# Fake Base Station Detection and Link Routing Defense +
## 3 Background and Primer
### Radio Resource Control (RRC) for Wireless Communication Channel Control and Setup  
Because user equipment connects wirelessly to base stations, RRC establishes the radio resource and the wireless channel, including the medium access control (MAC), between the user equipment and the base station.  
The user equipment deterministically selects a base station that has system information messages with the highest received signal power to establish the RRC layer connection using a three-way handshake. As illustrated in Figure 2(a) (yellow-shaded), the RRC connection process begins with the base station periodically broadcasting system information messages with a specific downlink frequency. The system information messages consist of the master information block (MIB) and system information block messages. Among  
Figure 2: The protocol between user equipment, base station, and core network for setting up connectivity, including RRC and NAS. The RRC process between the user equipment and the base station (yellow-shaded) precedes the NAS process between the user equipment and the core network via the base station (blue-shaded). In NAS, the registration request can be repeated until the authentication request is received. The three figures differ in the nature of the base station scenarios: legitimate and working (green) vs. fake (red) vs. faulty (yellow). (**a**) The legitimate base station operates according to 3 GPP standardized protocol [18]. (**b**) The fake base station does not comply with the protocol and ceases transmission after receiving the registration request. (**c**) The unintentionally faulty base station sends an RRC release and authentication reject, notifying user of the connectivity disruption.  
these messages, the system information block 1 (SIB1) is important for the user equipment to obtain network parameters for initiating the RRC connection with the base station. The system information block 1 (SIB1) contains network access-related information such as network identities (PLMN ID, cell ID), cell selection criteria such as minimum received signal strength/quality, and downlink/uplink frequencies. The PLMN ID is the unique identifier of the cellular network provider, and the cell ID is the unique identifier of the base station broadcasting the SIB1. Before further proceeding with the SIB1, the user equipment selects the cell of the base station if the cell selection criteria are satisfied.  
When there are multiple base stations nearby, the user equipment uses a deterministic algorithm while selecting a base station (also known as cell selection/reselection according to 3 GPP [3]) to establish the radio connection. After a piece of user equipment is powered on, it scans all radio frequency channels in the 5G NR band to find its surrounding base stations. Then it determines if the base stations qualify for the selection criterion and selects the base station with the highest received signal-to-noise ratio (SNR) among the qualified base stations.  
After the radio signal-based base station/cell selection based on SIB1, as shown in Figure 2a, the user equipment proceeds to set up the RRC connection with the base station by sending the RRC setup request. Upon receiving the RRC setup request, the base station accepts the connection request and sends the RRC setup message to the user equipment. The user equipment completes the RRC connection by sending the RRC setup complete message along with the registration request to initiate a NAS-layer connection with the core network. This initial registration request is the first message in the 5G authentication and key agreement protocol (5G-AKA). Section 3.3 discusses the 5G-AKA and NAS-layer connection setup in detail.