Skip to main content

Welcome to a Grasp lesson

Create a free account to keep studying and create your own study path.

Lesson 1

Spectrum Allocation in Cellular Systems

Recommended resources

Hello! Welcome to your first lesson on the path to understanding telecommunications security.

Your goal is to get hands-on with 4G and 5G hacking. To do that effectively, we first need to build a solid foundation. Hacking any system, whether it's a web application or a cellular network, starts with understanding its fundamental architecture. In wireless systems, that foundation is the radio frequency (RF) spectrum itself.

This lesson addresses the first learning outcome of our course: Describe how radio frequency spectrum is allocated and shared in cellular systems. We'll explore what the RF spectrum is, why it's a crucial and valuable resource, how it's divided and assigned to network operators, and finally, how millions of users can share it simultaneously.

Think of it this way: in your work with IP networking, you know that the pool of public IP addresses is a finite, managed resource. The RF spectrum is the equivalent for all wireless communications, and understanding how it's managed is the first step to understanding the network's attack surface.

1. The Electromagnetic Spectrum: A Finite Resource

All wireless communication, from your car radio to your 5G phone, travels through the air as electromagnetic waves. These waves exist across a huge range of frequencies, known as the electromagnetic spectrum. However, only a small portion of this spectrum is suitable for mobile communication.

To get a clear picture of why the spectrum is so valuable and limited, let's watch a short video.

Understanding Spectrum! | ICT #6

This video from Sabin Civil Engineering, 'Understanding Spectrum!', provides an excellent overview of why spectrum is a precious resource and how it's managed.

Please watch the following segments: 00:00 - 00:40: Introduction to spectrum as a valuable resource. 03:05 - 04:46: Explanation of the scientific and regulatory reasons why usable spectrum is limited and how governments manage it. Focus on the reasons why not all frequencies are suitable (penetration capability, antenna size) and the role of regulatory bodies like the ITU and FCC.

As the video explained, the usable spectrum is a finite resource. This scarcity makes it incredibly valuable. Governments license specific frequency blocks, called bands, to mobile network operators (MNOs) like Verizon, T-Mobile, or Vodafone, often through multi-billion dollar auctions.

These bands are generally categorized by their frequency, which determines their physical properties:

  • Low-band (< 1 GHz): Excellent for wide area coverage, as these signals travel far and penetrate buildings well. However, they offer lower data speeds.
  • Mid-band (1 GHz - 6 GHz): A balance of good coverage and high capacity. This is the workhorse for most 4G and 5G networks today.
  • High-band (> 24 GHz): Also known as millimeter wave (mmWave), this offers enormous capacity and ultra-high speeds but has a very short range and is easily blocked by obstacles.
Electromagnetic Spectrum and 5G Frequency Bands
This chart shows the entire electromagnetic spectrum. Cellular communications, from 2G to 5G, operate within a specific slice of the 'Radio frequencies' portion. You can see how 5G utilizes all three categories: Low-band, Mid-band, and High-band.

To learn more about these bands and how they've been adopted through different cellular generations, the following article provides a good summary.

Understanding Cellular Frequency Bands: LTE, 5G & NB-IoT ...

Let's read a section from the article 'Understanding Cellular Frequency Bands' by Cavli Wireless.

Please read the section titled 'The Backbone of Wireless Connectivity: Understanding Cellular Frequency Bands for IoT'. Focus on the definitions of low-band, mid-band, and high-band spectrum and their characteristics regarding coverage and speed. The FAQ section at the end of the article also has some useful, concise definitions.


2. Sharing the Spectrum: Multiple Access Techniques

Once a mobile operator has a license for a frequency band, they face a new challenge: how can thousands of users in a city all share that same block of spectrum without interfering with each other? The solution is a set of technologies called multiple access methods.

These methods are essentially strategies for dividing the spectrum resource among multiple users. Let's watch a video that explains the evolution of these techniques.

2.2 - MULTIPLE ACCESS - FDMA/TDMA/CDMA/OFDMA

This video from the 'LTE' channel clearly illustrates the primary multiple access methods used in cellular networks, linking each one to a specific generation (2G, 3G, 4G).

Watch the video from the beginning until 05:42. Pay close attention to the visual diagrams for each method and which cellular generation it's associated with: FDMA (1G) TDMA (2G/GSM) CDMA (3G) OFDMA (4G/LTE & 5G)

Let's summarize the key techniques from the video:

  • Frequency Division Multiple Access (FDMA): The total frequency band is split into smaller, separate channels, and each user is assigned their own channel. This is like a radio dial, where each station has its own unique frequency.
  • Time Division Multiple Access (TDMA): Users take turns using the entire frequency band, each for a small slice of time (a time slot). This is common in 2G systems like GSM.
  • Code Division Multiple Access (CDMA): All users transmit on the same frequency at the same time. They are separated by a unique mathematical "code." The receiver uses this code to "tune in" to the desired signal and filter out the rest. This was the primary technology for 3G.
  • Orthogonal Frequency Division Multiple Access (OFDMA): This is the advanced method used in 4G LTE and 5G. It combines aspects of FDMA and TDMA. The main frequency band is divided into hundreds or thousands of tiny "subcarriers." Different users are allocated a specific number of these subcarriers for very short periods. This method is highly flexible and efficient, which is why it enables the high data rates you expect from modern networks.

The following image provides a great visual summary of how FDMA, TDMA, and CDMA divide up the two main resources: frequency and time.

Multiple Access Techniques: FDMA, TDMA, CDMA, and Aloha
Comparison of multiple access methods. Frequency is on the y-axis and time is on the x-axis. FDMA gives each user their own frequency row. TDMA gives each user their own time column. CDMA lets users occupy the same space, separated by unique codes (represented by color).

3. Spatial Sharing and Duplexing

Beyond the multiple access techniques we just discussed, there are two other key concepts for how spectrum is shared and managed.

Frequency Reuse

Operators don't have enough spectrum to give every cell tower its own unique frequency. Instead, they cleverly reuse the same frequencies in different geographic areas that are far enough apart not to interfere. This is a form of spatial sharing. By using directional antennas, a single cell site can even reuse frequencies in different sectors (e.g., North, East, West) around the tower. This dramatically increases the network's overall capacity.

Duplexing: Talking and Listening

Your phone needs to both transmit (uplink) and receive (downlink) data. This two-way traffic must be managed so the strong outgoing signal doesn't drown out the weak incoming one. This is handled by a duplexing method. The article you read earlier has an excellent, simple analogy for this.

Understanding Cellular Frequency Bands: LTE, 5G & NB-IoT ...

Let's revisit the Cavli Wireless article to understand duplexing.

Please read the section titled 'Understanding LTE Communication: TDD vs FDD and Their Role in IoT Connectivity'. The walkie-talkie analogies for Time Division Duplex (TDD) and Frequency Division Duplex (FDD) are very effective.

In short:

  • FDD (Frequency Division Duplex): Uses two separate, paired frequency bands—one for uplink and one for downlink. This is like having two separate channels on your walkie-talkie, one for talking and one for listening.
  • TDD (Time Division Duplex): Uses a single frequency band for both uplink and downlink, but rapidly alternates between them in time. This is like using one channel and saying "over" to let the other person talk.

We will explore the security implications of FDD and TDD in later lessons, but for now, it's important to know they are two fundamental ways an operator's licensed spectrum is organized for two-way communication.


Conclusion

In this lesson, we've established the foundational concepts of spectrum management in cellular networks.

Key Takeaways:

  • The RF spectrum is a finite, regulated, and highly valuable public resource.
  • Spectrum is allocated to mobile operators in licensed frequency bands (Low, Mid, and High), each with different characteristics of coverage and capacity.
  • Spectrum is shared among users in a cell via multiple access techniques like FDMA (1G), TDMA (2G), CDMA (3G), and most importantly for modern networks, OFDMA (4G/5G).
  • Spectrum is also shared spatially through frequency reuse, allowing the same frequencies to be used in non-adjacent cells.

You now have a mental model of how a single, vast resource—the radio spectrum—is partitioned and managed to serve millions of devices.

In our next lesson, we will dive deeper into the two duplexing methods, FDD and TDD. Understanding these is crucial because the specific band plans and duplexing schemes used by operators are public knowledge, and they form the basis for how you will configure your SDR tools to find and listen to cellular signals.