๐ก GSM & CDMA Deep Dive
TDMA · SIM · IMSI · TMSI · GPRS · LTE · OFDMA
Theory
Questions
MCQs
Practice
Cheat Sheet
⏱️ TDMA — Time Division Multiple Access GSM ENGINE
Core Idea: One radio frequency channel is divided into repeating time slots. Multiple users share the same frequency — each gets exclusive use during their assigned slot.
Analogy: Like taking turns at a meeting mic — everyone uses the same frequency but only one person talks at a time.
Analogy: Like taking turns at a meeting mic — everyone uses the same frequency but only one person talks at a time.
๐ GSM TDMA Parameters
- Channel bandwidth: 200 kHz
- Time slots per frame: 8
- Frame duration: 4.615 ms
- Each slot: ~577 ยตs
- Raw bit rate: 270.833 kbps
- Voice coded at: 13 kbps (full rate)
- Frames per second: ~217
๐ TDMA + FDMA Together in GSM
- FDMA: separates users onto different 200 kHz frequencies
- TDMA: further divides each frequency into 8 time slots
- = 8 users per frequency carrier
- Each user transmits only 1/8 of the time
- Idle slots allow monitoring of neighbor cells → enables handoff
⚡ Burst Transmission
- Each user's phone transmits in short bursts (1 slot per frame)
- Burst contains: voice data + training sequence + guard bits
- Training sequence = known pattern for channel equalization
- During the other 7 slots: phone scans neighbor cells → feeds handoff decisions to BSC
๐ณ SIM — Subscriber Identity Module PORTABLE IDENTITY
What it stores: IMSI · TMSI · Ki (128-bit auth key) · ICCID · LAI · PIN/PUK · Phone book · SMS
Key insight: SIM identifies the subscriber (person), NOT the device. Swap SIM → take your identity to any phone.
Key insight: SIM identifies the subscriber (person), NOT the device. Swap SIM → take your identity to any phone.
๐พ SIM Physical Types
- Mini-SIM (2FF): ~25×15mm (older)
- Micro-SIM (3FF): iPhone 4 era
- Nano-SIM (4FF): ~12.3×8.8mm (current)
- eSIM: embedded, reprogrammable remotely — no physical card
๐ PIN / PUK Protection
- PIN: 4–8 digits. Wrong 3× → SIM blocked
- PUK: 8-digit unblock code
- PUK wrong 10× → SIM permanently destroyed
- Ki: 128-bit key, never transmitted over the air
๐ SIM in Roaming
- SIM holds home network credentials (IMSI, Ki)
- Foreign MSC reads IMSI → queries home HLR
- Home HLR authenticates via AuC → sends profile to VLR
- eSIM: switches operator profiles OTA via RSP
๐ IMSI & TMSI — Identity System PRIVACY CORE
IMSI = MCC (3) + MNC (2–3) + MSIN (up to 10) ≤ 15 digits
Example: 404 (India) + 10 (Airtel) + 1234567890 → 404101234567890
๐ข IMSI Structure
- MCC = Mobile Country Code (3 digits) — identifies country
- MNC = Mobile Network Code (2–3 digits) — identifies operator
- MSIN = Mobile Subscriber Identification Number (up to 10 digits)
- Max: 15 digits total (ITU-T E.212)
- Permanent — never changes unless SIM replaced
๐ญ TMSI — Privacy Alias
- Temporary 32-bit alias for IMSI — assigned by VLR
- Sent encrypted to mobile after authentication
- Changes at every Location Area Update
- Prevents "IMSI catchers" from tracking subscribers
- VLR maintains TMSI↔IMSI mapping internally
- If VLR crashes → network requests IMSI as fallback
GSM Authentication Flow (Triplet)
AuC generates triplet: RAND (128-bit) + SRES (32-bit) + Kc (64-bit cipher key)
↓ (triplet sent to VLR)
Network → sends RAND challenge to mobile
SIM → computes SRES = A3(Ki + RAND) & Kc = A8(Ki + RAND)
Network → compares received SRES with stored SRES → ✅ authenticated
A5 algorithm uses Kc to encrypt the radio link (ciphering)
Key rule: Ki NEVER travels over the air. Only the RAND challenge and SRES response are exchanged. The SIM and AuC each independently compute SRES and Kc — identical because they both have Ki.
๐ฆ GPRS — General Packet Radio Service 2.5G
Core Innovation: Added packet switching to GSM's circuit-switched network → "Always-on" mobile internet with volume-based billing.
๐ก GPRS Key Facts
- Speed: up to 171.2 kbps (all 8 slots, CS-4)
- Typical: 40–114 kbps
- Always-on: no dial-up delay
- Billing: per KB/MB (not per minute)
- Runs alongside GSM voice
⚙️ Coding Schemes
- CS-1: 9.05 kbps/slot — max error protection
- CS-2: 13.4 kbps/slot — high protection
- CS-3: 15.6 kbps/slot — medium
- CS-4: 21.4 kbps/slot — no error protection
- EDGE (8-PSK): up to 384 kbps
๐ GPRS Network Nodes
- SGSN (Serving GPRS Support Node): routes data, tracks location for packet data — like MSC but for data
- GGSN (Gateway GPRS Support Node): gateway to internet/external networks
- Gb interface: BSC ↔ SGSN
- Gn interface: SGSN ↔ GGSN
- Gi interface: GGSN ↔ Internet
GPRS Procedure Summary
- GPRS Attach: mobile registers with SGSN for packet data service
- PDP Context Activation: mobile gets IP address; GTP tunnel created SGSN↔GGSN
- Data flows: mobile ↔ PDCH ↔ BSC ↔ SGSN ↔ GGSN ↔ Internet
- Routing Area (RA) tracking: SGSN tracks subscriber at Routing Area level
- IMSI Detach: mobile informs network it is switching off → network stops paging
๐ LTE — Long Term Evolution 4G ALL-IP
Core Principle: Everything over IP — voice (VoLTE), data, signaling — all packets. Flat architecture = fewer nodes = lower latency.
๐ LTE Key Specs
- Peak DL: 150 Mbps (Cat 4) / 1 Gbps (LTE-A)
- Peak UL: ~50 Mbps
- Latency: 15–50 ms
- Bandwidths: 1.4, 3, 5, 10, 15, 20 MHz
- Sub-carrier spacing: 15 kHz
๐️ EPC — Evolved Packet Core
- eNodeB: Smart LTE base station (= BTS + BSC)
- MME: Mobility, auth, paging (= MSC + SGSN control)
- SGW: Data routing, mobility anchor (= SGSN user plane)
- PGW: Gateway to internet, IP alloc (= GGSN)
- HSS: Subscriber DB + auth (= HLR + AuC)
๐ LTE Interfaces
- X2: eNodeB ↔ eNodeB (fast handover)
- S1-MME: eNodeB ↔ MME (control)
- S1-U: eNodeB ↔ SGW (user data)
- S5/S8: SGW ↔ PGW (data, S8 = roaming)
- S6a: MME ↔ HSS (subscriber info)
LTE-Advanced Enhancements
Carrier Aggregation (CA): Combine up to 5 × 20 MHz carriers = 100 MHz total bandwidth → proportionally higher speeds.
MIMO: Up to 8×8 antenna arrays — spatial multiplexing transmits multiple independent streams on same frequency.
HetNet: Mix of macro cells, small cells, picocells, femtocells (Home eNodeB / HeNB) for indoor/dense coverage.
MIMO: Up to 8×8 antenna arrays — spatial multiplexing transmits multiple independent streams on same frequency.
HetNet: Mix of macro cells, small cells, picocells, femtocells (Home eNodeB / HeNB) for indoor/dense coverage.
๐ถ OFDMA — Orthogonal Frequency Division Multiple Access 4G/5G ENGINE
๐ฃ️ The Highway Analogy: Traditional FDMA = one 6-lane highway for ONE truck. OFDMA = 100 narrow lanes for 100 motorcycles simultaneously. The lanes are "orthogonal" (perfectly parallel — don't cross), so they don't interfere even when close together. One lane hits a pothole (fading) → only one motorcycle affected. Assign more lanes (Resource Blocks) to users who need more data — in real-time, every half-millisecond.
๐ฌ How OFDMA Works
- One wide channel → hundreds of narrow sub-carriers (15 kHz each)
- Sub-carriers are orthogonal: peaks of one coincide with zeros of all others
- Different Resource Blocks assigned to different users
- 1 RB = 12 sub-carriers × 1 time slot (0.5 ms)
- Scheduler assigns RBs dynamically based on CQI
✅ OFDMA Advantages
- Multipath resistance: narrow sub-carriers + cyclic prefix eliminate ISI
- Frequency diversity: fading on one sub-carrier ≠ whole signal lost
- Flexible allocation: more RBs for heavy users, fewer for light
- High spectral efficiency: overlapping orthogonal sub-carriers
๐ก SC-FDMA (LTE Uplink)
- LTE uses SC-FDMA (not OFDMA) on uplink
- Reason: OFDMA has high PAPR (Peak-to-Average Power Ratio) → drains phone battery
- SC-FDMA = single carrier → much lower PAPR → battery efficient
- Similar capacity/efficiency to OFDMA
Cyclic Prefix — Anti-Multipath Guard
Cyclic Prefix: A copy of the end of each OFDM symbol, appended to the beginning. Creates a guard interval so multipath echoes die out before the symbol is processed — eliminates Inter-Symbol Interference (ISI).
Trade-off: Longer CP = better multipath protection, but more overhead = less spectral efficiency.
Trade-off: Longer CP = better multipath protection, but more overhead = less spectral efficiency.
๐บ️ Integration Map — How It All Connects
GSM TDMA (2G) GPRS (2.5G) LTE OFDMA (4G)
───────────────── ─────────────────── ──────────────────────
8 time slots/freq Packet switching Sub-carrier RB assignment
SIM identifies user SGSN + GGSN added EPC replaces core network
IMSI = true ID CS-1 to CS-4 speeds eNodeB = smart BTS
TMSI = alias ID "Always on" data VoLTE = voice over IP
Auth: Ki+RAND→SRES PDP Context = IP conn EPS Bearer = data pipe
Protected by: SIM Ki key + TMSI privacy + AuC authentication
Section 2 — 50 Conceptual Questions
Section 3 — 100 Master MCQs
Score: 0 / 0
⚡
Rapid Fire — 150 Questions
Speed & pattern recognition · Shuffled every round
—
CORRECT
150
TOTAL
—
ACCURACY
Identity Hierarchy
ICCID → identifies the SIM card (physical card serial number, 18–22 digits)
IMSI → identifies the subscriber (permanent, stored on SIM, max 15 digits)
TMSI → temporary alias for IMSI (privacy, 32-bit, assigned by VLR, changes often)
MSISDN → the phone number (what people dial to reach you)
IMEI → identifies the device hardware (NOT on SIM — stored in phone, 15 digits)
GPRS Coding Schemes
| Scheme | Speed / Slot | Error Protection | Signal Needed |
|---|---|---|---|
| CS-1 | 9.05 kbps | Maximum | Weak OK |
| CS-2 | 13.4 kbps | High | Moderate |
| CS-3 | 15.6 kbps | Medium | Good |
| CS-4 | 21.4 kbps | None | Excellent |
Modulation — Bits Per Symbol
| Modulation | Bits/Symbol | Used In | SNR Needed |
|---|---|---|---|
| GMSK | 1 | GSM / GPRS | Low |
| 8-PSK | 3 | EDGE | Moderate |
| QPSK | 2 | LTE (low SNR) | Low |
| 16-QAM | 4 | LTE (mid SNR) | Moderate |
| 64-QAM | 6 | LTE (high SNR) | High |
| 256-QAM | 8 | LTE-Advanced | Very High |
LTE EPC Node Mapping
| LTE Node | Replaces (GSM) | Function |
|---|---|---|
| eNodeB | BTS + BSC | Smart radio base station, radio scheduling |
| MME | MSC + SGSN (control) | Mobility management, auth, paging |
| SGW | SGSN (user plane) | Data routing, mobility anchor |
| PGW | GGSN | Gateway to internet, IP address allocation |
| HSS | HLR + AuC | Subscriber database + authentication |
Key Acronyms
TDMA
Time Division Multiple Access
SIM
Subscriber Identity Module
IMSI
International Mobile Subscriber Identity
TMSI
Temporary Mobile Subscriber Identity
GPRS
General Packet Radio Service (2.5G)
LTE
Long Term Evolution (4G)
OFDMA
Orthogonal Frequency Division Multiple Access
SC-FDMA
Single Carrier FDMA (LTE uplink)
MCC
Mobile Country Code (3 digits)
MNC
Mobile Network Code (2–3 digits)
MSIN
Mobile Subscriber Identification Number
ICCID
Integrated Circuit Card ID (SIM serial)
Ki
Individual Subscriber Authentication Key (128-bit)
RAND
128-bit Random Challenge (from AuC)
SRES
Signed Response (32-bit, from A3+Ki+RAND)
Kc
Cipher Key (64-bit, from A8+Ki+RAND)
SGSN
Serving GPRS Support Node
GGSN
Gateway GPRS Support Node
EPC
Evolved Packet Core (LTE core network)
MME
Mobility Management Entity
SGW
Serving Gateway
PGW
PDN Gateway
HSS
Home Subscriber Server
VoLTE
Voice over LTE (voice as IP packets)
PAPR
Peak-to-Average Power Ratio
RB
Resource Block (12 sub-carriers × 0.5 ms)
CQI
Channel Quality Indicator (0–15)
HARQ
Hybrid Automatic Repeat reQuest