Mobile generations 1G → 5G: what changed

Across the previous eight courses of the telecom track, we traced the entire journey of wireline and packet communications — from the copper local loop, digital E1 (2048 kbit/s) trunks, and SS7 signaling to RTP media streams, the SIP protocol, and the carrier NGN (Softswitch + MGW + SGW) core. Starting with this course, our subscriber cuts the cord and moves freely across cities, countries, and continents at the speed of a car or airliner. In this lesson, we build a complete engineering map of the five generations of mobile networks (1G → 5G): we examine why operators had to replace the air interface roughly every 10 years, how the core network evolved from pure circuit switching (CS) to a dual-domain architecture (CS + PS in 2G/3G) and an all-packet core (All-IP PS in 4G/5G), and why 2G GSM and 3G UMTS remain the backbone of global roaming, voice fallback, SMS, and M2M/IoT connectivity today.

Goal and prerequisites

Lesson goal: systematically distinguish the five generations of mobile communications (1G–5G) across four fundamental engineering axes — multiple radio access method, core switching domain architecture (CS / PS), subscriber identity and security mechanisms, and voice/data transport, while understanding the enduring role of 2G GSM and 3G UMTS inside a modern multi-RAT operator network.

What you need to know before starting:

• frequency, bandwidth, analog vs. digital modulation, TDM time-division multiplexing, and the 64 kbit/s basic digital channel from Telecom Basics (telbasics 1–8, 27);
• the separation of voice bearer channels from the SS7 (MTP, SCCP, TCAP, ISUP) signaling network from SS7 Signaling (ss7 1, 4, 56, 70);
• the decoupling of call control from media switching (Softswitch / MGC + MGW) from NGN and Softswitch Networks (ngn 1–4).

Real-world task

You are the Lead Core Network Architect at a national mobile operator. The company is preparing a five-year strategy for spectrum refarming (reallocating 900 MHz and 2100 MHz bands to 4G LTE and 5G NR) and core modernization. During an executive review, the CFO asks a blunt question:

1. "We have already deployed 4G LTE and 5G nationwide. Why are we still paying to maintain 2G/3G nodes — BSC/RNC controllers, MSC/VLR switches, HLR registers, STP signaling routers, and MAP/CAP protocols? Why can't we simply shut down 2G and 3G tomorrow morning?"
2. An audit reveals that 450,000 industrial M2M modems (smart utility meters, POS terminals, automotive eCall units) support only 2G/3G; furthermore, roughly 35% of smartphones (especially international roamers without bilateral VoLTE Roaming agreements) automatically drop from 4G LTE down to the 2G/3G radio network via CSFB (Circuit Switched Fallback) on every incoming or outgoing voice call!

To defend the network architecture and plan a safe migration, you need a crystal-clear understanding of how 1G → 5G evolved and which core mechanisms were introduced in each generation.

Four engineering axes of the 1G → 5G evolution

A change in generation number ("G" — Generation) occurs roughly once a decade and is never merely about "faster download speeds." A new generation is defined when four foundational pillars of the network change simultaneously:

1. Air Interface & Multiple Access: how dozens or hundreds of phones within a single base station sector share the same radio spectrum without interfering with one another (frequency division FDMA, time division TDMA, code division CDMA/WCDMA, or orthogonal frequency division OFDMA).
2. Core Network Switching Domains: how traffic is switched inside the operator core — over dedicated time-division voice circuits (CS — Circuit Switched), across parallel voice and packet domains (CS + PS), or over a unified packet core (All-IP PS — Packet Switched).
3. Identity & Cryptographic Security: where subscriber identity resides (hardcoded inside the handset or isolated inside a removable cryptographic smart card SIM / USIM / eSIM), whether the radio link is encrypted, and whether the handset authenticates the network.
4. Services & Data Rates: from analog-only voice to SMS text messaging, mobile broadband Internet, IP voice (VoLTE / VoNR), and deterministic network slicing for industrial automation.

Let us walk step by step through all five stages of this engineering ladder.

1G (1980s): analog cellular telephony (NMT, AMPS, TACS)

The first generation proved that automatic cellular telephony in motion was possible: a city was divided into cells with frequency reuse, and the mobile exchange learned to switch an active call from one base station to another as a car drove across town (Handover / Handoff).

Under the hood, however, 1G was a purely analog radio system:

• Multiple access: pure FDMA (Frequency Division Multiple Access). Every phone call locked an individual narrow radio carrier of $25\text{ kHz}$ (in Nordic NMT-450 / NMT-900) or $30\text{ kHz}$ (in North American AMPS), modulating speech with analog Frequency Modulation (FM) — just like an FM broadcast station.
• Three fatal flaws of 1G:
  1. Severely limited spectral capacity: one base station transceiver could handle only one conversation at a time. In dense cities, available frequencies quickly ran out.
  2. Zero security and no SIM cards: phones had no SIM card — the handset's factory Electronic Serial Number (ESN) was broadcast in cleartext over the air, and voice audio was unencrypted. Anyone with a radio scanner could eavesdrop on calls, and fraudsters intercepted ESNs over the air to program "cloned" phones billed to the victim.
  3. Incompatible national standards (no global roaming): Scandinavia and Eastern Europe used NMT, the UK used TACS, Germany used C-Netz, France used Radiocom 2000, and the US used AMPS. A phone from one country became a paperweight across the border.

2G (1991): the digital GSM revolution, SIM card, SMS, and the birth of the packet domain (GPRS/EDGE)

To replace Europe's patchwork of incompatible analog systems, the European Conference of Postal and Telecommunications Administrations (CEPT) formed the Groupe Spécial Mobile (GSM) in 1982 (later renamed Global System for Mobile Communications, standardized by ETSI, and subsequently handed over to 3GPP). The world's first commercial 2G GSM call was placed on July 1, 1991, in Finland (on the Radiolinja network).

The transition from 1G to 2G remains the single greatest architectural leap in mobile history:

• Digital speech and hybrid FDMA + TDMA: the frequency band (initially 900 MHz, later 1800 MHz and 1900 MHz) is sliced into $200\text{ kHz}$ radio carriers, and each carrier is divided in time into 8 TDMA timeslots of $576.92\text{ }\mu\text{s}$ each (a $4.615\text{ ms}$ frame). Speech is digitized and compressed by a vocoder (FR $13\text{ kbit/s}$, EFR $12.2\text{ kbit/s}$, AMR $4.75\text{–}12.2\text{ kbit/s}$), allowing a single base station transceiver to serve 8 (or up to 16 in Half-Rate HR mode) simultaneous calls with error correction and encryption!
• Decoupling subscriber identity from the handset — the SIM card: subscriber identity (IMSI per ITU-T E.212) and the secret 128-bit key Ki were moved out of the phone into a tamper-resistant cryptographic smart card — the SIM (Subscriber Identity Module). Users could swap phones in seconds, the network authenticated SIMs via A3/A8 challenge-response triplets and encrypted the air interface with the A5 stream cipher, and the MAP (Mobile Application Part) protocol over SS7 enabled seamless international roaming.
• Short Message Service (SMS): originally designed as a lightweight mechanism to carry short text notifications of up to 160 Latin characters (140 bytes) over idle radio signaling channels, SMS became the most widely used digital messaging service on Earth.
• Evolution to 2.5G (GPRS) and 2.75G (EDGE): early GSM carried data only via CSD ($9.6\text{ kbit/s}$), tying up a full voice timeslot. In the late 1990s, GPRS (General Packet Radio Service) introduced a second, parallel Packet Switched core domain (PS Core: SGSN and GGSN nodes, GTP tunneling protocol) delivering $80\text{–}171\text{ kbit/s}$, while EDGE (EGPRS) introduced 8PSK modulation (3 bits per symbol instead of 1 bit in GMSK) to boost speeds within the same $200\text{ kHz}$ channel to $236\text{–}384\text{ kbit/s}$ (and up to $473\text{ kbit/s}$ peak across 8 timeslots).

# Spectrum capacity calculation (1 MHz slice): analog 1G vs. digital 2G GSM
spectrum_capacity_comparison_1mhz:
  1G_amps_analog:
    carrier_bandwidth_khz: 30
    channels_per_carrier: 1
    total_voice_channels_in_1mhz: 33 # 1000 kHz / 30 kHz = 33 analog calls
  2G_gsm_digital:
    carrier_bandwidth_khz: 200
    carriers_in_1mhz: 5              # 1000 kHz / 200 kHz = 5 ARFCN carriers
    tdma_timeslots_per_carrier: 8
    total_channels_full_rate: 40     # 5 * 8 = 40 Full-Rate channels (FR/EFR/AMR)
    total_channels_half_rate: 80     # 5 * 16 = 80 Half-Rate channels (HR/AMR-HR)

3G (2001): UMTS/HSPA broadband access, mutual authentication, and Release 4 architecture

By the early 2000s, GSM's narrow $200\text{ kHz}$ carrier hit a physical ceiling for mobile web browsing and multimedia. In Release 99, 3GPP introduced the third-generation standard UMTS (Universal Mobile Telecommunications System):

• Wideband code-division access (WCDMA): instead of slicing spectrum into narrow $200\text{ kHz}$ channels and timeslots, all users in a 3G sector transmit simultaneously across a shared $5\text{ MHz}$ wideband carrier ($3.84\text{ Mcps}$ chip rate), separated mathematically by orthogonal OVSF (Orthogonal Variable Spreading Factor) codes. Because neighboring base stations (NodeB) operate on the exact same $5\text{ MHz}$ frequency, a handset at the cell edge can communicate with 2–3 towers simultaneously (Soft Handover, Make-before-Break).
• USIM AKA mutual authentication: in 2G GSM, the network authenticated the phone, but the phone never authenticated the base station (leaving 2G vulnerable to rogue base stations / IMSI-catchers). In 3G, the USIM application introduced UMTS AKA using 5-element security vectors (quintets), where the AUTN token lets the handset cryptographically verify that the base station belongs to the genuine home operator, while signaling messages are protected by a dedicated 128-bit integrity key IK.
• Preserving the dual-domain core (CS + PS) and adopting NGN in 3GPP Release 4: the new 3G radio network UTRAN (NodeB + RNC controller) connected simultaneously to both existing core domains — via Iu-CS to the voice MSC and via Iu-PS to the packet SGSN. In 3GPP Release 4 (R4), the monolithic MSC was decomposed along NGN principles into a control-plane MSC Server (MSS) and a media-plane MGW (using BICC / SIP-I and H.248).
• Acceleration to 3.5G HSPA and 3.75G HSPA+: in Releases 5–7, HSDPA / HSUPA / HSPA+ moved packet scheduling and fast HARQ retransmissions from the RNC directly into the NodeB, shortened the transmission time interval (TTI) to $2\text{ ms}$, and added 16QAM / 64QAM modulation and MIMO, accelerating mobile data from $384\text{ kbit/s}$ to $14.4 \rightarrow 21 \rightarrow 42\text{ Mbit/s}$ (and up to $84\text{ Mbit/s}$ with Dual-Carrier).

4G (2009): flat LTE / EPC architecture and the elimination of the CS domain (All-IP)

In 3GPP Release 8 (LTE — Long Term Evolution and the EPC — Evolved Packet Core), mobile architecture underwent its most radical simplification since GSM:

• OFDMA air interface and wide channels up to 20 MHz: WCDMA code division was replaced by orthogonal frequency-division multiplexing (OFDMA in downlink, SC-FDMA in uplink) with flexible channel bandwidths from $1.4$ to $20\text{ MHz}$ (and up to $100\text{ MHz}$ with Carrier Aggregation in LTE-Advanced), delivering $150\text{ Mbit/s}$ to $1\text{ Gbit/s}$ and radio latency under $10\text{ ms}$.
• Flat E-UTRAN radio network (no BSC/RNC controllers): 4G eliminated the intermediate base station controller altogether — all radio resource management moved directly into the eNodeB base station, which connects straight to the EPC core over the S1 interface.
• Complete removal of the Circuit-Switched (CS) domain: the 4G EPC core (MME, SGW, PGW, and HSS over the Diameter protocol) is All-IP Packet-Switched (PS) Only! LTE has no MSC switches and no $64\text{ kbit/s}$ voice circuits. Consequently, placing a phone call on 4G relies on one of two mechanisms:
  1. VoLTE (Voice over LTE): voice is carried as a prioritized RTP IP stream orchestrated by the IMS (IP Multimedia Subsystem) over SIP.
  2. CSFB (Circuit Switched Fallback): if the handset, roaming partner, or local cell lacks VoLTE, the 4G MME coordinates with the legacy 2G/3G MSC/VLR over the SGs interface and commands the phone to drop back to 2G GSM or 3G UMTS for the duration of the voice call!

5G (2019): 5G NR, cloud-native Service-Based Architecture (5GC SBA), and over-the-air identity encryption

The fifth generation (3GPP Release 15+: 5G NR — New Radio and 5GC — 5G Core) was engineered not just for smartphones, but for all three ITU IMT-2020 service pillars: Enhanced Mobile Broadband (eMBB — $10\text{–}20\text{ Gbit/s}$), Ultra-Reliable Low-Latency Communications around $1\text{ ms}$ for industry and vehicles (URLLC), and Massive Machine-Type Communications (mMTC — up to $1\text{ million}$ devices per $\text{km}^2$).

• Flexible 5G NR air interface: OFDMA with scalable subcarrier spacing ($\text{SCS} = 15, 30, 60, 120\text{ kHz}$), operating across both FR1 (Sub-6 GHz, channels up to $100\text{ MHz}$) and millimeter-wave FR2 (mmWave $24\text{–}40\text{ GHz}$, channels up to $400\text{ MHz}$) with Massive MIMO beamforming.
• Service-Based Architecture (SBA): in 5GC, legacy telecom boxes are replaced by cloud-native network functions (AMF, SMF, UPF, UDM, AUSF, NRF) communicating via HTTP/2 + JSON REST APIs, with full Control/User Plane Separation (CUPS) and end-to-end Network Slicing.
• Closing the final cleartext identity gap (SUPI → SUCI): in 2G, 3G, and even 4G LTE, during initial registration (before a temporary TMSI/GUTI is assigned), a phone had to transmit its permanent IMSI in cleartext over the radio link once. In 5G, the permanent SUPI is never sent in cleartext over the air — the USIM encrypts it with the home operator's public key (ECIES) into a one-time SUCI (Subscription Concealed Identifier).

# Engineering audit of mobile generations (1G -> 5G)
mobile_generations_audit:
  1G_analog:
    era: "1980s (NMT-450/900, AMPS, TACS)"
    air_interface: "FDMA (Analog FM, 25/30 kHz carrier)"
    core_domain: "CS Only (analog circuit switching)"
    security: "None (no SIM card, unencrypted radio)"
  2G_gsm:
    era: "1991+ (3GPP TS 45/23/24/29 series: GSM, GPRS, EDGE)"
    air_interface: "FDMA + TDMA (200 kHz carrier = 8 timeslots), GMSK / 8PSK"
    core_domain: "CS (MSC/VLR, GMSC, HLR, MAP/BSSAP) + 2.5G PS (SGSN, GGSN, GTP)"
    security: "SIM card (IMSI, Ki), unilateral A3/A8 authentication (triplets), A5 cipher"
  3G_umts:
    era: "2001+ (3GPP Rel-99..Rel-10: UMTS, HSDPA, HSUPA, HSPA+)"
    air_interface: "WCDMA (5 MHz carrier, 3.84 Mcps, OVSF codes, Soft Handover)"
    core_domain: "Dual-domain core: CS (R4 MSC Server + MGW, RANAP) + PS (SGSN + GGSN)"
    security: "USIM, mutual UMTS AKA authentication (quintets: RAND, XRES, CK, IK, AUTN)"
  4G_lte:
    era: "2009+ (3GPP Rel-8+: LTE, LTE-Advanced)"
    air_interface: "OFDMA (DL) / SC-FDMA (UL), 1.4..20 MHz (+CA), flat eNodeB RAN"
    core_domain: "All-IP PS Only (EPC: MME, SGW, PGW, HSS/Diameter); voice = VoLTE (IMS) or CSFB to 2G/3G"
    security: "USIM/ISIM, EPS-AKA, Kasme key hierarchy"
  5G_nr:
    era: "2019+ (3GPP Rel-15+: 5G NR, 5GC)"
    air_interface: "Flexible SCS OFDMA (Sub-6 GHz up to 100 MHz, mmWave up to 400 MHz), Massive MIMO"
    core_domain: "Cloud-native 5GC (SBA over HTTP/2 + JSON: AMF, SMF, UPF, UDM), Network Slicing, voice = VoNR"
    security: "5G-AKA, over-the-air permanent identity encryption (SUPI -> SUCI)"

Comparative matrix of generations 1G → 5G

The table below summarizes the key architectural parameters across all five generations:

Evolution of the core network: how CS and PS domains shifted

To understand the architecture of the gsm course, let us look at how the Core Network evolved across three distinct stages:

1. Stage 1 — Pure Circuit-Switched Core (CS Only: 1G and early 1990s 2G GSM):
   * The entire core mirrors a PSTN/ISDN telephone network over SS7.
   * The BSS (BTS + BSC) connects over the A interface to the MSC/VLR mobile switch, which queries the HLR/AuC over MAP and switches $64\text{ kbit/s}$ voice circuits to external networks via ISUP.
   * Even if a subscriber wants to send data (fax or CSD $9.6\text{ kbit/s}$ dial-up), an entire voice timeslot is locked for the duration of the session!
2. Stage 2 — Dual-Domain Core (Dual-Domain CS + PS: 2.5G GPRS/EDGE and 3G UMTS/HSPA — the focus of this course!):
   * Starting with GPRS and throughout 3G UMTS, the operator core splits into two parallel domains sharing a single master subscriber database (HLR / AuC):
   * Circuit-Switched Domain (CS Domain): MSC/VLR and GMSC (or in 3GPP Release 4, the split MSC Server + MGW pair). The CS domain handles all voice calls, USSD menus (*100#), classic SMS, and real-time CAMEL (CAP) prepaid charging.
   * Packet-Switched Domain (PS Domain): the serving SGSN and gateway GGSN linked by GTP (GPRS Tunnelling Protocol) IP tunnels. The PS domain carries all mobile Internet traffic (billed per megabyte rather than per minute!).
   * Both radio networks — 2G GERAN (BTS + BSC) and 3G UTRAN (NodeB + RNC) — connect simultaneously to the CS domain (A and Iu-CS interfaces) and to the PS domain (Gb and Iu-PS interfaces).
3. Stage 3 — All-IP Packet Core (All-IP PS Only: 4G LTE EPC and 5G Core):
   * In 4G and 5G, the CS domain is eliminated from the core — leaving only packet gateways (SGW/PGW in 4G, UPF in 5G) and mobility controllers (MME in 4G, AMF/SMF in 5G).
   * Voice becomes an IP application over IMS (VoLTE / VoNR), while for legacy handsets, international roamers, and M2M devices, the 4G MME links over the SGs interface directly to the 2G/3G CS domain (MSC/VLR)!

💡 Architectural Verdict (answering the CFO from our real-world task): An operator cannot blindly power down its 2G/3G core (MSC/VLR, HLR/HSS, STP, SMSC, MAP/CAP) just because most gigabytes flow over 4G/5G. As long as hundreds of thousands of industrial 2G/3G M2M modems are in the field, as long as smartphone voice calls (especially in international roaming) rely on CSFB fallback over SGs to the MSC/VLR, and as long as global SMS, USSD, and roaming signaling run on MAP over SIGTRAN, the 2G/3G core remains the structural foundation of the carrier network. Moreover, the core concepts of 4G and 5G (IMSI/TMSI/LAI identities, mutual AKA authentication, GTP-U tunnels, and control/user plane separation) are direct descendants of 2G GSM and 3G UMTS!

# Pre-refarming dependency audit for 2G/3G spectrum (answering the CFO)
refarming_dependency_check:
  m2m_iot_fleet:
    active_devices: 450000
    supported_rat: "2G GSM / GPRS only (smart meters, POS terminals, eCall)"
    impact_if_2g_shutdown: "Complete loss of connectivity for 450,000 industrial units"
  smartphone_voice_fallback:
    csfb_share_percent: 35
    interface_to_legacy_core: "SGs (between 4G MME and 2G/3G MSC/VLR)"
    roaming_voice_dependency: "Without VoLTE Roaming, all roamer voice calls fall back via CSFB to 2G/3G"
  signaling_and_messaging:
    global_roaming_and_sms: "MAP and CAP over SIGTRAN (M3UA/SCTP), HLR/HSS, SMSC, USSD"
    recommended_strategy: "Phased refarming of 3G 2100 MHz to 4G/5G while retaining a 2G GSM-900 umbrella and CS/MAP core"

Self-check questions

1. Along which four fundamental engineering axes (beyond peak data rate) do mobile generations differ from 1G to 5G?
2. Why was it impossible to prevent eavesdropping or support seamless international roaming in 1G analog networks (NMT, AMPS), and which two innovations in 2G GSM solved both problems?
3. What is the fundamental difference between how the radio channel is shared in 2G GSM (FDMA + TDMA in a $200\text{ kHz}$ carrier) versus 3G UMTS (WCDMA in a $5\text{ MHz}$ carrier)?
4. Why was the operator core split into two parallel domains (CS and PS) in 2.5G GPRS and 3G UMTS, which nodes belong to each domain, and which database is shared between them?
5. Why can't a smartphone attached to 4G LTE place a standard voice call using the EPC core alone when VoLTE is unavailable (e.g., while roaming), and how does CSFB solve this?

Key takeaways

• 1G (1980s, NMT/AMPS): analog FM voice over FDMA ($25\text{–}30\text{ kHz}$), no SIM cards, no radio encryption, and no data, but introduced cellular frequency reuse and automatic handover.
• 2G (1991+, GSM / GPRS / EDGE): digital speech over hybrid FDMA + TDMA ($8\text{ timeslots}$ per $200\text{ kHz}$ carrier), introduced the SIM card (IMSI, secret key Ki), A3/A8 authentication, A5 ciphering, SMS, global MAP roaming, and spawned the parallel PS Core (SGSN + GGSN, GTP protocol) in 2.5G GPRS / 2.75G EDGE.
• 3G (2001+, UMTS / HSPA+): wideband code-division WCDMA air interface ($5\text{ MHz}$ carrier) with Soft Handover, UTRAN (NodeB + RNC), mutual USIM AKA (AUTN quintets) authentication, and Release 4 decomposition into MSC Server + MGW.
• 4G (2009+, LTE / EPC) and 5G (2019+, 5G NR / 5GC): OFDMA air interface, flat controller-less RAN, and an All-IP packet core (EPC and cloud-native 5GC SBA) with no CS domain (voice runs over IMS VoLTE / VoNR or falls back to 2G/3G via CSFB).