# Fake Base Station Detection and Link Routing Defense +
## 5 Our Scheme
### Detection Scheme for Passive Intelligence and Awareness  
In our scheme, the user equipment adds a timer-counter-based detection and a blacklisting identification to defend against the fake base station threat described in Section 4. To make the detection/blacklisting decision, our scheme uses sensing measures that are directly from the impact on the user equipment's availability experience, which results from the base station's connectivity behavior. More specifically, our scheme uses the time duration for the connectivity setup (\(T\)) and the repeat transmissions count to set up the connectivity (\(N\)). Because our objective is to reduce the availability threat impact, we use \(T\) and \(N\), which are inherently impacted by the threat. Our scheme also implements the sensing and computing/logic only on the user equipment and does not require any additional changes in the protocol, facilitating the practicality and deployment of our scheme.  
Figure 3: Proof of concept fake base station attack on an Android user equipment device connected to a real-world 4G LTE network.  
For detection, the user equipment tracks both the time duration, starting from the initial registration request in the NAS layer (T), and the number of registration request transmissions it repeats (N). \(N\) is equal to one or is a small number when the user equipment connects to a legitimate base station, as the legitimate base station has the connectivity to the core network and can provide the connectivity, as shown in Figure 2a; in our experimentation, which we describe in Section 7, \(N=1\) without needing to send another registration request. In contrast, \(N\) is larger if the user equipment connects to a faulty base station and when there is no connectivity to the core network (Figure 2c), and \(N\) is infinite and unbounded if it connects to a fake base station (Figure 2b).  
The registration request corresponds to the first transmission in the NAS in Figure 2a. The user equipment is persistent in sending the registration request message until it receives the authentication request/reject message from the network. When the user equipment receives the message from the network, it then proceeds to complete the NAS connection setup. However, when it does not receive any message from the network, it keeps sending a registration request message and measures \(T\) and \(N\). In this case, if \(T\) exceeds \(\tau_{T}\)**and**\(N\) exceeds \(\tau_{N}\), i.e., \(T>\tau_{T}\) and \(N>\tau_{N}\), then our scheme detects the fake base station. In our scheme, \(\tau_{T}\) is the threshold for the time duration (\(T\)) and \(\tau_{N}\) is the threshold for the number of registration requests (N) that our detection algorithm takes as inputs. Because the registration request and the connectivity setup are specific to one base station, which is identified by the cell ID, the user equipment further blacklists the cell ID of the fake base station.  
We select the \(\tau_{T}\) and \(\tau_{N}\) to detect and identify the fake base station. We focus on identifying the fake base station as opposed to the accidentally faulty base station, as described in Section 4.2, and therefore design our scheme to detect and identify the fake base station only. \(\tau_{T}\) and \(\tau_{N}\) increase as the communication channel between the user equipment and base station worsens, although the user equipment selects the base station with the greatest signal SNR, as described in Section 3.2. \(\tau_{T}\) and \(\tau_{N}\), therefore, vary depending on the user equipment's observed channel state information (channel state information, or CSI, is commonly used in modern communication signal processing, for example, MIMO).  
After the detection and blacklisting, the user equipment uses the novel link routing as an active defense measurement to restore the radio connection from the fake base station to the legitimate base station. We describe the link routing concept and scheme in the next section (Section 5.2).