# Fake Base Station Detection and Link Routing Defense +
## 5 Our Scheme
### Link routing vs. handover
#### 5.2.2 Link Routing Scheme Design  
Because the fake base station can launch a Sybil attack by taking a new identity and exploiting the deterministic base station selection algorithm to launch a denial-of-service attack, we design our link routing scheme as an active defense for the user equipment to select a base station from a reputation vector, \(\overrightarrow{R}\) (e.g., the base stations it was connected to before). \(\overrightarrow{R}\) contains IDs of the legitimate base station identities that the user equipment was previously connected to and received services from, and the attacker cannot manipulate the vector. As we mentioned in Section 3.3, 5G-AKA protects against fake base stations at the NAS layer; therefore, the user equipment can identify a base station as legitimate and add it to \(\overrightarrow{R}\) after the successful NAS connection setup procedure. The user equipment can also obtain the legitimate base station identities from the core network as well. However, we take the former approach for building \(\overrightarrow{R}\) (as shown in Step 5 of Algorithm 1) because the \(\overrightarrow{R}\) is based on the user equipment experience, and it can be different for different user equipment, which is effective in preventing fake base station attacks on a large scale. In link routing, we improve the current base station selection process by incorporating \(\overrightarrow{R}\) so that the user equipment connects to a known base station. In contrast, in the current base station selection procedure, the user equipment does not use any connection history but blindly selects a base station that has the highest SNR and connects to it as described in Section 3.2.  
```
Input :\(\tau_{T}\), \(\tau_{N}\) /* Time duration and repeated transmission thresholds */ Output :\(D\) /* Detected? True (1), False (0) */ Require :RRC Connection Setup Complete
1 Send Registration Request Msg
2 Measure \(T\) and \(N\)
3 if Received Authentication Request or Reject Msgthen
4 NAS Connection Setup Complete
5 Store the base station in the Reputation Vector (\(\overrightarrow{R}\))
6 else
7 if\(T>\tau_{T}\) and \(N>\tau_{N}\)then
8 Blacklist the base station with its ID
9 return\(D=1\) and disconnect with the base station /* Fake Base Station detected */
10 else
11 return\(D=0\) and go to Step 1 /* Not detected and send Registration Request Msg */
12 end if
13
14 end for
```  
**Algorithm 1**Fake Base Station Detection by User Equipment  
We include our link routing scheme before the RRC connection setup procedure as illustrated in Figure 4. After the detection of a fake base station, the user equipment scans for the candidate base stations around it. Then it performs a lookup in the reputation vector, \(\overrightarrow{R}\), to verify if the base station is known and legitimate. After a successful lookup with \(\overrightarrow{R}\), it performs the radio connection switching and proceeds with the RRC connection setup procedure with the base station.  
Figure 4: Flowchart of our fake base station (BS) detection and link routing during RRC and NAS connection setup procedure. The black-colored blocks represent 3 GPP standards and the blue-colored blocks represent our additions to the standards.