GSM and GPRS Protocols: Architecture, Authentication, Handover

Posted on Jan 12, 2026 in Computer Engineering

GSM Protocol Architecture

The GSM Protocol Architecture is a three-layer model designed to handle communication between the Mobile Station (MS) and the Core Network. These layers roughly correspond to the bottom three layers of the OSI model: Physical, Data Link, and Network.

Three-Layer Architecture

Layer 1 (Physical Layer)

This layer handles the actual radio transmission. It manages functions like GMSK modulation, channel coding, and the creation of the 0.577 ms bursts described earlier. It operates over the Um interface (the air interface).

Layer 2 (Data Link Layer)

Its job is to ensure a reliable connection between the mobile and the base station. It uses a specific protocol called LAPDm (Link Access Protocol on the Dm channel), which is a modified version of ISDN’s LAPD. It handles error detection and flow control.

Layer 3 (Network Layer)

This is the most complex layer, divided into three sub-layers that manage high-level tasks:

RR (Radio Resource Management): Manages the setup, maintenance, and release of radio channels. It also handles handovers when you move between cells.
MM (Mobility Management): Handles location updating, registration, and authentication (security). It ensures the network knows where you are to route calls to you.
CM (Connection Management): Manages end-to-end calls. It includes Call Control (CC) for making calls, SMS for texting, and Supplementary Services (SS) like call forwarding.

GSM Authentication Process

In GSM, authentication ensures that only valid subscribers can access the network. This is done using a challenge-response mechanism involving three algorithms: A3 (for authentication), A8 (for generating the ciphering key), and A5 (for actual data encryption).

Block Diagram of Authentication Process

Step-by-Step Process

Generation of Triplets: When a Mobile Station (MS) attempts to connect, the Authentication Center (AuC) generates a RAND (random number). It uses this RAND and the subscriber’s secret key Ki as inputs for the A3 and A8 algorithms to produce an SRES (Signed Response) and a Kc (cipher key). These three values (RAND, SRES, Kc) are called a triplet.
The Challenge: The network sends only the RAND to the mobile phone.

The secret key Ki never leaves the SIM card or the AuC, making the system secure.

The Mobile Calculation: The SIM card receives the RAND and uses its own stored Ki and the A3 algorithm to calculate its own version of the SRES.
The Response: The MS sends its calculated SRES back to the network.
Verification: The MSC/VLR compares the SRES from the mobile with the SRES it received from the AuC. If they match, the user is authenticated.
Ciphering: Simultaneously, both the MS and the network use the A8 algorithm to generate the Kc. From this point forward, all communication is encrypted using the A5 algorithm and this Kc key.

Key Components

Ki: Secret 128-bit key stored in the SIM and AuC.
RAND: 128-bit random challenge sent by the network.
SRES: 32-bit response used to verify identity.
Kc: 64-bit session key used for voice/data encryption.

GSM authentication process explained. This video provides a visual walkthrough of how the RAND, SRES, and Kc are generated and exchanged between the mobile device and the network.

Um Interface (Air Interface)

The Um interface, commonly known as the Air Interface or Radio Interface, is the wireless link between the Mobile Station (MS) and the Base Transceiver Station (BTS). It is the most critical part of the GSM system because it determines how radio frequency (RF) spectrum is used to carry voice and data.

Key Characteristics

Access Method: It uses a combination of FDMA (Frequency Division Multiple Access) and TDMA (Time Division Multiple Access).
Frequency Bands: Common bands include GSM 900 (Uplink: 890–915 MHz; Downlink: 935–960 MHz) and GSM 1800.
Modulation: It uses GMSK (Gaussian Minimum Shift Keying), which is a power-efficient digital modulation technique.
Channel Spacing: Each RF carrier is 200 kHz wide.

Channel Structure

The Um interface divides the radio resource into two types of channels: Physical and Logical.

1. Physical Channels

A physical channel is defined by its frequency (ARFCN) and its Time Slot (TS). Each frequency carrier is divided into 8 time slots. One time slot in a TDMA frame constitutes one physical channel.

2. Logical Channels

These are mapped onto the physical channels to carry specific types of information.

They are divided into:

Traffic Channels (TCH): Carry actual digitized speech or user data.
Control Channels (CCH): Used for signaling and system management.
Broadcast Channels (BCH): Used by the BTS to broadcast cell ID and frequency information.
Common Control Channels (CCCH): Used for paging and requesting access (e.g., RACH, PCH).
Dedicated Control Channels (DCCH): Used for specific tasks like authentication or SMS during a call (e.g., SDCCH, SACCH).

Layered Protocol Stack at Um

The Um interface operates across the bottom three layers:

Layer 1 (Physical): Manages the radio tasks like channel coding, interleaving, and burst formation.
Layer 2 (Data Link): Uses LAPDm to ensure reliable delivery of signaling messages.
Layer 3 (Network): Handles higher-level functions like Radio Resource (RR) management, which manages the connection over the Um interface.

GSM Network Architecture

The GSM (Global System for Mobile Communications) architecture is a hierarchical network divided into four main subsystems. Each subsystem has specific responsibilities, from handling radio signals to managing user data and network maintenance.

GSM Architecture Block Diagram

Mobile Station (MS)
The MS is the user-level equipment. It consists of two parts:
- Mobile Equipment (ME): The physical handset or terminal (identified by the IMEI number).
- Subscriber Identity Module (SIM): A smart card containing the user’s identity (IMSI), authentication keys, and phonebook.
Base Station Subsystem (BSS)
The BSS manages the radio connection between the mobile and the core network.
- Base Transceiver Station (BTS): Contains the radio equipment (transceivers and antennas) that creates a “cell.” It handles the Um interface and performs encryption/decryption of radio signals.
- Base Station Controller (BSC): Controls multiple BTSs. It handles radio resource management, frequency allocation, and handovers between BTSs in its group.
Network and Switching Subsystem (NSS)
This is the heart of the network that manages calls and mobility.
- Mobile Switching Center (MSC): The main switch that routes calls and coordinates between users. It also links the GSM network to the outside world (PSTN/ISDN).
- Home Location Register (HLR): A central database containing permanent information about every subscriber (e.g., service profile, current location).
- Visitor Location Register (VLR): A temporary database that stores data for subscribers currently roaming in a specific MSC’s area.
- Authentication Center (AuC): Stores the algorithms and secret keys used to verify a user’s identity.
- Equipment Identity Register (EIR): A database of IMEI numbers used to track stolen or unauthorized handsets.
Operation Support Subsystem (OSS)
The OSS is the management entity. It allows network operators to monitor traffic, perform maintenance, and manage billing/charging for the entire system through the Operation and Maintenance Center (OMC).

GPRS Network and Components

In GPRS (General Packet Radio Service), the network is upgraded with two primary nodes: the SGSN and the GGSN. These nodes work together to handle packet-switched data (internet/MMS), whereas the traditional MSC handles circuit-switched voice.

GPRS Network Block Diagram

1. Serving GPRS Support Node (SGSN)

The SGSN is the local node that serves the Mobile Station (MS) within its specific geographical area. You can think of it as the packet-switched equivalent of the MSC.

Key Functionalities:

Mobility Management: It tracks the location of the mobile device at the Routing Area level. When you move from one cell to another, the SGSN handles the update.
Packet Routing & Delivery: It handles the delivery of data packets to and from the mobile stations in its service area.
Logical Link Management: It establishes the logical link with the mobile phone, handling tasks like ciphering (security) and data compression to save bandwidth.
Authentication: It communicates with the HLR to verify the user’s credentials before allowing data access.
Charging: It collects billing information based on the use of the radio interface.

2. Gateway GPRS Support Node (GGSN)

The GGSN acts as the interface (the gateway) between the internal GPRS network and external packet data networks, such as the Internet or a corporate intranet.

Key Functionalities:

Anchor Point: To an external network (like the Internet), the GGSN looks like a standard sub-network router. It “hides” the mobile’s movement; even if you move between different SGSNs, your IP connection stays anchored at the GGSN.
IP Address Allocation: It is responsible for assigning IP addresses (either static or dynamic) to the mobile station so it can communicate on the Internet.
Protocol Conversion: It converts GPRS packets coming from the SGSN into the standard IP format required by the destination network.
PDP Context Activation: It maintains the PDP Context, which is the logical session that allows data to flow.
Screening/Firewall: It provides basic security by filtering incoming packets to protect the internal core network.

GPRS Definition and Features

GPRS, often called 2.5G, is a packet-oriented mobile data service upgrade for GSM networks. Unlike standard GSM, which uses circuit switching (dedicating a whole line for one call), GPRS uses packet switching, allowing multiple users to share the same radio resources efficiently.

Key Features of GPRS Data Service

Always-On Connectivity: Users do not need to “dial-up” to connect to the Internet. The connection is instantaneous and stays active as long as the device is within range.
High Data Rates: While standard GSM is limited to 9.6 kbps, GPRS theoretically supports speeds up to 171.2 kbps by using multiple time slots (up to 8) simultaneously.
Volume-Based Billing: Instead of being charged for the duration of the connection (minutes), users are typically billed for the amount of data (kilobytes/megabytes) transferred.
Resource Sharing: Radio channels are only occupied when data is actually being sent or received, making it far more efficient for “bursty” traffic like web browsing or email.

Network Enhancements

To support GPRS, two main nodes are added to the existing GSM architecture: SGSN (Serving GPRS Support Node) and GGSN (Gateway GPRS Support Node).

Applications

Web Browsing: Accessing full websites on mobile devices.
MMS (Multimedia Messaging Service): Sending photos and videos.
Push-to-Talk: Instant voice communication over data.
IoT/Telematics: Used for fleet tracking and remote sensors.

GSM Burst Structure

In GSM, a burst is the basic unit of transmission that fits into a single time slot of a TDMA frame. Each burst lasts for 0.577 ms and consists of 156.25 bits. There are five main types: Normal Burst (for traffic/data), Frequency Correction Burst (to tune frequency), Synchronization Burst (to align time), Access Burst (to request network entry), and Dummy Burst (used during idle slots).

Diagram of a Normal Burst

A Normal Burst is the most common and is used to carry user voice or data.

Components Explained

Tail Bits (3 bits): These bits (always set to 0) allow the transmitter’s power to “ramp up” and “ramp down” at the beginning and end of the burst.
Data Bits (2 x 57 bits): This is the payload containing the actual digitized voice or user data.
Stealing Flag (2 x 1 bit): These bits indicate whether the data bits are being used for user traffic or for urgent signaling (like handovers).
Training Sequence (26 bits): A fixed, known pattern used by the receiver’s equalizer to correct for distortions (multipath fading) caused by the environment.
Guard Period (8.25 bits): This is a period of silence at the end of the burst that acts as a buffer to prevent bursts from different mobile phones from overlapping.

GPRS Protocol Stack

The GPRS protocol stack is designed to provide a bridge between the mobile user and the Internet. It is divided into two planes: the Control Plane (for signaling) and the User Plane (for transferring actual data).

GPRS Protocol Stack (User Plane)

Explanation of Layers

1. MS to SGSN (The Access Side)

SNDCP (Sub-Network Dependent Convergence Protocol): Its primary job is to compress and segment data packets (like IP) into a format suitable for the network. It handles the mapping of different network layer protocols to the GPRS transmission level.

LLC (Logical Link Control): Provides a highly reliable logical link between the MS and the SGSN. It handles error detection, flow control, and encryption (ciphering).

RLC/MAC (Radio Link Control / Medium Access Control):

RLC breaks data into smaller blocks for transmission over the air and handles retransmissions if blocks are lost.
MAC manages the shared radio resource, deciding which user gets to transmit in which time slot.

2. SGSN to GGSN (The Core Side)

GTP (GPRS Tunneling Protocol): This protocol tunnels user data between the SGSN and the GGSN, ensuring that even as the user moves, their data session remains intact.

UDP/TCP & IP: These are the standard Internet protocols used to route the tunneled GTP packets across the backbone network.

3. Physical Layer

Um Interface: The radio link between the Mobile Station and the Base Station (BTS).
Gb Interface: Connects the BSS to the SGSN (typically using Frame Relay or IP).
Gn Interface: Connects the SGSN to the GGSN within the same network.

How Data Flows

When you send an email:

An IP packet is created.
SNDCP compresses it.
LLC encrypts it.
RLC/MAC sends it over the air (Um).
SGSN receives it, wraps it in a GTP tunnel, and sends it to the GGSN.
GGSN removes the GTP wrapper and sends the original IP packet to the Internet.

Call Processing in GSM

In GSM, call processing is divided into Mobile Originated (MO) calls (when you make a call) and Mobile Terminated (MT) calls (when you receive a call). Both follow a strict signaling sequence between the Mobile Station (MS) and the Core Network.

1. Mobile Originated (MO) Call Flow

When a user dials a number and presses the “call” button, the following steps occur:

Channel Request: The MS sends a “Channel Request” on the RACH (Random Access Channel) to the BSS.
Channel Assignment: The BSS assigns a dedicated signaling channel (SDCCH) via the AGCH (Access Grant Channel).
Service Request: The MS sends a “CM Service Request” to the MSC, including its identity (TMSI/IMSI).
Authentication & Ciphering: The network authenticates the user (A3/A8 algorithms) and enables encryption (A5).
Call Setup: The MS sends the dialed digits (B-number) in a “Setup” message.
Traffic Channel Assignment: The MSC instructs the BSS to allocate a voice channel (TCH). The MS tunes to this frequency/slot.
Alerting & Connect: The network routes the call to the destination. Once the destination rings, “Alerting” is sent to the MS. When the destination answers, a “Connect” message is sent, and the voice path is established.

2. Mobile Terminated (MT) Call Flow

When someone calls a mobile user, the network must first locate the device:

Routing Interrogation: The call reaches the GMSC (Gateway MSC). The GMSC queries the HLR to find out which MSC/VLR the subscriber is currently visiting.
Roaming Number Request: The HLR asks the serving VLR for an MSRN (Mobile Station Roaming Number) and passes it back to the GMSC.
Paging: The GMSC routes the call to the serving MSC. This MSC sends a “Paging” message to all BSSs in the user’s current Location Area (LA).
Paging Response: The MS detects the page and responds via the RACH.
Setup & Assignment: Similar to the MO call, the network performs authentication, ciphering, and assigns a TCH.
Ringing: The MS sends an “Alerting” message back to the network, and the mobile phone begins to ring. When the user picks up, the “Connect” signal completes the circuit.

Handover Concepts and Types

Handover (or handoff) is the process of transferring an ongoing call or data session from one channel, base station, or network to another without interrupting the connection. It is triggered when a user moves between cells, to balance network traffic, or to switch to a higher-quality frequency.

1. Classification by Connection Policy

Hard Handover: Known as “Break-before-make.” The connection to the current base station is terminated before the new connection is established. This is common in FDMA and TDMA systems like GSM.
Soft Handover: Known as “Make-before-break.” The mobile device connects to the new base station while still maintaining its link to the old one. It only drops the original link once the new one is stable. This is used in CDMA systems.

2. Classification by Network Hierarchy (GSM)

In exams, it is often required to list these based on the internal GSM components involved:

Intra-Cell Handover: Switching between two channels (frequencies) within the same cell. This is usually done to avoid local interference.
Inter-Cell (Intra-BSC) Handover: Moving from one cell to another where both are controlled by the same BSC.
Inter-BSC (Intra-MSC) Handover: Moving from a cell controlled by one BSC to a cell controlled by a different BSC, both under the same MSC.
Inter-MSC Handover: Moving between cells controlled by different MSCs. This is the most complex type as it involves high-level network coordination.

3. Other Specific Types

Horizontal Handover: Handover between base stations using the same technology (e.g., 4G to 4G).
Vertical Handover: Handover between different technologies (e.g., switching from 4G/LTE to Wi-Fi).
Mobile Assisted Handover (MAHO): The mobile station measures the signal strength of neighboring cells and reports it to the network, which then makes the handover decision. This is standard in GSM.

The primary goal of any handover is to ensure QoS (Quality of Service) and prevent call drops as users move throughout the network.

Cell Dragging and Umbrella Cell Concepts

Cell Dragging

Cell Dragging occurs in microcellular environments (like narrow streets or “urban canyons”) where the signal from a Base Station (BS) is reflected and channeled along the street, allowing it to remain strong far beyond the actual cell boundary.

The Problem: Because the signal remains strong for a long distance, the mobile station (MS) does not request a handoff to a closer cell. However, once the user turns a corner, the line-of-sight signal is suddenly blocked, causing the signal strength to drop rapidly (the “corner effect”).

Result: This leads to a sudden call drop because the system doesn’t have enough time to process a handoff to a new base station.

Umbrella Cell Concept

The Umbrella Cell is a technique used to solve the problem of frequent handoffs for fast-moving users (like those in a car on a highway) passing through many small microcells.

The Structure: A large macrocell (the umbrella) is layered over several smaller microcells.

Functionality:

Slow-moving users (pedestrians) are assigned to the microcells to preserve network capacity.
Fast-moving users (vehicles) are identified by the network and assigned directly to the umbrella cell.

The Benefit: By staying in the large umbrella cell, a high-speed user doesn’t have to perform a handoff every few seconds as they pass through small cells. This significantly reduces the signaling load on the network and prevents call drops due to handoff failures.

Summary for Exam:

Cell Dragging: An error caused by signal reflection that leads to dropped calls.
Umbrella Cell: A design solution that uses a large cell to cover multiple small cells for high-speed users.

Handoff Strategies and Decision Criteria

Handoff strategies are the procedures used by a network to determine when and how to transfer a call from one base station to another. The goal is to perform the transfer so quickly and smoothly that the user does not notice any interruption.

1. Handoff Initiation

The process begins when the received power (Pr) of the current base station drops below a certain level. To avoid unnecessary handoffs (the “ping-pong” effect), two thresholds are used:

Handoff Threshold: The minimum signal level required to maintain a high-quality call.
Hysteresis (Δ): A margin added to the handoff decision. The handoff only occurs if the new base station’s signal is stronger than the current one by a specific amount (e.g., 5 dB).

2. Types of Handoff Strategies

Network-Controlled Handoff (NCHO): The network (MSC) monitors signal strengths and manages the handoff. This was common in 1G systems but is slow for modern networks.
Mobile-Assisted Handoff (MAHO): The mobile station constantly measures the signal of surrounding base stations and sends reports to the network. The network then makes the final decision. This is the standard in GSM.
Soft Handoff: Used in CDMA, where a mobile connects to the new station before breaking the old one (“make-before-break”).
Hard Handoff: Used in GSM, where the connection is broken before the new one is made (“break-before-make”).

3. Prioritizing Handoffs

Since dropping a call is more annoying to a user than failing to start a new one, networks use these strategies:

Guard Channels: A fraction of the total available channels in a cell are reserved exclusively for handoff requests, even if it means blocking new incoming call attempts.
Queuing: If no channel is available in the new cell, the handoff request is put in a queue. Since there is a handoff zone where the old signal is still usable, the network has a few seconds to wait for a channel to become free.

GSM Handover Process

In GSM, the handover mechanism is a network-controlled process assisted by the Mobile Station (MS). It ensures that a call remains connected as the user moves between different radio coverage areas.

The Handover Process (Four Phases)

Measurement Phase: The MS continuously monitors the signal strength and quality of the serving cell and up to six neighboring cells. It sends these reports to the Base Station Controller (BSC) once every 480 ms.
Decision Phase: The BSC evaluates the measurement reports. A handover is triggered if the serving cell signal drops below a threshold or if a neighboring cell provides significantly better quality.
Execution Phase: The network allocates a new channel in the target cell. The MS is then commanded to tune to the new frequency and time slot.
Completion Phase: Once the MS successfully connects to the new channel, the old radio resources are released for other users.

Handover Scenarios in GSM Architecture

Intra-Cell Handover: The MS stays in the same cell but switches to a different frequency or time slot to avoid interference.
Inter-Cell (Intra-BSC) Handover: The MS moves between two cells, both managed by the same BSC. The BSC handles the entire process without involving the MSC.
Inter-BSC (Intra-MSC) Handover: The MS moves to a cell managed by a different BSC. Since the BSCs cannot talk to each other directly, the MSC must coordinate the handover.
Inter-MSC Handover: The MS moves to an area managed by a completely different MSC. This requires coordination between the Anchor MSC (where the call started) and the Target MSC.

Decision Criteria (MAHO)

GSM uses Mobile-Assisted Handover (MAHO). The decision is usually based on:

RSS (Received Signal Strength): If the signal falls below a minimum level (e.g., -90 dBm).
Quality (Bit Error Rate): If interference makes the voice unclear, even if the signal is strong.
Distance: Calculated using Timing Advance (TA). If the MS is too far from the BTS, a handover is forced.

Data Transfer Between Mobile and Fixed Nodes

In a mobile network (like GSM/GPRS or Mobile IP), data transfer between a Mobile Node (MN) and a Fixed Node (FN) involves several routing and encapsulation steps to ensure the data reaches the mobile device regardless of its location.

1. Data Transfer: Mobile Node to Fixed Node

When a mobile device sends data to a fixed computer (e.g., a server), the process is relatively straightforward because the destination address is static.

The MN sends data packets to its current serving station (BTS/BSC or Foreign Agent).
The serving node (SGSN in GPRS) forwards the packet to the Gateway node (GGSN or Home Agent).
The Gateway node acts as a standard router and pushes the data onto the external network (Internet).
The data travels through standard IP routing to reach the Fixed Node’s static IP address.

2. Data Transfer: Fixed Node to Mobile Node

This is more complex because the network must “find” the mobile node since its location changes. This typically uses tunneling.

Interception: The FN sends a packet to the MN’s Home Address. This packet is intercepted by the Home Agent (HA) or GGSN in the home network.
Encapsulation/Tunneling: The Home Agent looks up the MN’s current location (Care-of Address). It wraps the original packet inside a new packet—a process called encapsulation.
Delivery: This tunneled packet is sent to the Foreign Agent (FA) or SGSN currently serving the mobile node.
Decapsulation: The serving node removes the outer header (decapsulation) and delivers the original data packet to the MN.

Mobile IP: Agent Advertisement and Registration

In a Mobile IP network, Agent Advertisement and Discovery Registration are the processes that allow a Mobile Node (MN) to determine its location and notify its Home Network of its current Care-of Address (CoA).

1. Agent Advertisement (Discovery)

Agent Advertisement is the first step where Home Agents (HA) and Foreign Agents (FA) announce their presence to mobile nodes.

Process: Agents periodically broadcast ICMP Router Advertisement messages. These messages contain a special extension that includes the agent’s IP address and the services it offers (e.g., encapsulation methods).

Agent Solicitation: If a Mobile Node doesn’t want to wait for a periodic broadcast, it can send an “Agent Solicitation” message to the network, forcing any available agent to reply immediately with an advertisement.

The Goal: By receiving these messages, the MN determines if it is on its Home Network (it can act normally) or a Foreign Network (it must obtain a CoA).

2. Registration

Once a Mobile Node moves to a foreign network and obtains a Care-of Address (CoA), it must register this new location with its Home Agent so that data can be tunneled to it.

Registration Request: The MN sends a request to the Foreign Agent (FA) containing its Home Address, its Home Agent’s address, and the newly acquired CoA.
Forwarding: The FA receives the request and forwards it to the MN’s Home Agent (HA) in the home network.
Verification: The Home Agent checks the credentials, updates its routing table (associating the MN’s Home Address with the CoA), and creates a mobility binding.
Registration Reply: The HA sends a reply back to the FA, which then informs the MN that the registration was successful.

VoLGA Architecture

VoLGA (Voice over LTE via Generic Access) is an architecture designed as an interim solution to provide voice and SMS services over LTE networks by leveraging existing GSM/UMTS core infrastructure. It allows operators to deliver traditional circuit-switched services over the packet-switched LTE access network without requiring a full upgrade to IMS (IP Multimedia Subsystem).

Key Components of VoLGA Architecture

VES (VoLGA Access Network Controller / VANC): This is the core element of the architecture. It acts as a bridge between the LTE IP-based network and the traditional GSM/UMTS core. To the MSC, the VANC looks like a standard Base Station Controller (BSC).
LTE Access Network (eNodeB): The standard 4G radio stations that carry the IP packets.
Mobile Station (MS/UE): The handset must support the VoLGA protocol stack to encapsulate voice signaling into IP packets.

How it Works

The voice signal is digitized and encapsulated into IP packets at the mobile device.
These packets are sent over the LTE (E-UTRAN) air interface.
The VES (VANC) receives these packets and translates them back into standard GSM/UMTS signaling formats.
The VANC passes the signal to the MSC, which handles the call exactly like a normal cellular voice call.

Advantages

No IMS Required: Operators can offer 4G voice without the high cost and complexity of deploying a full IMS core (VoLTE).
Legacy Integration: It utilizes existing MSC, HLR, and VLR hardware, extending the life of current investments.
Fast Time-to-Market: It provides a quicker way to launch voice services on new LTE networks.

HSPA (High-Speed Packet Access)

HSPA is a collection of two mobile telephony protocols, HSDPA and HSUPA, that extend and improve the performance of existing 3G UMTS protocols. Often referred to as 3.5G, HSPA provides higher data transfer rates and capacity by using improved modulation techniques.

The Two Components of HSPA

1. HSDPA (High-Speed Downlink Packet Access)

Focuses on the download speed (from network to mobile). It uses techniques like Adaptive Modulation and Coding (AMC) and fast packet scheduling to achieve theoretical speeds of up to 14.4 Mbps.

2. HSUPA (High-Speed Uplink Packet Access)

Focuses on the upload speed (from mobile to network). It improves the uplink for tasks like sending emails with large attachments or video conferencing, reaching speeds up to 5.76 Mbps.

Key Features and Improvements

Shared Channel Transmission: Unlike basic 3G, where channels are dedicated to one user, HSPA allows multiple users to share the same high-speed channel dynamically.
Shorter Transmission Time Interval (TTI): HSPA reduces the TTI to 2 ms (from 10 ms in 3G). This significantly reduces latency and allows the network to react much faster to changing radio conditions.
Fast Retransmission (HARQ): HSPA uses Hybrid Automatic Repeat Request. If a data packet is corrupted during transmission, the receiver quickly requests a retransmission at the physical layer, saving time.
Adaptive Modulation: It switches between QPSK and 16-QAM modulation based on signal quality. If you are close to the tower, it uses 16-QAM for maximum speed; if you are far away, it switches to the more robust QPSK.