmission
Monitoring power and signal quality of surrounding cells for optimum handover
Power level : 0.8W – 20 W
160 character long SMS.

13. Mobile Station (MS) Subscriber Identity Module(SIM)
Smart card contains the International
Mobile Subscriber Identity (IMSI)
Allows user to send and receive calls and
receive other subscribed services
Protected by a password or PIN
Can be
moved from phone
to phone –
contains
key information to
activate the
phone

14. Network Sub-System/Switching System
 Home location register (HLR) —The HLR is a
database used
subscriptions.
for storage and management of
The HLR is considered the most
important database, as it stores permanent data about subscribers, including a subscriber's service profile, location information, and activity status.
 Mobile services switching center (MSC) —The MSC performs the telephony switching functions of the system. It controls calls to and from other telephone and data systems. It also performs such functions as toll ticketing, network interfacing, common channel signaling, and others. 16

15. Network Sub-System/Switching System
Visitor location register (VLR) —The VLR is a database that contains temporary information about subscribers that is needed by the MSC in order to service visiting subscribers. The VLR is always integrated with the MSC.
Authentication center (AUC) —A unit called the AUC provides authentication and encryption parameters that verify the user's identity and ensure the confidentiality of each call. The AUC protects network operators from different types of fraud found in today's cellular world.

16. Network Sub-System/Switching System
Equipment identity register (EIR) —The EIR is a database that contains information about the identity of mobile equipment that prevents calls from stolen, unauthorized, or defective mobile stations. The AUC and EIR are implemented as stand-alone nodes or as a combined AUC/EIR node.

17. Base Station System/Radio Sub-System
 BSC —The BSC provides all the control functions and physical links between the MSC and BTS. It is a high-capacity switch that provides functions such as handover, cell configuration data, and control of radio frequency (RF) power levels in base transceiver stations. A number of BSCs are served by an MSC.
 BTS —The BTS handles the radio interface to the mobile station. The BTS is the radio equipment (transceivers and antennas) needed to service each cell in the network. A group of BTSs are controlled by a BSC.

18. Base Station System/Radio Sub-System20

19. MAINTENANCE SUBSYSTEM
OPERATION
AND
MAINTENANCE SUBSYSTEM
Dynamic monitoring and controlling of
network.
Operation and maintenance data function.
Configuration management.
Fault report and alarm handling.
Performance supervision.
Storage of software and data.
Stores data for minimum one year.

20. Security in GSM On air interface, GSM uses encryption and
TMSI instead of IMSI.
SIM is provided 4-8 digit PIN to validate the ownership of SIM
3 algorithms are specified
A3 algorithm for authentication
A5 algorithm for encryption
A8 algorithm for key generation

21. GSM SecuritywDww.Viedyarsthipilugs.comn Requirements
Add significant overhead on call set up
Increase bandwidth of the channel
Increase error rate
Add expensive complexity to the system
Cost effective scheme
Define security procedures
Generation and distribution of keys
Exchange information between operators
Confidentiality of algorithms 23

22. GSM Sewwcw.uVidyrartihiptluys.com Features
Key
management is
independent
of equipment
Subscribers can change handsets without compromising security
Subscriber identity protection not easy to identify the user of the system intercepting a user data
Detection of compromised equipment - Detection mechanism whether a mobile device was compromised or not
Subscriber authentication - The operator knows for billing purposes who is using the system
Signaling and user data protection- Signaling and data channels are protected over the radio path 24

23. Authentication awnww.dVidyarEthipluns.cocm
ryption Scheme
Mobile Station
Radio Link
GSM Operator
Challenge RAND
SIM Ki
SRES A3 A3 K i
Signed response (SRES)
SRES A8
Authentication: are SRES A8
values equal? Kc Kc mi A5
Encrypted Data A5 mi 25

24. A3 – MS Authwwew.nVidytarithcipluas.cotmion Algorithm
Goal
Generation of SRES response to MSC’s random
challenge RAND
RAND (128 bit) A3
Ki (128 bit)
SRES (32 bit) 26

25. A8 – Voice Priwvwwa.Vidcyartyhiplus.Kcom
ey Generation
Algorithm
Goal
Generation of session key Kc
A8 specification was never made public
RAND (128 bit) A8
Ki (128 bit)
KC (64 bit) 27

26. Logical Implemwewwn.Vidtyaarthiptluis.coom n of A3 and A8
Both A3 and A8 algorithms are implemented
on the SIM
Operator can decide, which algorithm to use.
Algorithms implementation is independent of
hardware manufacturers and network operators.
COMP128 is used for both A3 and A8 in most GSM networks.
COMP128 is a keyed hash function 28

27. A5 – Encrwywwp.Vidytarithioplusn.com Algorithm
A5 is a stream cipher
Implemented very efficiently on hardware
Design was never made public
Leaked to Ross Anderson and Bruce Schneier
Variants
A5/1 – the strong version
A5/2 – the weak version
A5/3
GSM Association Security Group and 3GPP design
Based on Kasumi algorithm used in 3G mobile systems 29

28. A5 Ewwwn.Vidcyarrthipylus.cpom tion
Mobile Stations
Base Station Subsystem
Network Management
Subscriber and terminal equipment databases
OMC
BTS
Exchange System
VLR
BTS
BSC
MSC
HLR AUC
BTS
EIR
A5 Encryption 30