Voice-Data Tunnelling over GSM Voice
Channel
Dr. N. Katugampala & Dr. K. Al-Naimi
1. Introduction
The GSM speech service is secure up to the point where speech enters the core
network. However over the core network it has no security. Moreover the security
over the air interface is optional, and some operators do not implement the encryption
algorithms. In order to have an end-to-end security, speech must be encrypted before
it enters the GSM network. However the GSM speech transcoding process will
severely distort an encrypted signal that does not possess characteristics of speech. As
a result it is not possible to use standard modem techniques over the GSM speech
channel.
Although the GSM data channel can be used for encrypted speech transmission, this
approach suffers from a number of disadvantages. The GSM data channel typically
requires 28-31 seconds to establish a connection, of which approximately 18 seconds
are taken up by the GSM modem handshaking time. Also the round-trip time of the
GSM data channel is between 1 and 2 seconds for the 95th percentile. This is the
solution adopted by current secure GSM systems, which therefore suffer from the
problems associated with the GSM data channel: long delays and call set-up times,
and interoperability problems. Moreover they require a dedicated handset and
subscription to the GSM data services. To make the problem worse the GSM data
service may not be available at all in which case even the dedicated handset would not
operate. This problem will extend to the 3G systems until the real-time data links
become a reality that is not expected in the very near future.
The proposed secure speech and data communications system modulates binary data
into a voice band signal, and creates a data bearer. The modulated voice band signal is
specially designed for this application, and passes through low bit rate GSM speech
coders as well as on PSTN with sufficient accuracy for demodulation. The created
data bearer allows the transmission of encrypted binary data on the standard GSM
voice channel.
2. Architecture of the proposed system
Speech-like
waveform
1100110
Data
encryption
Speech
encoder
Input speech
1010101
Data
modulator
Add-on module to be connected
to standard GSM handset
Speech
encoder
PSTN
to
GSM
Speech
decoder
GSM
to
PSTN
64 kbps PCM
waveform
Base Station Subsystem
Base Station Subsystem
Speech-like
waveform
1010101
Data
demodulator
1100110
Data
decryption
Speech
decoder
Output speech
Add-on module to be connected
to standard GSM handset
Figure 1: Block diagram of the prototype system
Figure 1 depicts the block diagram of the prototype system. The major blocks of the
system are the speech codec, data encryption/decryption, and data modem. All the
functions can be implemented in software to run on a suitable hardware such as a
PDA, an embedded PC, or an integrated PDA/GSM handset. The interfaces between
the functions are provided by shared software buffers. When implemented as an addon module the connection with the GSM handset can be provided by either cable or
Bluetooth. A cable connection to the handsfree socket of the phone provides an
analogue interface. Alternatively a Bluetooth connection provides a digital interface.
3. Experimental results over real GSM voice channels
Experiments were carried out on typical GSM channel conditions, which did not
exhibit unusual frame erasures patterns. The extreme conditions e.g. inside the tunnels
etc. were not tested. A cable was used as to connect a standard Nokia handset and the
modem at each end, i.e. an analogue interface. The modem was implemented in
software on a standard PC. A digital interface using Bluetooth is expected to give at
least as good results if not better. The gross rate of the modem is 3 kbps at 6% BER.
The modem which includes a 1:2 convolutional coder provides a throughput of 1.2
kbps at 0.35% BER, and 1% FER. The SBLPC speech coder operating at 1.2 kbps is
capable of withstanding those error rates, without degrading the speech quality.
The modem signal is capable of maintaining a continuous data channel despite the
GSM VAD, and withstands the effects of the various filters, which are present in the
GSM transmission chain. Setting up delay is less than 500 ms, and end-to-end delay is
less than 200 ms, which includes the delay of the GSM voice channel. The
experiments were carried out for the worst-case scenario i.e. GSM to GSM channels,
and GSM to PSTN channels are expected to provide better performance.
An experimental blue-tooth connection on the transmitter end (which avoids the
analogue section of the phone) indicates that close to 0% BER is achievable at 1.2kb/s
source rate.
At present PC based prototype is being configured for real-time measurements and a
patent covering the new invention is being processed.