See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/304296823

Data transmission via GSM voice channel for end to end security

Conference Paper · September 2015

DOI: 10.1109/ICCE-Berlin.2015.7391285

CITATIONS READS
3 1,289

2 authors:

Akif Özkan Berna Ors

Friedrich-Alexander-University of Erlangen-Nürnberg Istanbul Technical University
13 PUBLICATIONS   52 CITATIONS    75 PUBLICATIONS   1,141 CITATIONS   

SEE PROFILE SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Tubitak View project

All content following this page was uploaded by Akif Özkan on 07 August 2016.

The user has requested enhancement of the downloaded file.

This is the author’s version of the work. The definitive work was published in Proceedings of the IEEE International Conference on
Consumer Electronics Berlin (ICCE-Berlin), Berlin, Germany, 6-9 September, 2015.

Data Transmission via GSM Voice Channel for End

to End Security

Mehmet Akif Özkan S. Berna Örs

Istanbul Medeniyet University Istanbul Technical University
akif.ozkan@itu.edu.tr siddika.ors@itu.edu.tr

Abstract—Global System for Mobile Communications (GSM) Synthesizer Pitch Codebook

technology still plays a key role because of its availability,
reliability and robustness. Recently, additional consumer appli- Pitch index
.
. …
cations are proposed in which GSM is used as a backup or Speech Frame
.

P
data transmission service. Unfortunately sending data via GSM
Energy Codebook
channel is a challenging task since it is speech sensitive and
suppresses other forms of signals. In this paper, a systematic .
method is proposed to develop a modem that transmits data A/D Encryption .. .
Energy
.
.
G
over GSM voice channel (DoGSMV) using speech like (SL) index
symbols. Unlike the previous approaches an artificial search LSF Codebook
space is produced to find best SL symbols and analyses by
.
synthesis (AbyS) method is introduced for parameter decoding. LSF index . LPC Filter
.
As a result 1.6 kbps simulation data rate is achieved when wireless
communication errors are ignored.
Keywords—Data over GSM voice, Secure GSM communication, Analyzer
GSM Full Rate, Speech like signal Codebook
AbyS GSM GSM GSM
LPC Vocoder
Search Transmission Vocoder
Analyze
Synthetic
I. I NTRODUCTION Speech

Speech
GSM still protects its popularity with recent consumer .. . Decryption D/A Frame

applications because of its wide service availability in all over

the world. Even now it is the only communication service in Fig. 1. The structure of DoGSMV modem
many developing countries and rural areas. In addition to that
GSM voice dedicated channel has high priority, low latency
and better quality of service (QoS) comparing to data channels. (eCall) system for road safety monitoring is a mission critical
These advantages make GSM voice channel attractive as a example. It consists of an in-car system that calls the closest
data transmission service or a backup service for mission emergency center and sends the details in case of an accident.
critical applications even when higher data rates are offered Another important example is the pedestrian guidance of
with recent technologies such as 3G, 4G LTE. WikiWalk project [7], in which geographical information is
sent and guidance messages are received through GSM voice
Security of GSM communication is vital for many life
channel. A different usage is the network address translation
scenerios since it can have a content in each area of life,
(NAT) [8] that establishes a direct peer to peer communication
including personal information to be kept confidential until
between mobile users without a middle server. Covert data
the governmental information to be kept secret. However
communication [9], in which data is hidden into speech signals,
GSM network still has serious vulnerabilities [1]. The content
is an interesting application. Telemetry, automated meter read-
of a GSM communication is only encrypted between the
ing, alarm systems, vehicle tracking/fleet management, security
mobile phone and mobile station (MS), while the security
systems are foreseen as other applications [6].
of transmission through the network only depends on service
providers. Furthermore lightweight A5 algorithms, to which a DoGSMV is a challenging task since GSM channel is
lot of vulnerabilities have been reported [1], are used for the speech sensitive and suppresses other forms of signals. In
encryption. A solution is to encrypt and decrypt speech signals addition several operations are applied to use the bandwidth
before and after the GSM communication to provide end-to- efficiently. The voice channel has a narrow band with maxi-
end security [2]–[4] against third party including the network mum bandwidth of 4 kHz and speech is compressed with GSM
operator. However a special modem is necessary to transmit codec before it is transmitted. Then voice activity detection
data over GSM voice channel as shown in Figure 1. (VAD), discontinuous transmission (DTX) and comfort noise
generation (CNG) are applied in the transmission line so that
Data transmission over GSM voice channel (DoGSMV) is
only voiced parts are carried. Furthermore compression rate is
suggested for many other applications recently. It is proposed
adjusted adaptively according to cellular network traffic.
to be used in Point of Sale (POS) payment systems [5] and
wireless automatic teller machines (ATM) [6]. ETSI’s (Euro- Previous approaches for DoGSMV needs a special modem
pean Telecommunications Standards Institute) emergency call before and after GSM network as shown in Figure 1. The
DoGSMV modem converts digital bit stream to special sig- Synthesizer Pitch Codebook

nals that can be translated back after they are compressed, .

transmitted and decompressed via GSM. Related work can Pitch index . …
.
Speech Frame
be investigated in three group [6], [10]. First group includes P
methods that use digital modulation techniques [5], [7], [11], Energy Codebook

[12] to produce the special signals. Second group uses pre-

.
defined symbols [6], [10], [13]. Third group maps digital bit A/D Encryption .. .
.
.
Energy G
stream to speech parameters and synthesize speech-like (SL) index
signals [14], [15]. Although producing real speech signals have LSF Codebook
significant advantages over modulation methods to pass voice
.
activity detectors (VADs), previous SL symbol based methods LSF index .
.
LPC Filter

are either very slow or not fully explained.

In this paper we proposed a systematic method to transmit Analyzer
digital bit streams using speech like (SL) symbols. We intro- AbyS
Codebook GSM GSM GSM
duced analyses by synthesis (AbyS) for parameter decoding Search
LPC Vocoder Transmission Vocoder
Analyze
and designed the modem by selecting best performing SL Synthetic
Speech
symbols after a convenient artificial database is produced. As
Speech
a result performance increased from 0.6 kbps to 1.6 kbps data .. . Decryption D/A Frame
rate for GSM FR.
Fig. 2. The structure of DoGSMV modem
II. S TRUCTURE OF D O GSMV M ODEM
We focused on GSM Full Rate (GSM-FR) [16] in this work of GSM channel. Then a parameter pool is created from the
since it is one of the widely used standards for mobile phones. determined combinations and a synthetic SL symbol database
Its sampling frequency is 8 kHz and data rate is 13 kbps. Its is produced as a search space. Finally, best SL symbols are
compression algorithm is Regular Pulse Excitation-Long Term selected according to the objective function and the codebooks
Prediction (RPE-LTP), which is a type of Code Excited Linear of DoGSMV modem are designed.
Prediction (CELP).
CELP is a lossy compression based on Linear Predictive A. Objective Function
Coding (LPC) and analyses by synthesis (AbyS) methods.
Input signal is divided to short frames and vocal properties Symbol Error Rate (SER) is chosen for the cost function.
of speech are analyzed with LPC. The error in AbyS is the DoGSMV modem is designed in two steps to have most fault
difference between the input signal and the synthetic speech tolerant codebook and decoding scheme. In the first step,
that is produced from analyzed parameters. Speech parameters euclidean distances of codewords are maximized in order to
of input are extracted with LPC and error is calculated with produce most distinguished SL symbols for different inputs. In
AbyS in a CELP based compression. An iteration is run until the second step, error correction blocks are designed for the
a small error is reached. A detailed explanation can be found decoding part. Conditional probability of P (IN (Yi ) = i|Xi )
in [17]. is maximized where IN (Yi ) is the codeword index of GSM
channel output for the input of Xi signal.
Considering the structure of CELP, we chose LPC method
to produce SL symbols from the basic parameters, which are
Line Spectrum Frequencies (LSF), pitch and energy, as shown B. Search space
in Figure 2. The DoGSMV modem consists of look up tables,
which are called codebooks, to store the parameters of selected Optimizing the cost function in a speech database has two
SL signals. Input bit stream is used as a set of index numbers advantages: 1) Finding SL symbols. 2) Reducing the search
to the codebooks. The biggest challenge is that the same exact space to a subset most probably provides a global minimum
parameters cannot be found even when the synthesized signal for the cost function. Previous works targets TIMIT speech
is analyzed with no change. Furthermore additional distortions database as the search space [4], [10], [13] for the SL symbol
to produced signal come from the (de)compression of GSM- selection. Then they applied several pre-processing operations
FR. Therefore we used a clever parameter extraction method are applied such as voiced symbol selection, power normal-
based on AbyS for the decoder part. ization and similar symbol election before the optimization of
cost function.
SL symbols are selected from voiced frames because of two
reasons: 1) Not to trigger VADs of GSM. 2) Distortion coming In this paper, a novel approach is proposed. An artificial
from GSM (de)compression is much bigger for unvoiced database is created using LPC from the constraints of GSM
speech frames [4]. On the other hand silence intervals should instead of filtering a speech database. Since LPC uses IIR filter
be placed between voiced frames to pass VADs. for speech production, producing a database consisting stable
sets of LPC parameters is a challenge. We overcome this prob-
Design of the DoGSMV modem has three stages. First, an lem by using Line Spectrum Frequencies (LSF) instead of LPC
objective function is determined to measure the performance. parameters. LSF is a transformation of LPC that provides better
Second, quantization tables for the parameters of the SL performance in quantization [17]. A monotonically increasing
symbols are determined from the properties and requirements LSF parameters, obeying to (1), assures the stability of LPC
 Pitch Codebok
Received LPC Error Signal
Speech Scaling
Analyse .
Filter .
.
Synthetic
Speech
LSF LSF LPC LPC Coeff.
Codebook Codebook2 Analyse
Compare Signals Autocorrelation
.
.
.
.
LPC for all
. . and Analyse pitch codewords
LPC to LSF Calculate Error

Find Maximum Autocorrelation

and Get Pitch Index
Find LSF index and LSF from
LSF codebook Scaling
Fig. 4. Pitch parameter decoding
LSF Coeff.
LPC Cost of LSF codebooks are minimized with an iteration of
LSF to LPC Synthesize two steps:
LPC Coeff Period
Filter
1) K in (2) is selected and all the combinations of
4/6 LSF codewords are created from the quantization
.
.
.
Yes Error < Epsilon table of CELP [17].
2) Most distinct codewords are found using
Neighborhood No
LBG (Linde-Buzo-Gray) algorithm and Codebooks
Output are updated when the minimum cost is reached.
LSF Matrice
LSF LSF index As a result optimal K is selected and best LSF database
is created. In the second step, LBG is replicated with many
different set of initial vectors to avoid local minimum. Mean
shift algorithm can also be used in here. These clustering
Fig. 3. LSF parameters decoding algorithms are modified to force selected codeword to be an
element of its search database.

synthesis filter. LSF decoder structure of DoGSMV modem is given in

Figure 3. AbyS method is used with a concept called Neigh-
LSF [i] < LSF [j] for i < j and i, j ∈ [1, 10] (1) borhood matrix (NM). NM consists of a set of indexes in its
ith row in order to address most probable symbols that can be
The main advantage of the proposed method is that we selected instead of codeword i after GSM coding. The term
only introduced the SL signals showing good performances in “nearest neighbor” is used for the symbol having the biggest
GSM (de)coding. We made sure that speech signals produced probability of confusion. Affordable calculation cost of AbyS
from the parameters of the quantization levels of GSM are in can be achieved thanks to NM concept. In addition, NM can
the database. In addition, we included outputs of GSM after a be updated according to system noise.
signal is repeatedly coded as explained in paper [4]. LSF decoder extracts the indexes in six steps:

C. LSF Parameter (De)Coding 1) Calculate LSF parameters of received signal.

2) Extract LSF indexes from codebooks.
LSF codebook of DoGSMV modem is designed to map 10 3) Produce SL symbol from the selected LSF code-
bits of digital data. It is experimented that 10 LSF parameters words.
provide a good performance for 10/20 ms frames. Splitted 4) Calculate a scaled error of produced SL symbol
vector quantization method is used with euclidean distance. 5) Return the index if the error is acceptable
(4, 6) splitting of LSF parameters is reported to give best 6) If there is a nearest neighbor, select its LSF code-
performance [17]. Therefore two codebooks having 25 + 25 words and skip to step 3. Else return the index of the
codewords are designed for the sets of 4 LSFs and 6 LSFs codeword with minimum error.
instead of a one big 210 sized codebook.
All of the LSF combinations that are produced from splitted D. Pitch Parameter De(Coding)
codebooks should be monotonically increasing to preserve the Frequency of the SL symbols should be in the range of
stability. This means that the maximum codeword of 4 LSF human voice to trick VADs of GSM. It is observed that less
codebook is smaller than the minimum codeword of 6 LSF distortion come for the frequencies between 50 Hz and 400
codebook. Mathematical explanation is given in (2). Hz in GSM coding.

K > LSF [i] for i ≤ 4 Experimental results show that pitch parameter can be
K| (2)
K < LSF [i] for i ≥ 4 extracted correctly even for the GSM coded signals. On the
 The number of signals giving the wrong LSF index number
80
Transmitted Find Correct
Speech LPC Parameters
70
LPC
Find Correct Synthesize
60
Period Filter

50 Gain
Codebook Scaling
40
.
.
.

30

20 Calculate Error and Find Gain index

0 100 200 300 400 500
Period

Fig. 5. Symbol error rate (SER) / pitch histogram Fig. 6. Energy parameter decoding

other hand, changing the frequency affects fault tolerance to using SOX tool [18]. Additional VAD programs, which check
GSM coding of SL symbols differently. Therefore designing low band to full band ratio, zero crossing rate and normalized
the pitch codeword with a linear division of the specified first autocorrelation coefficient features to estimate the silence,
frequency range gives a poor performance. Concerning these are designed. 1.6 kbps data rate is reached by coding 16 bit
observations, a nonlinear approach is proposed to design 4-bit streams on 10 ms speech frames with the proposed method.
pitch codebook. Proposed algorithm has three steps: Coherency of simulation platforms is very important for
1) Search space is extended by producing SL symbols a fair comparison of the related work. While some work
using all of the combinations of LSF codebooks and simulates the voice channel only with speech compression
selected frequency range of pitch. source code [2], [4], [15], results on real time implementations
2) Symbol error rate (SER) / pitch histogram is calcu- exist [3], [5]. Although there are certain challenges in real
lated over the search space as given in Figure 5. time implementation of the system, Katugampala et. al. proves
3) Codewords are selected from pitch values providing that closed results of a simulation [2] can be achieved in real
minimal SER and their distances are maximized. time [3]. This work proposes a more efficient algorithm to
use auto-regressive speech production methods. It can also be
Autocorrelation, which is a general approach, is used in applied in other works. Related work giving the simulation
the decoding part as shown in Figure 4. It has three steps: results on GSM-FR channel or using the speech production
methods are given in Table I. A fair comparison can be made
1) Filter the received speech signal by LPC analyze with [4], [15]. Bit Error Rate (BER) in a simulation system
using the parameters calculated at the 3rd step of LSF points constant design faults when only speech compression
error correction algorithm. This is the result of first codec is implemented as in [15]. Moreover, Sapozhnykov [6]
LPC analyze. shows that vocoder selection and acceptable BER highly
2) Calculate autocorrelation values of the error signal effects maximum achievable data rate. Even accepting a small
for all of the codewords of the pitch codebook. BER rises the data rate of the same technique significantly.
3) Extract the index number of the codeword that has It can be seen that the proposed algorithm increases the data
maximum auto-correlation result. rate of [4] by 33 % when 20 ms frames are processed in both
algorithms.
E. Energy Parameter De(Coding)
AbyS approach increases the performance of speech pro-
Energy is calculated using the error of LPC analyze since it duction methods significantly. A competitor in this class is
provides a more reliable result [17]. 2 bits of energy codebook Katugampala’s design. A raw data rate of 3 kbps has been
is produced with a linear approach. AbyS is used in the reported with a simulation BER of 2.9 %. Adding error correct-
decoding as shown in Figure 6. Decoding has two steps: ing codes (rate 1/2 convolutional codes) yielded a throughput
of 1.2 kb/s with a 0.03 % BER. However their results are
1) Synthesized speech frame is multiplied with code- on GSM EFR. Moreover, they gave no detail about their
words of energy codebook. codebook design and error handling algorithms. Concerning
2) Energy index is extracted by selecting the codeword the advantages of using speech signals instead of modulation
providing minimum distance with the received signal. methods to pass VADs, the results of the proposed system is
promising.
III. R ESULTS & D ISCUSSIONS
IV. C ONCLUSION
GSM-FR 06.10 is selected to show the boundaries of the
proposed method since it is the hardest scenario [6]. GSM- In this work a system is given to provide end to end
GSM communication is simulated in computer environment data communication over GSM voice channel. A systematic
 TABLE I. C OMPARISON WITH PREVIOUS WORKS USING GSM FR.
[5] B. Kotnik, Z. Mezgec, J. Svečko, and A. Chowdhury, “Data trans-
mission over gsm voice channel using digital modulation technique
based on autoregressive modeling of speech production,” Digital Signal
Vocoder Data Rate BER %
Processing, vol. 19, no. 4, 2009.
∗,CE
Proposed Method FR 1.6 (kbps) 0.00 [6] V. V. Sapozhnykov and K. S. Fienberg, “A low-rate data transfer
∗,RT technique for compressed voice channels,” Journal of Signal Processing
Kotnik et al. [5] FR 0.533 (kbps) 30
Systems, vol. 68, no. 2, 2012.
FR 0.107 (kbps) 10
[7] B. T. Ali et al., “Data transmission over mobile voice channel based on
∗,CE
Ozkan et al. [4] FR 0.600 (kbps) 0.00 m-fsk modulation,” in IEEE Wireless Communications and Networking
∗,CE Conference (WCNC), 2013.
Katugampala et al. [2] EFR 3 (kbps) 0.5
[8] A. Patro, G. Baudoin, and O. Venard, “A system for audio signalling
4 (kbps) 4 based nat traversal,” in IEEE International Conference on Communica-
∗,RT tion Systems and Networks (COMSNETS), 2011.
Katugampala et al. [3] EFR 3 (kbps) 2.9
1.2 (kbps) 0.03 [9] M. Boloursaz, R. Kazemi, F. Behnia, and M. A. Akhaee, “Performance
improvement of spread spectrum additive data hiding over codec-
FR 1.4 (kbps) 0.0004 distorted voice channels,” in IEEE European Signal Processing Conf.
(EUSIPCO), 2014, pp. 2510–2514.
EFR 2.1 (kbps) 0.0001
∗,RT
[10] M. Boloursaz, A. H. Hadavi, R. Kazemi, and F. Behnia, “A data modem
Sapozhnykov et al. [6] EFR 3 (kbps) 0.3466 for gsm adaptive multi rate voice channel,” in IEEE East West Design
(same technique) AMR 12.2 3 (kbps) 3.1 and Test Symposium, 2013.
[11] T. Chmayssani and G. Baudoin, “Data transmission over voice dedicated
AMR 12.2 0.76 (kbps) 0.00
channels using digital modulations,” in IEEE International Conference
∗,CE Radioelektronika, 2008.
Rashidi et al. [15] FR 1.15 (kbps) 0.02
∗,− [12] A. Dhananjay, A. Sharma, M. Paik, J. Chen, T. K. Kuppusamy, J. Li,
Peyvandi et al. [19] FR 0.8 (kbps) 0.4 and L. Subramanian, “Hermes: data transmission over unknown voice
∗
( : Methods using autoregressive speech production) channels,” in ACM International Conference on Mobile Computing and
(Simulation in CE : Computer Environment, RT : Real Time) Networking, 2010.
[13] A. Shahbazi, A. H. Rezaei, A. Sayadiyan, and S. Mosayyebpour, “Data
transmission over gsm adaptive multi rate voice channel using speech-
like symbols,” in IEEE International Conference on Signal Acquisition
method is proposed to design a special data modem that and Processing (ICSAP’10), 2010, pp. 63–67.
transmits digital bit streams using speech like (SL) symbols. [14] N. N. Katugampala, K. T. Al-Naimi, S. Villette, and A. M. Kondoz,
The modem converts SL symbols to digital data correctly after “Real time end to end secure voice communications over gsm voice
it is compressed and uncompressed with the vocoders of GSM. channel,” in IEEE European Signal Processing Conference (EUSIPCO),
2005, pp. 1–4.
The system is simulated using GSM-FR 06.10 vocoder and
[15] M. Rashidi, A. Sayadiyan, and P. Mowla, “Data mapping onto speech-
VAD programs. like signal to transmission over the gsm voice channel,” in IEEE
Southeastern Symposium on System Theory, 2008.
SL symbols are produced from LSF, pitch and energy
[16] E. S. T. Series, “Etsi standard gsm 06.10,” 1997, eTSI SMG 2 Group.
properties of speech using splitted vector quantization with two
[17] A. M. Kondoz, Digital speech: coding for low bit rate communication
main contributions. First, analyses by synthesis (AbyS) method systems. John Wiley & Sons, 2005.
of CELP compression is used in the decoding part. Second, [18] “Sox - sound exchange,” http://sourceforge.net/projects/sox/.
cost function of the codebook design is optimized in artificial
[19] H. Peyvandi and A. R. Ebrahimi, “A neural approach for compensation
databases that are created from the quantization levels of the of nonlinear distortion effect in up to 1600bps data communication
selected GSM vocoder. A significant increase in performance over voice-dedicated channels,” in IEEE International Conference on
is observed with a 1.6 kbps data rate. Telecommunications (ICT), 2010.

Furthermore design of the modem is defined as a speech

identification problem. As a future work decoding part will
be designed with the identification methods such as hidden
markov models and it will be applied to other GSM voice
channels, such as EFR, AMR, HR. In addition, synchronization
algorithms will be investigated and the proposed method will
be tested in real time.

R EFERENCES
[1] G. Cattaneo, G. De Maio, and U. F. Petrillo, “Security issues and attacks
on the gsm standard: a review,” Journal of Universal Computer Science,
vol. 19, no. 16, pp. 2437–2452, 2013.
[2] N. Katugampala, S. Villette, and A. M. Kondoz, “Secure voice over
gsm and other low bit rate systems,” 2003.
[3] N. N. Katugampala, K. T. Al-Naimi, S. Villette, and A. M. Kondoz,
“Real time data transmission over gsm voice channel for secure voice
& data applications,” IET Conference Proc., 2004.
[4] M. A. Ozkan, B. Ors, and G. Saldamli, “Secure voice communication
via gsm network,” in IEEE International Conference on Electrical and
Electronics Engineering (ELECO), 2011.

View publication stats