Mobile Network Architecture and Evolution

Introduction

Mobile communication systems have evolved from circuit-switched voice networks into highly distributed, software-controlled platforms supporting voice, broadband data, industrial automation, connected vehicles, and massive machine-type communication. Each generation introduced changes in the radio interface, transport network, core architecture, service model, security mechanisms, and operational philosophy.

The central architectural question is how a mobile network connects a user device to a service while maintaining identity, mobility, authentication, quality of service, and regulatory control. Although radio technology receives much attention, reliable mobile service depends equally on the core network, subscriber databases, signaling procedures, transport infrastructure, and operations systems.

This chapter traces the architecture of GSM, UMTS, LTE, and 5G. It explains radio access networks, core networks, subscriber management, signaling, bearer establishment, roaming, and network virtualization. The emphasis is on architectural continuity as well as technological change.

Learning Objectives

After studying this chapter, a student should be able to:

• identify the principal entities in GSM, UMTS, LTE, and 5G architectures;
• distinguish radio access, transport, and core-network functions;
• explain subscriber identity, authentication, location management, and mobility;
• describe signaling and bearer establishment for voice and data services;
• compare circuit-switched, packet-switched, EPC, and 5G Core models;
• explain home-network and visited-network roles in roaming;
• analyze virtualization, software-defined networking, network functions virtualization, and network slicing;
• evaluate practical, security, regulatory, and operational trade-offs.

1. Architectural Foundations

A mobile network can be viewed as four interacting domains:

1. User equipment (UE): the handset, modem, sensor, vehicle terminal, or industrial device.
2. Radio access network (RAN): provides the wireless connection between the UE and the operator network.
3. Transport network: carries traffic and signaling between radio sites, aggregation points, and core sites.
4. Core network: performs authentication, mobility management, session control, policy enforcement, interconnection, and access to external networks.

Two planes are commonly distinguished:

• The control plane transports signaling used for registration, authentication, mobility, session establishment, and policy control.
• The user plane transports application data, voice packets, video, and other payloads.

A third useful distinction is between access stratum (AS) and non-access stratum (NAS) signaling. AS signaling operates between the UE and the RAN, managing radio resources. NAS signaling operates between the UE and core control functions, although it is carried through the RAN.

Mobile networks also maintain several forms of identity. The SIM or USIM contains a permanent subscriber identity, normally represented by the IMSI, while the device may be identified by an IMEI. To reduce exposure of permanent identities, networks use temporary identifiers such as TMSI in GSM/UMTS and GUTI or 5G-GUTI in newer systems. A subscriber identity is not equivalent to a telephone number: the MSISDN identifies a service subscription, whereas the IMSI identifies the subscription for mobility and authentication purposes.

2. GSM: The First Widespread Digital Cellular Architecture

GSM was designed primarily for digital circuit-switched voice, short message service, and limited data. Its architecture separated the radio subsystem from switching and subscriber-management functions.

2.1 GSM Components

The principal components are:

• Mobile station (MS): the terminal and SIM.
• Base transceiver station (BTS): provides radio transmission within a cell.
• Base station controller (BSC): controls several BTSs, manages radio resources, and supports handover.
• Base station subsystem (BSS): the combined BTS and BSC.
• Mobile switching centre (MSC): performs call switching, mobility management, and circuit-service control.
• Gateway MSC (GMSC): connects the operator’s network to external fixed or mobile networks.
• Home location register (HLR): stores relatively permanent subscription and service information.
• Visitor location register (VLR): stores temporary information about subscribers currently served by an MSC area.
• Authentication centre (AuC): generates authentication and ciphering-related parameters.
• Equipment identity register (EIR): may classify devices according to their IMEI status.
• Operation and maintenance centre (OMC): supervises and configures network elements.

The HLR and AuC are conceptually home-network functions; the VLR is associated with a serving or visited MSC. In many implementations these databases were integrated physically, but their logical responsibilities remained distinct.

2.2 GSM Signaling and Mobility

When a device powers on, it searches for a suitable cell and performs location updating. The network authenticates the subscriber using challenge-response procedures based on secret material in the SIM and AuC. It then assigns a temporary identity and may enable encryption over the radio interface.

For a mobile-terminated call, the GMSC queries the HLR to determine the subscriber’s serving location. The HLR contacts the relevant VLR, which identifies the serving MSC and location area. Paging is then performed through the BSS. For a mobile-originated call, the MS requests access, the serving MSC checks subscription and routing information, and a circuit connection is established.

GSM uses location areas, each containing multiple cells. A mobile normally updates its location when it enters a new location area rather than reporting every cell change. This reduces signaling but means that paging may involve several cells.

2.3 GSM Data Evolution

The original GSM data service used circuit-switched channels. GPRS introduced packet-switched data through the serving GPRS support node (SGSN) and gateway GPRS support node (GGSN). The SGSN handled mobility and session-related functions, while the GGSN connected to external packet networks and often allocated or relayed IP addresses.

Enhanced Data rates for GSM Evolution (EDGE) improved radio efficiency but did not fundamentally change the division between the GSM radio network and packet core. GSM therefore illustrates a transitional architecture: voice remained circuit-oriented while packet data was added as a parallel service domain.

3. UMTS: Separating Radio Technology from a Multiservice Core

UMTS introduced a wideband CDMA radio interface and a new radio access network called UTRAN. It retained substantial compatibility with GSM core-network concepts while supporting higher data rates and more flexible bearer services.

3.1 UMTS Terrestrial Radio Access Network

UTRAN contains:

• Node B: the radio base station;
• Radio network controller (RNC): controls radio resources, admission, power-related procedures, and mobility within the radio network;
• Iu interface: connects the RNC to the core network.

The RNC could support soft handover, in which a UE communicates with more than one cell during a transition. This is a major difference from the predominantly hard-handover behavior of GSM.

3.2 UMTS Core Network

UMTS retained two logical service domains:

• Circuit-switched domain: MSC and visitor location functions for voice and traditional telephony services.
• Packet-switched domain: SGSN and GGSN for IP data.

The HLR, AuC, and equipment identity functions remained central subscriber and security resources. The same subscription could be used across GSM and UMTS access networks, allowing interworking and mobility between generations.

UMTS introduced the idea of a radio access bearer (RAB), linking a radio bearer to a core-network bearer. Bearers could be configured with different quality-of-service characteristics, such as conversational, streaming, interactive, or background traffic. This was an important step toward explicit service differentiation.

3.3 UMTS Session Establishment

For packet data, a UE requested activation of a packet data protocol context. The request passed through the RNC to the SGSN and GGSN. The GGSN selected or confirmed an access point name (APN), and a logical path was established toward an external packet data network. The resulting context included subscriber authorization, an address or addressing method, and traffic-treatment parameters.

UMTS therefore advanced the network from a voice-centric architecture toward a multiservice design, but it retained multiple control mechanisms and relatively complex interfaces.

4. LTE: Flat, All-IP Architecture

LTE was designed to improve spectral efficiency, reduce latency, simplify the network, and support broadband IP services. Its radio access network is E-UTRAN, and its packet core is the Evolved Packet Core (EPC).

4.1 E-UTRAN

The principal E-UTRAN element is the evolved Node B (eNodeB). Unlike the GSM BTS or UMTS Node B, the eNodeB incorporates many functions previously located in a controller. This flatter design reduces hierarchy and can shorten control and user-plane paths.

E-UTRAN uses OFDMA in the downlink and SC-FDMA in the uplink in conventional LTE specifications. It supports packet scheduling, admission control, radio bearer control, retransmission mechanisms, and mobility procedures.

4.2 EPC Components

The main EPC entities are:

• Mobility Management Entity (MME): control-plane mobility management, NAS signaling termination, authentication coordination, and bearer control.
• Serving Gateway (S-GW): user-plane forwarding and mobility anchoring within the LTE system.
• Packet Data Network Gateway (P-GW): connection to external packet networks, IP address allocation, charging-related enforcement, and policy application.
• Home Subscriber Server (HSS): subscriber, authentication, and location-related data.
• Policy and Charging Rules Function (PCRF): policy and quality-of-service rules.
• eNodeB: radio access and radio-resource functions.

LTE separates the control path through the MME from the user path through the S-GW and P-GW. The UE does not directly communicate with the MME using ordinary IP application traffic; NAS messages are transported via the eNodeB.

4.3 EPS Bearers

LTE uses the Evolved Packet System (EPS) bearer as the unit of traffic treatment between the UE and the P-GW. A default bearer is normally created when the UE establishes packet connectivity through an APN. Dedicated bearers may subsequently be created for traffic requiring distinct quality-of-service treatment.

An EPS bearer is associated with parameters including a QoS Class Identifier (QCI), allocation and retention priority, and aggregate or guaranteed bit-rate characteristics where applicable. The bearer is realized through radio, transport, and core-network components; it is not merely a radio channel.

The LTE attach procedure typically includes cell access, RRC connection establishment, NAS attach signaling, authentication, security activation, subscription retrieval, default bearer establishment, and IP connectivity. A simplified sequence is:

1. The UE selects a cell and requests an RRC connection.
2. The eNodeB establishes signaling connectivity with the MME.
3. The MME obtains authentication vectors and subscription information from the HSS.
4. Mutual authentication and security procedures occur.
5. The MME selects an S-GW and P-GW and requests session creation.
6. The eNodeB configures radio resources and the UE receives bearer and addressing information.

5. 5G New Radio and 5G Core

5G introduces New Radio (NR), a more service-oriented core, advanced antenna techniques, flexible numerology, support for diverse spectrum ranges, and a design intended for enhanced mobile broadband, ultra-reliable low-latency communication, and massive machine-type communication.

5.1 5G Radio Access Network

The 5G RAN uses the gNodeB (gNB). A gNB may be split into a central unit (CU) and distributed unit (DU), with standardized interfaces such as F1. Further separation may distinguish control-plane and user-plane functions. This functional disaggregation enables centralized processing, local deployment, and more flexible transport engineering, but it also creates synchronization, latency, security, and interoperability requirements.

5G supports standalone (SA) operation with a 5G Core and non-standalone (NSA) operation in which NR is assisted by an LTE radio or EPC-related architecture. NSA enabled early 5G deployment but does not expose the full set of standalone core capabilities.

5.2 5G Core Functions

The 5G Core (5GC) uses a service-based architecture (SBA). Important network functions include:

• AMF: access and mobility management;
• SMF: session management, including PDU session establishment;
• UPF: user-plane packet forwarding and traffic anchoring;
• UDM: unified data management;
• AUSF: authentication server function;
• PCF: policy control;
• NRF: network repository and service discovery;
• NSSF: network slice selection;
• NEF: controlled exposure of network capabilities;
• NSSF: selection of an appropriate network slice;
• CHF: charging-related functions in appropriate deployments.

The SBA allows network functions to expose services through APIs, commonly using HTTP-based service communication with security and discovery mechanisms. This differs from the more interface-specific architecture of earlier generations, although 5G also retains carefully specified reference points and protocol procedures.

5.3 Registration and PDU Sessions

In 5G, a UE first performs registration for access and mobility services. It may then request establishment of a PDU session to a data network identified through a data network name (DNN). The AMF handles access and mobility signaling, while the SMF controls the session and selects or configures a UPF. The UPF forwards user traffic toward the data network.

A PDU session may support IPv4, IPv6, or Ethernet-like connectivity depending on deployment and subscription. Quality of service is represented through QoS flows, which are mapped to radio and transport resources. This is more flexible than treating the entire packet connection as one undifferentiated bearer.

6. Subscriber Management and Security

Subscriber management includes identity, authentication, authorization, mobility state, service subscription, charging eligibility, and policy. Earlier systems centered on the HLR; LTE used the HSS; 5G distributes responsibilities among UDM, AUSF, AMF, and related functions.

Authentication generally relies on a secret shared between the subscriber’s secure module and the home operator. The network sends a challenge, and the secure module calculates a response. Successful authentication demonstrates possession of the secret without transmitting it directly. In 5G, improved identity privacy mechanisms conceal the permanent subscription identifier using a subscription concealed identifier (SUCI) derived from the permanent identifier and a home-network public-key mechanism.

Security objectives include:

• mutual authentication where supported;
• confidentiality of radio and signaling traffic;
• integrity protection of control signaling;
• replay resistance;
• secure key derivation;
• protection of subscriber privacy;
• controlled access to operational interfaces.

Security is not guaranteed solely by encryption. Misconfigured roaming interfaces, exposed management APIs, insecure virtualization hosts, weak credentials, and supply-chain vulnerabilities can all compromise a network.

7. Signaling, Bearers, and Mobility Management

Signaling establishes context before user data flows. It also updates that context when a device moves, changes service requirements, enters idle mode, or loses coverage.

A generic data-session sequence contains:

1. Discovery and access: the UE finds a suitable cell and acquires system information.
2. Registration or attach: the network identifies and authenticates the subscription.
3. Authorization: subscription and policy data are checked.
4. Session establishment: a gateway path and addressing context are created.
5. Radio resource configuration: the RAN creates radio bearers or QoS flows.
6. User-plane forwarding: packets traverse the configured path.
7. Modification or release: resources change or are removed when no longer needed.

Mobility may be handled in idle mode through tracking or location-area updates, or in connected mode through handover. Intra-system handovers may remain within one RAN; inter-system mobility may involve GSM, UMTS, LTE, or 5G procedures and interworking functions. The design challenge is to preserve service continuity while changing radio and sometimes core-network anchors.

Control-plane signaling consumes processing capacity and transport resources. Excessive periodic updates, poorly configured timers, mass reconnection after an outage, or dense IoT deployment can create signaling storms. Capacity planning must therefore consider signaling load, not only aggregate user-plane throughput.

8. Roaming Architecture

Roaming allows a subscriber of a home public land mobile network (HPLMN) to obtain service through a visited public land mobile network (VPLMN). The home network normally retains authority over subscription, authentication, and policy, while the visited network provides radio access and some serving functions.

Two broad data-routing models are common:

• Home-routed roaming: user traffic is carried through the visited access network toward a gateway in the home network. This preserves home-network service control but can increase latency.
• Local breakout: traffic exits through a gateway in the visited network. This can reduce latency and improve local service access but requires policy, charging, security, and regulatory coordination.

Roaming requires agreements concerning authentication, signaling security, charging, lawful access, quality, fraud management, and data protection. International signaling networks and IP interconnects must be protected against impersonation, unauthorized probing, and signaling abuse. Regulatory requirements may determine whether subscriber data can leave a jurisdiction and where traffic may be routed.

9. Virtualization, Cloudification, and Network Slicing

Traditional mobile networks used dedicated hardware appliances. Network functions virtualization (NFV) implements network functions as software on virtual machines or containers running on general-purpose infrastructure. Software-defined networking (SDN) separates traffic-control logic from forwarding elements and enables programmable path management.

Virtualization provides elasticity, automation, resource pooling, and potentially faster deployment. However, it introduces concerns about orchestration complexity, noisy-neighbor effects, timing performance, observability, multi-tenant isolation, and dependence on cloud infrastructure.

A virtualized deployment commonly contains:

• virtual or containerized network functions;
• compute, storage, and networking infrastructure;
• an orchestration and lifecycle-management system;
• telemetry, policy, security, and automation systems.

Network slicing creates logically isolated service environments over shared physical infrastructure. A slice may be optimized for broadband, industrial control, public safety, or massive sensors. A slice is not simply a VLAN or a separate APN; it can include coordinated radio, transport, core, policy, and operations characteristics. Isolation must be engineered and verified rather than assumed.

Edge computing places selected application or user-plane functions close to users. It can reduce latency and backhaul usage, but distributed sites increase operational, physical-security, synchronization, and software-update challenges.

10. Comparative Evolution

The evolution is not a complete replacement at every generation. Operators often run multiple generations simultaneously, and interworking preserves service continuity. Consequently, engineers must understand both the target architecture and the migration interfaces.

11. Illustrative Case: Migrating a Regional Operator to 5G Standalone

Background

A regional operator has LTE coverage, an EPC, and a growing industrial customer base. A factory requests deterministic policy control, local data processing, and isolation from ordinary consumer traffic.

Problem

The operator must introduce 5G without immediately replacing LTE. It must support existing subscribers, manage roaming, reduce latency for the factory, and avoid unacceptable capital and operational costs.

Analysis

An NSA deployment would provide early NR capacity but would continue to depend substantially on LTE and EPC procedures. It would not provide the full 5G Core service-based architecture or the most flexible slicing and local-breakout model. A standalone deployment requires investment in 5GC functions, cloud infrastructure, transport upgrades, security controls, and staff skills.

Approach

The operator deploys a 5G Core with AMF, SMF, UPF, UDM, AUSF, PCF, and supporting functions. A local UPF is placed near the factory, while a centralized UPF serves ordinary Internet traffic. The factory receives a distinct subscription profile and slice-related selection policy. RAN and transport monitoring are integrated with the orchestration platform. LTE and 5G interworking is retained for consumer mobility.

The operator also establishes strict API authentication, workload isolation, software-image signing, logging, lawful-interception capability, and fallback procedures. Roaming traffic remains home-routed unless commercial and regulatory requirements support an alternative.

Outcome

The factory obtains local traffic handling and policy differentiation, while consumer services continue through the established LTE/EPC infrastructure. The operator gains a migration path but must manage more complex operations and verify that the promised service characteristics are achieved end to end rather than only at the radio site.

Learning Points

1. Standalone 5G is an architectural transformation, not merely a new radio.
2. A local UPF can reduce path length but cannot compensate for inadequate radio, transport, or application design.
3. Slicing requires coordinated policy and isolation across several domains.
4. Migration plans must address legacy mobility, roaming, charging, security, and operational skills.

12. Engineering, Governance, and Operational Considerations

Network design should begin with service requirements rather than labels such as “4G” or “5G.” Engineers should identify traffic patterns, mobility, latency, reliability, data sovereignty, security, and availability requirements.

Important best practices include:

• maintain accurate inventory and dependency maps;
• separate control and user-plane monitoring;
• test attach, registration, handover, session release, and roaming scenarios;
• protect signaling and management interfaces;
• use least privilege for operators and workloads;
• automate configuration with validation and rollback;
• measure end-to-end performance, not only radio indicators;
• plan overload controls for signaling storms;
• verify slice isolation and tenant boundaries;
• retain interoperability and disaster-recovery procedures.

Ethical and regulatory issues include lawful interception, emergency calling, retention of communication metadata, privacy of location information, accessibility, supply-chain accountability, and equitable coverage. Artificial intelligence can assist anomaly detection, energy optimization, traffic forecasting, and predictive maintenance, but automated decisions require quality data, explainability appropriate to the use, human oversight, and protection against adversarial or biased behavior.

Chapter Summary

GSM established a hierarchical digital cellular architecture centered on BTS/BSC radio access, MSC switching, and HLR/VLR subscriber management. GPRS added packet data through SGSN and GGSN. UMTS introduced UTRAN with Node B and RNC and expanded bearer-based multiservice operation. LTE flattened the radio network through the eNodeB and created an all-IP EPC with MME, S-GW, P-GW, HSS, and PCRF. 5G adds NR, flexible gNB disaggregation, a service-based 5G Core, QoS flows, cloud-native functions, edge deployment, and network slicing.

Across all generations, the essential tasks remain subscriber authentication, mobility management, session or bearer establishment, policy enforcement, charging, security, and interconnection. Roaming distributes these responsibilities between home and visited networks. Virtualization and cloudification improve programmability and elasticity but introduce new operational and security risks. Effective engineering therefore requires end-to-end analysis across radio, transport, core, applications, governance, and operations.

Key Terms

Access stratum: Signaling and procedures associated primarily with the UE–radio access connection.

AMF: 5G Core function responsible mainly for access and mobility management.

Bearer: A logical service path with defined traffic-treatment characteristics.

BSC: GSM controller that manages radio resources for multiple BTSs.

EPC: LTE packet core consisting principally of MME, S-GW, P-GW, HSS, and policy functions.

eNodeB: LTE radio base station incorporating substantial controller functionality.

gNodeB: 5G NR radio access node.

HLR: GSM home database containing subscriber and service information.

HSS: LTE subscriber and authentication database.

MME: LTE control-plane entity for mobility, NAS signaling, and bearer control.

Network slicing: Logical service-specific network environments sharing underlying infrastructure.

NFV: Implementation of network functions as software on virtualized infrastructure.

PDU session: 5G logical connectivity between a UE and a data network.

RAN: Radio access network connecting UEs to the operator core.

Roaming: Use of a visited network by a subscriber belonging to a home network.

SBA: 5G service-based architecture in which network functions expose services through APIs.

SGSN: Packet-domain mobility and session node in GPRS/UMTS.

UPF: 5G user-plane forwarding function.

VLR: Temporary subscriber database associated with a GSM serving area.

Review Questions

Short Answer Questions

1. What are the principal functions of a mobile core network?
2. Distinguish the control plane from the user plane.
3. What roles do the SGSN and GGSN perform in packet-switched GSM/UMTS networks?
4. Why did LTE use an eNodeB rather than retaining a separate RNC?
5. What is the difference between home-routed roaming and local breakout?

Long Answer Questions

1. Compare GSM, UMTS, LTE, and 5G architectures, including their RAN and core-network components.
2. Explain LTE attach and default EPS bearer establishment in a logically ordered sequence.
3. Describe 5G registration and PDU session establishment, identifying the functions of AMF, SMF, and UPF.
4. Explain subscriber identity, authentication, temporary identifiers, and security evolution across mobile generations.
5. Evaluate the benefits and limitations of NFV, SDN, edge computing, and network slicing in a mobile operator.

Analytical / Application Questions

1. An operator wants low-latency industrial traffic while retaining an existing LTE consumer network. Recommend an architecture and justify the roles of local UPF, 5GC, policy control, and interworking.
2. A sudden outage causes millions of devices to reconnect simultaneously. Analyze the likely signaling consequences and propose engineering controls.
3. A roaming partner requests local breakout for regulatory and latency reasons. Identify the technical, commercial, security, charging, and governance issues that must be evaluated.

Multiple Choice Questions with Answers

Question 1

Which GSM entity primarily performs circuit-switched call switching and mobility management?

A. BTS

B. MSC

C. HLR

D. EIR

Correct Answer: B. MSC

Question 2

Which pair forms the principal packet-switched core of GPRS and UMTS?

A. MME and HSS

B. AMF and SMF

C. SGSN and GGSN

D. BSC and MSC

Correct Answer: C. SGSN and GGSN

Question 3

What is a major architectural characteristic of LTE?

A. Separate RNC for every eNodeB

B. All-IP packet-oriented core and flatter RAN

C. Exclusive reliance on circuit-switched voice

D. Removal of subscriber authentication

Correct Answer: B. All-IP packet-oriented core and flatter RAN

Question 4

Which LTE function primarily handles control-plane mobility management and NAS signaling?

A. MME

B. S-GW

C. P-GW

D. PCRF

Correct Answer: A. MME

Question 5

In 5G, which function manages PDU session establishment and modification?

A. AMF

B. SMF

C. UPF

D. NRF

Correct Answer: B. SMF

Question 6

What is the main role of the 5G UPF?

A. Store permanent subscriber identities

B. Forward user-plane traffic

C. Perform radio scheduling

D. Generate authentication vectors

Correct Answer: B. Forward user-plane traffic

Question 7

Which statement best describes home-routed roaming?

A. All authentication is performed by the visited network only

B. User traffic is generally anchored through a gateway in the home network

C. The UE is prohibited from using visited radio access

D. The visited network has no operational role

Correct Answer: B. User traffic is generally anchored through a gateway in the home network

Question 8

What is a network slice?

A. A single physical antenna sector

B. A logical service-specific network environment over shared infrastructure

C. A temporary subscriber identity

D. A GSM encryption algorithm

Correct Answer: B. A logical service-specific network environment over shared infrastructure

Question 9

Why are temporary subscriber identifiers used?

A. To increase antenna gain

B. To reduce exposure of permanent subscriber identities

C. To replace IP routing

D. To eliminate mobility management

Correct Answer: B. To reduce exposure of permanent subscriber identities

Question 10

Which technology implements network functions as software on general-purpose virtualized infrastructure?

A. NFV

B. FDMA

C. TDM

D. GPS

Correct Answer: A. NFV