2.3 Mobile Telephony

Content written by Alex DeLarge and Virtua7.

2.3.1 GSM

GSM, which is an abbreviation of Global System for Mobile telecommunications (formerly Group Speciale Mobile) is the most widespread digital cellular phone system. The whole of western Europe uses it, most of the developed world has at least a secondary network. The main competitor to GSM is PCS which isn't in use within the UK and as such is out of the scope of this FAQ.

How do you listen to GSM conversations? Get loads of money, learn a shed load about GSM, then try to implement Shamir, Wagner and Buryakov's A5/1 real-time cryptoanalysis technique (described at http://www.snapshield.com/Articles_helpful/Real_Time_Cryptanalysis.htm). This requires a very sexy scanner, a ninja PC (or equivalent) with lots of RAM and disk space, some ninja coding skills to convert the garbage picked up by the scanner into something useful. There was a project a while back to actually do this but the costs were estimated in the tens of thousands and it never really got very far.

2.3.2 3G

3G is a term used for the third generation of mobile phones, the first being analogue devices and second digital GSM. 3G mobiles typically use CDMA, UMTS, WCDMA, i-MODE and FOMA technologies. It is the final transition from a circuit switched systems to a fully packet switched mobile infrastructure and is supposed to improve speeds more than GPRS. 3G is apparently available on the Isle of Man but it will be some time before mainland UK sees 3G.

Potentially 3G technology should be more secure than the existing networks however as 3G is not yet in wide use it is not known whether the extra security features will be implemented properly. Users should be able to authenticate to the network whilst at the same time remaining anonymous to any eavesdropper. As well as authenticating to the network, the network authenticates to the user. After authentication the use of different ciphering algorithms can be decided.

Some flaws are already known to exist in 3G, the IMSI is send in clear text when allocating a TMS and the transmission of the IMEI is not protected at all. For this reason the IMEI should not be considered fit for use as a security feature. Eavesdropping of calls is also possible in networks which allow calls without encryption algorithms by a man-in-the-middle attack.

(expansion? - please submit suggestions)

2.3.3 GPRS

The General Packet Radio Service (GRPS) is a new service that allows data to transferred across mobile telephone networks. It should be obvious that this service is based on the sending of packets of data rather than a continuous connection - however it does in effect present an ``always on'' data connection. At a basic level it is similar in operating to other packet radio services and has a theoretical maximum bandwidth of 171.2 kbps whilst in practice you should expect to get somewhere around 45 kbps, just slightly slower than a standard modem. It uses a mechanism called TDMA (Time Division Multiple Access) in order to manage packet data more effectively. All the GPRS networks the author has seen use TCP/IP internally, and furthermore tend not to segregate the GPRS network from the Telephony infrastructure, instead relying upon the GPRS Tunneling Protocol (GTP) and some filtering to protect them.

What's the main difference between GPRS and GSM? In the GPRS world, only data (including SMS/MMS) is carried over GPRS. Voice traffic is still carried over the existing GSM infrastructure - hence the term '2.5G'. The equipment is also somewhat different in places. The key things to look out for are the Gateway Support Nodes (GSNs), *Mandatory* DNS servers, Lawful interception Gateways (LIG) and Border Gateways (BGs). Both Ericsson and Nokia have a large amount of information regarding GPRS infrastructure on their websites respectively. A quick Google session is likely to turn up most of what you need to know.

(technical paragraph? - please submit suggestions)

2.3.4 Mobile-Java

Mobile phones are now appearing on the market that support some form of Java environment into which programs can be downloaded over the air. Mobile Information Decide Profile (MDIP) is a set of Java APIS which with the Connected Limited Device Configuration (CLDC) provide a J2ME environment. This is a subset of a complete Java environment, for example it should not be possible for the JavaVM to allow access to sensitive storage areas on the phone such as address books. It remains to be seen if there are any flaws in the implementation.

(more to add? - please submit suggestions)

2.3.5 Where to read more?

As well as Google, all of the GSM/GPRS/3G standards themselves are available from ftp.3gpp.org. Be warned, some of them can be difficult to read, but persevere and you'll get the definitive word on whatever you're trying to find out. At best, they read like RFCs. At worst, they read like Chekov, translated into Chinese. If you prefer some paperware documentation, for GSM I recommend Redl, Weber and Oliphant's 'An introduction to GSM' (ISBN 0-89006785-6). For an understanding of GSM/GPRS that doesn't focus too much on the Radio side, look at Eberspacher, Vogel and Bettstetter's 'GSM Switching Services and Protocols (2nd edition)' (ISBN 0-471-49903-X). If you're after a greater understanding of 3G, stick to the standards as most of the books I've seen seem to quote them directly almost throughout.