From 1G to 5G: how mobile networks evolved
In short: Mobile networks moved from analogue voice (1G) to digital voice and SMS (2G), mobile data (3G), all-IP broadband (4G) and flexible, service-based 5G. Security improved along the way, adding mutual authentication and identity protection. Older generations remain in use, and attackers can exploit downgrades to them.
Who defines the generations
Mobile "generations" are informal labels for big steps in capability. Today the technical specifications are written by 3GPP (the 3rd Generation Partnership Project), a partnership of regional standards bodies, and published in numbered releases. The ITU sets requirements for each generation: IMT-2000 for 3G, IMT-Advanced for 4G and IMT-2020 for 5G. Operators then deploy the standards using licensed radio spectrum.
Generation by generation
| Generation | Example technologies | What it added |
|---|---|---|
| 1G | Regional analogue systems such as AMPS and TACS | Mobile voice; easy to eavesdrop and clone phones |
| 2G | GSM (and CDMA systems) | Digital voice, SMS, SIM cards, basic encryption; later GPRS and EDGE data |
| 3G | UMTS, later HSPA | Practical mobile internet and mutual authentication |
| 4G | LTE and LTE-Advanced | All-IP core (EPC), high-speed broadband, voice over LTE (VoLTE) |
| 5G | 5G NR (New Radio) and 5G Core | Higher capacity, lower latency options, service-based core, network slicing |
Two big architectural shifts stand out. 4G removed the old circuit-switched voice network, so everything became IP packets. 5G then rebuilt the core as cloud-native software functions talking over web-style APIs, described in 5G architecture.
How security improved
In GSM, the network authenticated the phone but the phone did not authenticate the network. This makes fake base stations (often called IMSI catchers) possible: a rogue cell can attract nearby phones and collect identifiers. Some early GSM ciphers were later shown to be weak. 3G introduced mutual authentication using the AKA (Authentication and Key Agreement) protocol, and 4G strengthened keys and added integrity protection for signalling. 5G goes further by encrypting the permanent subscriber identity (SUPI) before sending it, producing a concealed identifier called the SUCI, which makes passive identity collection much harder.
Tip: a phone that falls back to 2G loses many of these protections. Some phones now let users or administrators disable 2G, which is worth considering for high-risk users.
Why the history still matters
- Coexistence: many networks run several generations at once, and some IoT devices still rely on older ones. Operators in many countries have switched off 2G or 3G, while others keep them for coverage or legacy devices.
- Downgrade attacks: jamming or spoofing can push devices onto an older, weaker generation.
- Signalling legacy: older inter-operator protocols such as SS7 and Diameter have known abuse cases; 5G adds protections between operators, covered in 5G security.
- Planning IoT: choose connectivity with a long future, such as LTE-M, NB-IoT or 5G, rather than a generation likely to be switched off.
For exams, remember the key additions: 2G digital and SIM, 3G mutual authentication and data, 4G all-IP, 5G service-based core and slicing.
Practice
Why are fake base stations a bigger problem on 2G than on 4G?
What is the SUCI in 5G?
Which generation first used an all-IP core with no circuit-switched voice?
Key takeaways
- 3GPP writes mobile standards in releases; ITU sets each generation’s goals.
- 2G brought digital voice and SIMs; 3G added mutual authentication and data.
- 4G is all-IP; 5G adds a service-based core and network slicing.
- 5G conceals the permanent subscriber identity over the air.
- Downgrades to older generations remain a real security risk.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.