WO2021189175A1

WO2021189175A1 - Base station reselection in response to detection of a mac-i mismatch condition

Info

Publication number: WO2021189175A1
Application number: PCT/CN2020/080568
Authority: WO
Inventors: Hao Zhang; Jian Li; Meng Liu; Yun Peng; Tianya LIN
Original assignee: Qualcomm Incorporated
Priority date: 2020-03-23
Filing date: 2020-03-23
Publication date: 2021-09-30

Abstract

In an example, a method of wireless communication includes receiving, by a user equipment (UE) device, a message indicating a first message authentication code for integrity (MAC-I) and further indicating a first base station as a source of the message. The method further includes, in response to detecting that the first MAC-I differs from a second MAC-I determined by the UE device, adding an indication of the first base station to control information stored by the UE device. The method further includes selecting a second base station for camping based at least in part on the control information.

Description

BASE STATION RESELECTION IN RESPONSE TO DETECTION OF A MAC-I MISMATCH CONDITION

TECHNICAL FIELD

Aspects of the present disclosure relate generally to wireless communication systems, and more particularly, to base station reselection in response to detection of a message authentication code for integrity (MAC-I) mismatch condition in a wireless communication system.

DESCRIPTION OF THE RELATED TECHNOLOGY

Wireless communication networks are widely deployed to provide various communication services such as voice, video, packet data, messaging, broadcast, and the like. These wireless networks may be multiple-access networks capable of supporting multiple users by sharing the available network resources. Such networks, which are usually multiple access networks, support communications for multiple users by sharing the available network resources.

A wireless communication network may include a number of base stations or node Bs that can support communication for a number of user equipments (UEs) . A UE may communicate with a base station via downlink and uplink. The downlink (or forward link) refers to the communication link from the base station to the UE, and the uplink (or reverse link) refers to the communication link from the UE to the base station.

A base station may transmit data and control information on the downlink to a UE and/or may receive data and control information on the uplink from the UE. On the downlink, a transmission from the base station may encounter interference due to transmissions from neighbor base stations or from other wireless radio frequency (RF) transmitters. On the uplink, a transmission from the UE may encounter interference from uplink transmissions of other UEs communicating with the neighbor base stations or from other wireless RF transmitters. This interference may degrade performance on both the downlink and uplink.

As the demand for mobile broadband access continues to increase, the possibilities of interference and congested networks grows with more UEs accessing the long-range wireless communication networks and more short-range wireless systems being deployed in communities. Research and development continue to advance wireless technologies not only to meet the growing demand for mobile broadband access, but to advance and enhance the user experience with mobile communications.

SUMMARY

In one aspect of the disclosure, a method of wireless communication includes receiving, by a user equipment (UE) device, a message indicating a first message authentication code for integrity (MAC-I) and further indicating a first base station as a source of the message. The method further includes, in response to detecting that the first MAC-I differs from a second MAC-I determined by the UE device, adding an indication of the first base station to control information stored by the UE device. The method further includes selecting a second base station for camping based at least in part on the control information.

In an additional aspect of the disclosure, an apparatus includes a memory and one or more processors coupled to the memory. The one or more processors are configured to receive, at a user equipment (UE) device, a message indicating a first message authentication code for integrity (MAC-I) and further indicating a first base station as a source of the message. The one or more processors are further configured to add, in response to detecting that the first MAC-I differs from a second MAC-I determined by the UE device, an indication of the first base station to control information stored by the UE device. The one or more processors are further configured to select a second base station for camping based at least in part on the control information.

In an additional aspect of the disclosure, a non-transitory computer-readable medium stores instructions executable by a processor to perform operations. The operations include receiving, by a user equipment (UE) device, a message indicating a first message authentication code for integrity (MAC-I) and further indicating a first base station as a source of the message. The operations further include, in response to detecting that the first MAC-I differs from a second MAC-I determined by the UE device, adding an indication of the first base station to control information stored by the UE device. The operations further include selecting a second base station for camping based at least in part on the control information.

In an additional aspect of the disclosure, an apparatus for wireless communication includes means for storing instructions. The apparatus further includes means for executing the instructions to receive, at a user equipment (UE) device, a message indicating a first message authentication code for integrity (MAC-I) and further indicating a first base station as a source of the message. The means for executing is configured to add, in response to detecting that the first MAC-I differs from a second MAC-I determined by the UE device, an indication of the first base station to control information stored by the UE device. The means for executing is configured to select a second base station for camping based at least in part on the control information.

BRIEF DESCRIPTION OF THE DRAWINGS

A further understanding of the present disclosure may be realized by reference to the drawings. In the drawings, similar components or features may have the same reference label. Further, various components of the same type may be distinguished by following the reference label by a dash and a second label that distinguishes among the similar components. If just the first reference label is used in the specification, the description is applicable to any one of the similar components having the same first reference label irrespective of the second reference label.

FIG. 1 is a block diagram illustrating details of a wireless communication system including a user equipment (UE) device configured to perform base station reselection in response to detection of a message authentication code for integrity (MAC-I) mismatch condition according to some aspects of the present disclosure.

FIG. 2 is a block diagram conceptually illustrating a design of a base station and a UE configured to perform base station reselection in response to detection of a MAC-I mismatch condition according to some aspects of the present disclosure.

FIG. 3 is a block diagram illustrating details of a wireless communication system including a UE device configured to perform base station reselection in response to detection of a MAC-I mismatch condition according to some aspects of the present disclosure.

FIG. 4 is ladder diagram illustrating operations that may be performed within a wireless communication system including a UE device configured to perform base station reselection in response to detection of a MAC-I mismatch condition according to some aspects of the present disclosure.

FIG. 5 is a flow chart illustrating an example of a method of wireless communication performed by a UE device to perform base station reselection in response to detection of a MAC-I mismatch condition according to some aspects of the present disclosure.

FIG. 6 is a block diagram conceptually illustrating a design of a UE configured to perform base station reselection in response to detection of a MAC-I mismatch condition according to some aspects of the present disclosure.

DETAILED DESCRIPTION

Certain wireless communication protocols may specify a message code for authentication integrity (MAC-I) verification procedure. For example, a user equipment (UE) device may receive a first MAC-I from a base station and may compare the first MAC-I to a second MAC-I computed by the UE device. If the first MAC-I corresponds to the second MAC-I, the UE device may detect a MAC-I match condition and may continue communications with the base station.

Alternatively, the first MAC-I may fail to correspond to the second MAC-I. In response to detecting a MAC-I mismatch condition, the UE device may reattempt the MAC-I verification procedure (e.g., by repeating the MAC-I verification procedure four additional times) . If repeating the MAC-I verification procedure fails to result in a MAC-I match, the MAC-I verification procedure may “time out. ” A wireless communication protocol may specify that the UE device is to “fall back” to another device in response to the timing out of the MAC-I verification procedure, such as by initiating communications with a device having reduced capabilities, such as a second generation (2G) base station or a third generation (3G) base station.

Failure of the MAC-I verification procedure may be associated with decreased performance in a wireless communication network. For example, performing and repeating the MAC-I verification procedure may take a relatively long period of time, such as approximately two minutes. During this time, the UE device may be in an out-of-service (OOS) state. Further, “falling back” to another device may decrease a data rate available to the UE device or other capabilities.

In addition, failure of the MAC-I verification procedure may be associated with certain security vulnerabilities. To illustrate, in some circumstances, a message may include an incorrect MAC-I due to a malicious entity, such as a hacker, attempting to gain authorized access to a network or a device (e.g., by causing the UE device to initiate communications with a 2G or 3G base station that is associated with increased vulnerability or decreased security in some cases) .

In some aspects of the disclosure, a UE device is configured to perform operations to decrease or avoid delays and service interruptions associated with a MAC-I mismatch condition. In one aspect, the UE device is configured to maintain control information, such as a list of “barred” cells that are associated with MAC-I mismatch conditions. In response to detecting a MAC-I mismatch condition with a first base station, the UE device may add an indication of the first base station to the control information. Further, the UE device may select a second base station for camping base at least in part on the control information, such as by determining that the list of barred cells does not include an indication of the second base station.

By barring a cell and reselecting another cell using the control information in response to a MAC-I mismatch condition, performance and security of a UE device may be improved as compared to other techniques. For example, the UE device may reduce or avoid an OOS state associated with techniques that repeat a MAC-I verification procedure. As another example, the UE device may remain connected to a base station associated with a more recent wireless communication protocol, such as a fourth generation (4G) or a fifth generation (5G) wireless communication protocol (e.g., instead of “falling back” to a 2G or 3G cell) . In some cases, a base station that operates in accordance with a more recent wireless communication protocol may be associated with faster data rates and increased security as compared to a base station that operates in accordance with a less recent wireless communication protocol. Accordingly, performance and security may be enhanced.

The detailed description, in connection with the appended drawings, is intended as a description of various configurations and is not intended to limit the scope of the disclosure. Rather, the detailed description includes specific details for the purpose of providing a thorough understanding of the inventive subject matter. It will be apparent to those skilled in the art that these specific details are not required in every case and that, in some instances, well-known structures and components are shown in block diagram form for clarity of presentation.

Various aspects of the disclosure may be used for wireless communication networks, such as code division multiple access (CDMA) networks, time division multiple access (TDMA) networks, frequency division multiple access (FDMA) networks, orthogonal FDMA (OFDMA) networks, single-carrier FDMA (SC-FDMA) networks, LTE networks, GSM networks, 5th Generation (5G) or new radio (NR) networks (sometimes referred to as “5G NR”networks/systems/devices) , as well as other communications networks. As described herein, the terms “networks” and “systems” may be used interchangeably.

A CDMA network, for example, may implement a radio technology such as universal terrestrial radio access (UTRA) , cdma2000, and the like. UTRA includes wideband-CDMA (W-CDMA) and low chip rate (LCR) . CDMA2000 covers IS-2000, IS-95, and IS-856 standards.

A TDMA network may, for example implement a radio technology such as GSM. 3GPP defines standards for the GSM EDGE (enhanced data rates for GSM evolution) radio access network (RAN) , also denoted as GERAN. GERAN is the radio component of GSM/EDGE, together with the network that joins the base stations (for example, the Ater and Abis interfaces) and the base station controllers (A interfaces, etc. ) . The radio access network represents a component of a GSM network, through which phone calls and packet data are routed from and to the public switched telephone network (PSTN) and Internet to and from subscriber handsets, also known as user terminals or user equipments (UEs) . A mobile phone operator's network may comprise one or more GERANs, which may be coupled with Universal Terrestrial Radio Access Networks (UTRANs) in the case of a UMTS/GSM network. An operator network may also include one or more LTE networks, and/or one or more other networks. The various different network types may use different radio access technologies (RATs) and radio access networks (RANs) .

An OFDMA network may implement a radio technology such as evolved UTRA (E-UTRA) , IEEE 802.11, IEEE 802.16, IEEE 802.20, flash-OFDM and the like. UTRA, E-UTRA, and Global System for Mobile Communications (GSM) are part of universal mobile telecommunication system (UMTS) . In particular, long term evolution (LTE) is a release of UMTS that uses E-UTRA. UTRA, E-UTRA, GSM, UMTS and LTE are described in documents provided from an organization named “3rd Generation Partnership Project” (3GPP) , and cdma2000 is described in documents from an organization named “3rd Generation Partnership Project 2” (3GPP2) . These various radio technologies and standards are known or are being developed. For example, the 3rd Generation Partnership Project (3GPP) is a collaboration between groups of telecommunications associations that aims to define a globally applicable third generation (3G) mobile phone specification. 3GPP long term evolution (LTE) is a 3GPP project which was aimed at improving the universal mobile telecommunications system (UMTS) mobile phone standard. The 3GPP may define specifications for the next generation of mobile networks, mobile systems, and mobile devices. The present disclosure is concerned with the evolution of wireless technologies from LTE, 4G, 5G, NR, and beyond with shared access to wireless spectrum between networks using a collection of new and different radio access technologies or radio air interfaces.

5G networks contemplate diverse deployments, diverse spectrum, and diverse services and devices that may be implemented using an OFDM-based unified, air interface. To achieve these goals, further enhancements to LTE and LTE-A are considered in addition to development of the new radio technology for 5G NR networks. The 5G NR will be capable of scaling to provide coverage (1) to a massive Internet of things (IoTs) with an ultra-high density (e.g., ～1M nodes/km^2) , ultra-low complexity (e.g., ～10s of bits/sec) , ultra-low energy (e.g., ～10+ years of battery life) , and deep coverage with the capability to reach challenging locations; (2) including mission-critical control with strong security to safeguard sensitive personal, financial, or classified information, ultra-high reliability (e.g., ～99.9999%reliability) , ultra-low latency (e.g., ～ 1 ms) , and users with wide ranges of mobility or lack thereof; and (3) with enhanced mobile broadband including extreme high capacity (e.g., ～ 10 Tbps/km^2) , extreme data rates (e.g., multi-Gbps rate, 100+ Mbps user experienced rates) , and deep awareness with advanced discovery and optimizations.

5G NR devices, networks, and systems may be implemented to use optimized OFDM-based waveform features. These features may include scalable numerology and transmission time intervals (TTIs) ; a common, flexible framework to efficiently multiplex services and features with a dynamic, low-latency time division duplex (TDD) /frequency division duplex (FDD) design; and advanced wireless technologies, such as massive multiple input, multiple output (MIMO) , robust millimeter wave (mmWave) transmissions, advanced channel coding, and device-centric mobility. Scalability of the numerology in 5G NR, with scaling of subcarrier spacing, may efficiently address operating diverse services across diverse spectrum and diverse deployments. For example, in various outdoor and macro coverage deployments of less than 3GHz FDD/TDD implementations, subcarrier spacing may occur with 15 kHz, for example over 1, 5, 10, 20 MHz, and the like bandwidth. For other various outdoor and small cell coverage deployments of TDD greater than 3 GHz, subcarrier spacing may occur with 30 kHz over 80/100 MHz bandwidth. For other various indoor wideband implementations, using a TDD over the unlicensed portion of the 5 GHz band, the subcarrier spacing may occur with 60 kHz over a 160 MHz bandwidth. Finally, for various deployments transmitting with mmWave components at a TDD of 28 GHz, subcarrier spacing may occur with 120 kHz over a 500MHz bandwidth.

The scalable numerology of 5G NR facilitates scalable TTI for diverse latency and quality of service (QoS) requirements. For example, shorter TTI may be used for low latency and high reliability, while longer TTI may be used for higher spectral efficiency. The efficient multiplexing of long and short TTIs to allow transmissions to start on symbol boundaries. 5G NR also contemplates a self-contained integrated subframe design with uplink/downlink scheduling information, data, and acknowledgement in the same subframe. The self-contained integrated subframe supports communications in unlicensed or contention-based shared spectrum, adaptive uplink/downlink that may be flexibly configured on a per-cell basis to dynamically switch between uplink and downlink to meet the current traffic needs.

For clarity, certain aspects of the apparatus and techniques may be described below with reference to exemplary LTE implementations or in an LTE-centric way, and LTE terminology may be used as illustrative examples in portions of the description below; however, the description is not intended to be limited to LTE applications. Indeed, the present disclosure is concerned with shared access to wireless spectrum between networks using different radio access technologies or radio air interfaces, such as those of 5G NR.

Moreover, it should be understood that, in operation, wireless communication networks adapted according to the concepts herein may operate with any combination of licensed or unlicensed spectrum depending on loading and availability. Accordingly, it will be apparent to one of skill in the art that the systems, apparatus and methods described herein may be applied to other communications systems and applications than the particular examples provided.

While aspects are described in this application by illustration to some examples, those skilled in the art will understand that additional implementations and use cases may come about in many different arrangements and scenarios. Innovations described herein may be implemented across many differing platform types, devices, systems, shapes, sizes, packaging arrangements. For example, aspects described herein may be implemented via integrated chip implementations and/or other non-module-component based devices (e.g., end-user devices, vehicles, communication devices, computing devices, industrial equipment, retail/purchasing devices, medical devices, AI-enabled devices, etc. ) . While some examples may or may not be specifically directed to use cases or applications, a wide assortment of applicability of described innovations may occur. Implementations may range from chip-level or modular components to non-modular, non-chip-level implementations and further to aggregated, distributed, or OEM devices or systems incorporating one or more described aspects. In some practical settings, devices incorporating described aspects and features may also necessarily include additional components and features for implementation and practice of claimed and described examples. It is intended that innovations described herein may be practiced in a wide variety of implementations, including both large/small devices, chip-level components, multi-component systems (e.g. RF-chain, communication interface, processor) , distributed arrangements, end-user devices, etc. of varying sizes, shapes, and constitution.

FIG. 1 shows wireless network 100 for communication according to some aspects. Wireless network 100 may, for example, comprise a 5G wireless network. As appreciated by those skilled in the art, components appearing in FIG. 1 are likely to have related counterparts in other network arrangements including, for example, cellular-style network arrangements and non-cellular-style-network arrangements (e.g., device to device or peer to peer or ad hoc network arrangements, etc. ) .

Wireless network 100 illustrated in FIG. 1 includes a number of base stations 105 and other network entities. A base station may be a station that communicates with the UEs and may also be referred to as an evolved node B (eNB) , a next generation eNB (gNB) , an access point, and the like. Each base station 105 may provide communication coverage for a particular geographic area. In 3GPP, the term “cell” can refer to this particular geographic coverage area of a base station and/or a base station subsystem serving the coverage area, depending on the context in which the term is used. In implementations of wireless network 100 herein, base stations 105 may be associated with a same operator or different operators (e.g., wireless network 100 may comprise a plurality of operator wireless networks) , and may provide wireless communications using one or more of the same frequencies (e.g., one or more frequency bands in licensed spectrum, unlicensed spectrum, or a combination thereof) as a neighboring cell. In some examples, an individual base station 105 or UE 115 may be operated by more than one network operating entity. In other examples, each base station 105 and UE 115 may be operated by a single network operating entity.

A base station may provide communication coverage for a macro cell or a small cell, such as a pico cell or a femto cell, and/or other types of cell. A macro cell generally covers a relatively large geographic area (e.g., several kilometers in radius) and may allow unrestricted access by UEs with service subscriptions with the network provider. A small cell, such as a pico cell, would generally cover a relatively smaller geographic area and may allow unrestricted access by UEs with service subscriptions with the network provider. A small cell, such as a femto cell, would also generally cover a relatively small geographic area (e.g., a home) and, in addition to unrestricted access, may also provide restricted access by UEs having an association with the femto cell (e.g., UEs in a closed subscriber group (CSG) , UEs for users in the home, and the like) . A base station for a macro cell may be referred to as a macro base station. A base station for a small cell may be referred to as a small cell base station, a pico base station, a femto base station or a home base station. In the example shown in FIG. 1,

base stations

105d and 105e may correspond to regular macro base stations, while base stations 105a-105c may correspond to macro base stations enabled with one of 3 dimension (3D) , full dimension (FD) , or massive MIMO. In some examples, base stations 105a-105c take advantage of their higher dimension MIMO capabilities to exploit 3D beamforming in both elevation and azimuth beamforming to increase coverage and capacity. Base station 105f may correspond to a small cell base station which may be a home node or portable access point. A base station may support one or multiple (e.g., two, three, four, and the like) cells.

Wireless network 100 may support synchronous or asynchronous operation. For synchronous operation, the base stations may have similar frame timing, and transmissions from different base stations may be approximately aligned in time. For asynchronous operation, the base stations may have different frame timing, and transmissions from different base stations may not be aligned in time. In some scenarios, networks may be enabled or configured to handle dynamic switching between synchronous or asynchronous operations.

UEs 115 are dispersed throughout the wireless network 100, and each UE may be stationary or mobile. It should be appreciated that, although a mobile apparatus is commonly referred to as user equipment (UE) in standards and specifications promulgated by the 3rd Generation Partnership Project (3GPP) , such apparatus may also be referred to by those skilled in the art as a mobile station (MS) , a subscriber station, a mobile unit, a subscriber unit, a wireless unit, a remote unit, a mobile device, a wireless device, a wireless communications device, a remote device, a mobile subscriber station, an access terminal (AT) , a mobile terminal, a wireless terminal, a remote terminal, a handset, a terminal, a user agent, a mobile client, a client, a gaming device, an augmented reality device, vehicular component device/module, or some other suitable terminology. Within the present document, a “mobile” apparatus or UE need not necessarily have a capability to move, and may be stationary. Some non-limiting examples of a UE 115 may include a mobile phone, a cellular (cell) phone, a smart phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a laptop, a personal computer (PC) , a notebook, a netbook, a smart book, a tablet, and a personal digital assistant (PDA) . A mobile apparatus may additionally be an “Internet of things” (IoT) or “Internet of everything” (IoE) device such as an automotive or other transportation vehicle, a satellite radio, a global positioning system (GPS) device, a logistics controller, a drone, a multi-copter, a quad-copter, a smart energy or security device, a solar panel or solar array, municipal lighting, water, or other infrastructure; industrial automation and enterprise devices; consumer and wearable devices, such as eyewear, a wearable camera, a smart watch, a health or fitness tracker, a mammal implantable device, gesture tracking device, medical device, a digital audio player (e.g., MP3 player) , a camera, a game console, etc. ; and digital home or smart home devices such as a home audio, video, and multimedia device, an appliance, a sensor, a vending machine, intelligent lighting, a home security system, a smart meter, etc. In one aspect, a UE may be a device that includes a Universal Integrated Circuit Card (UICC) . In another aspect, a UE may be a device that does not include a UICC. In some aspects, UEs that do not include UICCs may also be referred to as IoE devices. UEs 115a-115d of FIG. 1 are examples of mobile smart phone-type devices accessing wireless network 100. A UE may also be a machine specifically configured for connected communication, including machine type communication (MTC) , enhanced MTC (eMTC) , narrowband IoT (NB-IoT) and the like. UEs 115e-115k illustrated in FIG. 1 are examples of various machines configured for communication that access wireless network 100.

A mobile apparatus, such as UEs 115, may be able to communicate with any type of the base stations, whether macro base stations, pico base stations, femto base stations, relays, and the like. In FIG. 1, a lightning bolt (e.g., communication link) indicates wireless transmissions between a UE and a serving base station, which is a base station designated to serve the UE on the downlink and/or uplink, or desired transmission between base stations, and backhaul transmissions between base stations. UEs may operate as base stations or other network nodes in some scenarios. Backhaul communication between base stations of wireless network 100 may occur using wired and/or wireless communication links.

In operation at wireless network 100, base stations 105a-105c serve

UEs

115a and 115b using 3D beamforming and coordinated spatial techniques, such as coordinated multipoint (CoMP) or multi-connectivity. Macro base station 105d performs backhaul communications with base stations 105a-105c, as well as small cell, base station 105f. Macro base station 105d also transmits multicast services which are subscribed to and received by

UEs

115c and 115d. Such multicast services may include mobile television or stream video, or may include other services for providing community information, such as weather emergencies or alerts, such as Amber alerts or gray alerts.

Wireless network 100 may support mission critical communications with ultra-reliable and redundant links for mission critical devices, such as UE 115e, which is a drone. Redundant communication links with UE 115e include from

macro base stations

105d and 105e, as well as small cell base station 105f. Other machine type devices, such as UE 115f (thermometer) , UE 115g (smart meter) , and UE 115h (wearable device) may communicate through wireless network 100 either directly with base stations, such as small cell base station 105f, and macro base station 105e, or in multi-hop configurations by communicating with another user device which relays its information to the network, such as UE 115f communicating temperature measurement information to the smart meter, UE 115g, which is then reported to the network through small cell base station 105f. Wireless network 100 may also provide additional network efficiency through dynamic, low-latency TDD/FDD communications, such as in a vehicle-to-vehicle (V2V) mesh network between UEs 115i-115k communicating with macro base station 105e.

FIG. 2 shows a block diagram of a design of a base station 105 and a UE 115, which may be any of the base stations and one of the UEs in FIG. 1. For a restricted association scenario (as mentioned above) , base station 105 may be small cell base station 105f in FIG. 1, and UE 115 may be UE 115c or 115D operating in a service area of base station 105f, which in order to access small cell base station 105f, would be included in a list of accessible UEs for small cell base station 105f. Base station 105 may also be a base station of some other type. As shown in FIG. 2, base station 105 may be equipped with antennas 234a through 234t, and UE 115 may be equipped with antennas 252a through 252r for facilitating wireless communications.

At the base station 105, a transmit processor 220 may receive data from a data source 212 and control information from a controller/processor 240. The control information may be for the physical broadcast channel (PBCH) , physical control format indicator channel (PCFICH) , physical hybrid-ARQ (automatic repeat request) indicator channel (PHICH) , physical downlink control channel (PDCCH) , enhanced physical downlink control channel (EPDCCH) , MTC physical downlink control channel (MPDCCH) , etc. The data may be for the PDSCH, etc. The transmit processor 220 may process (e.g., encode and symbol map) the data and control information to obtain data symbols and control symbols, respectively. The transmit processor 220 may also generate reference symbols, e.g., for the primary synchronization signal (PSS) and secondary synchronization signal (SSS) , and cell-specific reference signal. Transmit (TX) multiple-input multiple-output (MIMO) processor 230 may perform spatial processing (e.g., precoding) on the data symbols, the control symbols, and/or the reference symbols, if applicable, and may provide output symbol streams to modulators (MODs) 232a through 232t. Each modulator 232 may process a respective output symbol stream (e.g., for OFDM, etc. ) to obtain an output sample stream. Each modulator 232 may additionally or alternatively process (e.g., convert to analog, amplify, filter, and upconvert) the output sample stream to obtain a downlink signal. Downlink signals from modulators 232a through 232t may be transmitted via the antennas 234a through 234t, respectively.

At the UE 115, the antennas 252a through 252r may receive the downlink signals from the base station 105 and may provide received signals to the demodulators (DEMODs) 254a through 254r, respectively. Each demodulator 254 may condition (e.g., filter, amplify, downconvert, and digitize) a respective received signal to obtain input samples. Each demodulator 254 may further process the input samples (e.g., for OFDM, etc. ) to obtain received symbols. MIMO detector 256 may obtain received symbols from demodulators 254a through 254r, perform MIMO detection on the received symbols if applicable, and provide detected symbols. Receive processor 258 may process (e.g., demodulate, deinterleave, and decode) the detected symbols, provide decoded data for the UE 115 to a data sink 260, and provide decoded control information to a controller/processor 280.

On the uplink, at the UE 115, a transmit processor 264 may receive and process data (e.g., for the physical uplink shared channel (PUSCH) ) from a data source 262 and control information (e.g., for the physical uplink control channel (PUCCH) ) from the controller/processor 280. Transmit processor 264 may also generate reference symbols for a reference signal. The symbols from the transmit processor 264 may be precoded by TX MIMO processor 266 if applicable, further processed by the modulators 254a through 254r (e.g., for SC-FDM, etc. ) , and transmitted to the base station 105. At base station 105, the uplink signals from UE 115 may be received by antennas 234, processed by demodulators 232, detected by MIMO detector 236 if applicable, and further processed by receive processor 238 to obtain decoded data and control information sent by UE 115. Processor 238 may provide the decoded data to data sink 239 and the decoded control information to controller/processor 240.

Controllers/

processors

240 and 280 may direct the operation at base station 105 and UE 115, respectively. Controller/processor 240 and/or other processors and modules at base station 105 and/or controller/processor 280 and/or other processors and modules at UE 115 may perform or direct the execution of various processes for the techniques described herein, such as to perform or direct one or more operations of FIG. 5 and/or other processes for the techniques described herein.

Memories

242 and 282 may store data and program codes for base station 105 and UE 115, respectively. Scheduler 244 may schedule UEs for data transmission on the downlink and/or uplink.

Wireless communications systems operated by different network operating entities (e.g., network operators) may share spectrum. In some instances, a network operating entity may be configured to use an entirety of a designated shared spectrum for at least a period of time before another network operating entity uses the entirety of the designated shared spectrum for a different period of time. Thus, in order to allow network operating entities use of the full designated shared spectrum, and in order to mitigate interfering communications between the different network operating entities, certain resources (e.g., time) may be partitioned and allocated to the different network operating entities for certain types of communication.

For example, a network operating entity may be allocated certain time resources reserved for exclusive communication by the network operating entity using the entirety of the shared spectrum. The network operating entity may also be allocated other time resources where the entity is given priority over other network operating entities to communicate using the shared spectrum. These time resources, prioritized for use by the network operating entity, may be utilized by other network operating entities on an opportunistic basis if the prioritized network operating entity does not utilize the resources. Additional time resources may be allocated for any network operator to use on an opportunistic basis.

Access to the shared spectrum and the arbitration of time resources among different network operating entities may be centrally controlled by a separate entity, autonomously determined by a predefined arbitration scheme, or dynamically determined based on interactions between wireless nodes of the network operators.

In some cases, UE 115 and base station 105 may operate in a shared radio frequency spectrum band, which may include licensed or unlicensed (e.g., contention-based) frequency spectrum. In an unlicensed frequency portion of the shared radio frequency spectrum band, UEs 115 or base stations 105 may traditionally perform a medium-sensing procedure to contend for access to the frequency spectrum. For example, UE 115 or base station 105 may perform a listen before talk (LBT) procedure such as a clear channel assessment (CCA) prior to communicating in order to determine whether the shared channel is available. A CCA may include an energy detection procedure to determine whether there are any other active transmissions. For example, a device may infer that a change in a received signal strength indicator (RSSI) of a power meter indicates that a channel is occupied. Specifically, signal power that is concentrated in a certain bandwidth and exceeds a predetermined noise floor may indicate another wireless transmitter. A CCA also may include detection of specific sequences that indicate use of the channel. For example, another device may transmit a specific preamble prior to transmitting a data sequence. In some cases, an LBT procedure may include a wireless node adjusting its own backoff window based on the amount of energy detected on a channel and/or the acknowledge/negative-acknowledge (ACK/NACK) feedback for its own transmitted packets as a proxy for collisions.

Referring to FIG. 3, an illustrative example of a wireless communication system is depicted and generally designated 300. The wireless communication system 300 includes multiple base stations, such as a first base station (e.g., the base station 105a) and a second base station (e.g., the base station 105b) . The wireless communication system 300 may further include a public land mobile network (PLMN) device 302.

In some examples, the base station 105a and the base station 105b are associated with a common wireless communication protocol. In some implementations, the common wireless communication protocol is a fourth-generation long term evolution (4G LTE) wireless communication protocol.

The PLMN device 302 may be associated with a wireless communication protocol that is different than the wireless communication protocol associated with the base station 105a and the base station 105b. To illustrate, the PLMN device 302 may be associated with a second generation (2G) wireless communication protocol, a third generation (3G) wireless communication protocol, or a wideband code-division multiple access (WCDMA) wireless communication protocol, as illustrative examples.

The wireless communication system 300 further includes the UE 115. FIG. 3 illustrates that the UE 115 includes one or more processors (e.g., the controller/processor 280) and one or more memories (e.g., the memory 282) coupled to the one or more processors. In some implementations, the UE 115 further includes a timer 360, a counter 370, and one or more subscriber identity module (SIM) cards, such as a SIM card 380.

During operation, the UE 115 may receive a first message 306. The first message 306 indicates a first message authentication code for integrity (MAC-I) 308 and further indicates a source of the first message 306 as the base station 105a. For example, in some implementations, a source field or a cell identification field of the first message 306 indicates the base station 105a. In some examples, a message (such as the first message 306) includes a source indication 310 specifying a source (or an alleged source) of the message. In one example, the source indication 310 includes a cell global identity (CGI) identifier of the base station 105a.

In some examples, the UE 115 receives the first message 306 from the base station 105a. In some other circumstances, the UE 115 may receive the first message 306 from an entity “spoofing” the first message 306, such as from a malicious entity, such as a hacker attempting to gain authorized access to a network or a device.

To further illustrate, in some examples, the UE 115 is configured to perform a network access stratum (NAS) security mode control procedure with base stations, such as the base station 105a. During the NAS security mode control procedure, the UE 115 may send to the base station 105a a request, such as an attach request or a tracking area update (TAU) request. The first message 306 may include a security mode command that is sent by the base station 105a in response to the request sent by the UE 115.

During the NAS security mode control procedure, the UE 115 may initiate a MAC-I verification procedure to verify the first message 306 based on the first MAC-I 308. To illustrate, the UE 115 may determine (e.g., compute) a second MAC-I 330. The second MAC-I 330 may correspond to a computed MAC-I (X-MAC) . The UE 115 may determine the second MAC-I 330 based on one or more input parameters, such as a one or more parameters of the first message 306, a key, one or more other parameters, or a combination thereof.

The UE 115 is configure to compare the first MAC-I 308 to the second MAC-I 330 to determine whether the first MAC-I 308 corresponds to (e.g., matches) the second MAC-I 330 or whether the first MAC-I 308 differs from (e.g., mismatches) the second MAC-I 330. In response to determining that the first MAC-I 308 corresponds to the second MAC-I 330, the UE 115 may verify integrity of the first message 306, such as by determining that the first message 306 was sent by the base station 105a.

Alternatively, in some other examples, in response to determining that the first MAC-I 308 differs from the second MAC-I 330, the UE 115 may fail to verify integrity of the first message 306. In this case, the first message 306 may be sent by a malicious entity, such as a hacker attempting to gain authorized access to a network or a device. In some implementations, the UE 115 may request, from the base station 105a, one or more additional MAC-Is. For each of the one or more additional MAC-Is, the UE 115 may compare the MAC-I to another MAC-I (e.g., an X-MAC, such as the second MAC-I 330, or another MAC-I) computed by the UE 115 to attempt to identify a match between a MAC-I provided by the base station 105a and a MAC-I determined by the UE 115.

In some examples, the UE 115 is configured to initiate operation of the counter 370 in response to detecting that the second MAC-I 330 differs from the first MAC-I 308. For example, the UE 115 may initiate a counting operation to a threshold counter value 338. In some implementations, the UE 115 adjusts (e.g., increases) a value 372 of the counter 370 in response to each detected MAC-I mismatch. The UE 115 may be configured to terminate attempts to identify a MAC-I match in response identifying that the value 372 of the counter 370 satisfies (e.g., is greater than, or is greater than or equal to) the threshold counter value 338.

In connection with some aspects of the disclosure, the UE 115 is configured to add an indication 344 of the base station 105a to control information 340 stored by the UE device. In one example, the UE 115 is configured to add the indication 344 to the control information 340 in response to detecting that the value 372 of the counter 370 satisfies the threshold counter value 338. In some examples, the indication 344 includes cell identification information of a message, such as the source indication 310 of the first message 306. The source indication 310 may include a CGI identifier of the base station 105a, as an illustrative example. The UE 115 may be configured to reset the value 372 of the counter 370 in response to adding the indication 344 to the control information 340.

In some implementations, the control information 340 includes a list 342 of cells barred by the UE 115 due to detection of MAC-I mismatch conditions associated with the cells. In this example, the indication 344 may specify that the base station 105a corresponds to a cell barred by the UE 115 due to detecting one or more MAC-I mismatch conditions associated with the base station 105a.

In accordance with some aspects of the disclosure, the UE device 115 is configured to access the control information 340 to identify a second base station for camping, such as the base station 105b. To illustrate, in response to detecting that the value 372 of the counter 370 satisfies the threshold counter value 338, the UE 115 may terminate attempting to identify a MAC-I match with the base station 105a and may perform a search to identify one or more other neighbor cells for camping. In one example, performing the search may include receiving a control message 312 from the base station 105b. In some examples, the control message 312 includes one or more of a master information block (MIB) associated with the base station 105b, a system information block (SIB) associated with the base station 105b, or a synchronization signal block (SSB) associated with the base station 105b, as illustrative examples.

In some cases, the UE 115 may determine, based on the control message 312, that the base station 105b is a candidate for camping. In some examples, the UE 115 determines that the base station 105b is a candidate for camping based on a received signal strength of the control message 312 satisfying a threshold signal strength, based on capability information indicated by the control message 312 satisfying threshold capability parameters, one or more other criteria, or a combination thereof.

In response to identifying the that base station 105b is a candidate for camping, the UE 115 may access the control information 340 to determine whether the base station 105b is indicated in the list 342 of cells barred by the UE 115. In one example, the UE 115 is configured to search the list 342 to detect whether the list 342 includes the source indication 318.

If the UE 115 determines that the list 342 includes an indication of the base station 105b, the UE 115 may decline to initiate a connection setup procedure with the base station 105b. The UE 115 may identify one or more other base stations as candidates for camping, such as the base station 105c (e.g., in response to receiving a control message from the base station 105c) . In this example, the UE 115 may access the list 342 to determine whether the list 342 includes an indication of the base station 105c.

Alternatively, if the UE 115 determines that the list 342 includes an indication of the base station 105b, the UE 115 may initiate a connection setup procedure with the base station 105b. In some implementations, the connection setup procedure with the base station 105b may include one or more operations described with reference to the NAS security mode control procedure with the base station 105b, such as a MAC-I verification procedure. For example, the UE 115 may receive, from the base station 105b, a second message 314. In the second message 314 may indicate a third MAC-I 316 and a source indication 318 (e.g., a CGI identifier) of the base station 105b.

In some cases, the UE 115 may detect failure of the MAC-I verification procedure with the base station 105b (e.g., due to a MAC-I mismatch condition between the third MAC-I 316 and a fourth MAC-I 332 computed by the UE 115) . In this case, the UE 115 may add an indication of the base station 105b (e.g., the source indication 318, such as a CGI identifier of the base station 105b) to the list 342 and may identify one or more other candidate base stations for camping. Alternatively, upon success of the MAC-I verification procedure, the UE 115 may complete the NAS security mode control procedure with the base station 105b, which may include receiving an attachment acceptance message or a TAU acceptance message from the base station 105, as illustrative examples. In some examples, after completing the NAS the NAS security mode control procedure with the base station 105b, the UE 115 may communicate data or other messages with the base station 105b using a wireless communication protocol.

In some examples, the base station 105b is selected prior to completion of a MAC-I verification procedure associated with the base station 105a. To illustrate, a wireless communication protocol may specify that the MAC-I verification procedure is to be attempted for a particular duration. The wireless communication protocol may specify that if the MAC-I verification procedure has not succeeded by the end of the particular duration, then the UE 115 is to “fall back” to another device, such as the PLMN device 302. Thus, in some wireless communication protocols, completion of the MAC-I verification procedure may be associated selection of PLMN device for camping, such as the PLMN device 302. In some examples, the PLMN device 302 may be associated with reduced capabilities (e.g., lower data rates or less robust network security features) as compared to the base stations 105a-c. In accordance with some aspects of the disclosure, selecting the base station 105b prior to completion of the MAC-I verification procedure enables the UE 115 to avoid selecting the PLMN device 302 for camping.

In some implementations, the UE 115 is configured to delete (e.g., erase, overwrite, or invalidate) one or more entries of the control information 340. In some examples, the UE 115 is configured to maintain the list 342 on a first-in, first-out (FIFO) basis. For example, to add the indication 344 to the list 342, the UE 115 may replace a least-recently added entry of the list 342 with the indication 344. In other examples, the UE 115 may use one or more other techniques to manage the list 342, such as by overwriting entries of the list 342 on a least-frequently used (LFU) basis. For example, to add the indication 344 to the list 342, the UE 115 may replace a least-frequently accessed entry of the list 342 with the indication 344.

Alternatively or in addition, the UE 115 may be configured to detect a trigger event and to delete one or more entries of the control information 340 in response to detecting the trigger event. Upon detection of the trigger event, the UE 115 may delete one or more entries of the control information 340, such as by deleting the one or more entries on a FIFO basis or on a LFU basis, as illustrative examples. In some other implementations, the UE 115 is configured to clear the control information 340 upon detecting the trigger event (e.g., by deleting all entries of the list 342) .

In one example, the trigger event corresponds to expiration of the timer 360. For example, the UE 115 may be configured reset a value 362 of the timer 360 in response to updating the control information 340 (e.g., in response to adding the indication 344 to the list 342) and to initiate a counting operation to a threshold timer value 336. The UE 115 may be configured to detect the trigger event by detecting that the value 362 of the timer 360 satisfies the threshold timer value 336. The UE 115 may be configured to delete one or more entries of the control information 340 in response to detecting that the value 362 of the timer 360 satisfies the threshold timer value 336. In a non-limiting example, the threshold timer value 336 may correspond to a duration of six hours. In other examples, the threshold timer value 336 may correspond to another duration.

Alternatively or in addition, the trigger event may correspond to detection of a power-cycle event of the UE device 115. To illustrate, in some examples, the memory 282 includes a non-volatile memory configured to store the control information 340, and the UE 115 is configured to delete the control information 340 from the non-volatile memory in response to detecting the power-cycle. In another example, the memory 282 includes volatile memory configured to store the control information 340, and the UE 115 is configured to delete the control information 340 from the volatile memory in response to detecting the power-cycle.

Alternatively or in addition, the trigger event may correspond to detection of removal or insertion of the SIM card 380 of the UE device 115. To illustrate, the controller/processor 280 may be configured to detect removal or insertion of the SIM card 380 and to delete one or more entries of the control information 340 in response to detecting removal or insertion of the SIM card 380.

In some aspects of the disclosure, the UE 115 is configured to execute instructions 350 of a wireless communication protocol stack. For example, the memory 282 may be configured to store the instructions 350 of the wireless communication protocol stack, and the controller/processor 280 may be configured to retrieve the instructions 350 of the wireless communication protocol stack and to execute the instructions 350 of the wireless communication protocol stack to communicate with one or more devices described herein, such as the base stations 105a-c.

In some examples, the wireless communication protocol stack includes multiple layers, such as a first layer (e.g., an NAS layer) and a second layer (e.g., a radio resource control (RRC) layer) . The instructions 350 of the wireless communication protocol stack may include instructions 352 associated with the first layer and instructions 354 associated with the second layer. As described further with reference to FIG. 4, execution of the instructions 352 may be associated with some operations, and execution of the instructions 354 may be associated with other operations.

In some aspects of the disclosure, certain operations described herein are performed based on a particular mode of the UE 115. For example, the UE 115 may be configured to perform certain operations of FIG. 3 while operating according to a non-standalone (NSA) 5G NR mode of operation and to omit certain operations of FIG. 3 while operating according to a standalone (SA) 5G NR mode of operation. In some examples, a MAC-I mismatch condition during the NSA 5G NR mode of operation is associated with larger delays and more instances of interrupted connectivity (e.g., an out-of-service (OOS) state) as compared to the SA 5G NR mode. Accordingly, in some examples, the UE 115 is configured to perform base station reselection in response to detection of a MAC-I mismatch while in the NSA 5G NR mode and to decline to perform base station reselection in response to detection of a MAC-I mismatch while in the SA 5G NR mode.

One or more aspects described with reference to FIG. 3 may improve performance or security of a wireless communication system 300. For example, by barring a cell and reselecting another cell using the control information 340 in response to a MAC-I mismatch condition, performance and security of the UE 115 may be improved as compared to other techniques. To further illustrate, the UE 115 may reduce or avoid an OOS state associated with techniques that repeat a MAC-I verification procedure until a “time out” event. As another example, the UE 115 may remain connected to a base station (e.g., the base station 105b) associated with a more recent wireless communication protocol, such as a fourth generation (4G) or a fifth generation (5G) wireless communication protocol (e.g., instead of “falling back” to the PLMN device 302, which may be associated with a 2G or a 3G wireless communication protocol) . In some cases, a base station that operates in accordance with a more recent wireless communication protocol may be associated with faster data rates and increased security as compared to a base station that operates in accordance with a less recent wireless communication protocol. Accordingly, performance and security may be enhanced.

FIG. 4 depicts an example of a ladder diagram illustrating examples of operations 400 that may be performed by a wireless communication system, such as the wireless communication system 300 of FIG. 3. It is noted that the operations 400 are illustrative and are not intended to limit the scope of the disclosure. For example, a process in accordance with the disclosure may include a different number of operations, may include a different type of operations, may include one or more operations not illustrated in FIG. 4, or may exclude one or more operations illustrated in FIG. 4.

In some examples, the operations 400 may be performed by the UE 115, the base station 105a, and the base station 105b. In the example of FIG. 4, some of the operations 400 are described with reference to an NAS layer 452, and some others of the operations 400 are described with reference to an RRC layer 454. In some examples, the NAS layer 452 corresponds to execution of the instructions 352 by the controller/processor 280, and the RRC layer 454 corresponds to execution of the instructions 354 by the controller/processor 280.

The operations 400 may include sending a first request to the base station 105a, at 402. For example, the first request may correspond to an attach request or a TAU request sent by the UE 115 to the base station 105a.

The operations 400 may further include receiving, from the base station 105a, a first response to the first request, at 404. For example, the first response may correspond to the first message 306 of FIG. 3. In some examples, the first response corresponds to a first security mode command associated with an NAS security mode control procedure performed by the UE 115 and the base station 105a. The first response may indicate a MAC-I, such as the first MAC-I 308.

The operations 400 may further include determining whether a MAC-I mismatch has occurred, at 406. For example, the UE 115 may compare a MAC-I indicated by the first response sent by the base station 105a (e.g., the first MAC-I 308) to a MAC-I computed by the UE 115 (e.g., the second MAC-I 330) . In one example, the UE device 115 executes the instructions 352 to detect that the second MAC-I 330 differs from the first MAC-I 308.

In response to failure to detect a MAC-I mismatch, the operations 400 may further include sending a security mode completion message, at 442, and receiving an acceptance message, at 444. In one example, the acceptance message includes an attachment acceptance message. In another example, the acceptance message includes a TAU acceptance message. The operations 400 may end, at 446.

Alternatively, in response to detecting a MAC-I mismatch, the UE 115 may send a security mode rejection message, at 408. The security mode rejection message may indicate the MAC-I mismatch. In some implementations, the UE 115 may optionally re-request a MAC-I from the base station 105a one or more times. In this case, the UE 115 may re-determine (at 406) whether a MAC-I mismatch has occurred one or more times.

The operations 400 may further include detecting whether a threshold counter value is satisfied, at 410. To illustrate, in some examples, the UE 115 is configured to adjust the value 372 of the counter 370 in response to each detected MAC-I mismatch and may detect whether the adjusted value 372 satisfies the threshold counter value 338. In response to failure to detect that the threshold counter value is satisfied, the operations 400 may continue, at 418.

Alternatively, in response to detecting that the threshold counter value is satisfied, the operations 400 may further include generating a request, at 412. For example, execution of the instructions 352 may generate a request to update the control information 340 to indicate the base station 105a.

The operations 400 may further include performing an update operation, at 414. For example, execution of the instructions 354 may cause the UE 115 to update the control information 340 by adding the indication 344 of the base station 105a to the list 342.

The operations 400 may further include generating confirmation of the update operation, at 416. For example, execution of the instructions 354 may cause the UE 115 to generate confirmation of updating the control information 340 to indicate the base station 105a.

The operations 400 may further include detecting expiration of a second timer, at 418. In some examples, the second timer is associated with a wireless communication protocol, such as a 3GPP wireless communication protocol. In the example illustrated in FIG. 4, the second timer corresponds to a T3410 timer indicated by a 3GPP wireless communication protocol or a T3430 timer indicated by a 3GPP wireless communication protocol. Expiration of the T3410 timer or the T3430 timer may indicate that a threshold amount of time has expired since sending the first request, at 402. In some examples, the T3430 timer has a duration of approximately 15 seconds.

The operations 400 may further include generating an RRC connection release request, at 422. For example, in response to expiration of the second timer, the UE 115 may execute the instructions 352 to provide the RRC connection release request to the RRC layer 454.

The operations 400 may further include performing a cell reselection and camping operation, at 424. For example, the UE 115 may execute the instructions 354 to send one or more configuration messages (e.g., one or more RRC messages) to the base station 105a, to the base station 105b, to one or more other devices, or a combination thereof. The one or more configuration messages may indicate deselection of the base station 105a for camping and selection of the base station 105b for camping.

The operations 400 may further include generating a system information indication, at 426. For example, the UE 115 may execute the instructions 354 to provide the system information indication to the NAS layer 452 to indicate selection of the base station 105b for camping.

The operations 400 may further include detecting expiration of a third timer, at 428. In some examples, the third timer is associated with a wireless communication protocol, such as a 3GPP wireless communication protocol. In the example illustrated in FIG. 4, the third timer corresponds to a T3411 timer indicated by a 3GPP wireless communication protocol. Expiration of the T3411 timer may indicate a failure event associated with sending the first request, at 402. For example, expiration of the T3411 timer may indicate attachment failure or tracking area updating failure. In some implementations, the T3411 timer has a duration of approximately 10 seconds.

The operations 400 may further include sending a second request to the base station 105b, at 430. For example, the second request may correspond to an attach request or a TAU request sent by the UE 115 to the base station 105b.

The operations 400 may further include receiving, from the base station 105b, a second response to the second request, at 432. For example, the second response may correspond to the second message 314 of FIG. 3. In some examples, the second response corresponds to a second security mode command associated with an NAS security mode control procedure performed by the UE 115 and the base station 105b. The second response may indicate a MAC-I, such as the third MAC-I 316.

The operations 400 may further include detecting a MAC-I match condition, at 434. For example, the UE 115 may compare a MAC-I indicated by the first response sent by the base station 105a (e.g., the first MAC-I 308) to a MAC-I computed by the UE 115 (e.g., the fourth MAC-I 332) . In one example, the UE device 115 executes the instructions 352 to detect the MAC-I match condition, such as by detecting that the third MAC-I 316 corresponds to the fourth MAC-I 332.

The operations 400 may further include sending, to the base station 105b, a security mode completion message, at 436. For example, the UE 115 may send the security mode completion message in response to detecting the MAC-I match condition, at 434.

The operations 400 may further include receiving an acceptance message, at 438. In one example, the acceptance message includes an attachment acceptance message. In another example, the acceptance message includes a TAU acceptance message. The operations 400 may end, at 440.

One or more aspects described with reference to FIG. 4 may improve performance or security of a wireless communication system. For example, by barring a cell and reselecting another cell in response to a MAC-I mismatch condition, performance and security of a UE 115 may be improved as compared to other techniques. To further illustrate, the UE 115 may reduce or avoid an OOS state associated with techniques that repeat a MAC-I verification procedure until a “time out” event. As another example, the UE 115 may remain connected to a base station (e.g., the base station 105b) associated with a more recent wireless communication protocol, such as a fourth generation (4G) or a fifth generation (5G) wireless communication protocol (e.g., instead of “falling back” to the PLMN device 302, which may be associated with a 2G or a 3G wireless communication protocol) . In some cases, a base station that operates in accordance with a more recent wireless communication protocol may be associated with faster data rates and increased security as compared to a base station that operates in accordance with a less recent wireless communication protocol. Accordingly, performance and security may be enhanced.

FIG. 5 is a flow chart illustrating an example of a method 500 of wireless communication. In some implementations, operations of the method 500 are performed by a UE device, such as the UE 115, to perform base station reselection in response to detection of a MAC-I mismatch condition according to some aspects of the present disclosure.

The method 500 includes receiving, by a UE device, a message indicating a first MAC-I and further indicating a first base station as a source of the message, at 502. For example, the UE 115 may receive, from the base station 105a, the first message 306 indicating the first MAC-I 308 and the source indication 310.

The method 500 may further include determining, by the UE device, a second MAC-I. For example, the UE 115 may determine the second MAC-I 330.

The method 500 further includes, in response to detecting that the first MAC-I differs from the second MAC-I, adding an indication of the first base station to control information stored by the UE device, at 504. For example, the UE 115 may detect that the first MAC-I 308 differs from the second MAC-I 330 and may add an indication (e.g., the source indication 310) of the base station 105a to the control information 340.

The method 500 further includes selecting a second base station for camping based at least in part on the control information, at 506. For example, the UE 115 may identify the base station 105b based on the control message 312 and further based on a determination that the base station 105b is not indicated by the control information 340 (e.g., that the source indication 318 is not included in the list 342) .

FIG. 6 is a block diagram illustrating UE 115 configured according to one aspect of the present disclosure. UE 115 includes the structure, hardware, and components as illustrated for UE 115 of FIG. 2. For example, UE 115 includes controller/processor 280, which operates to execute logic or computer instructions stored in memory 282, as well as controlling the components of UE 115 that provide the features and functionality of UE 115. UE 115, under control of controller/processor 280, transmits and receives signals via wireless radios 600a-r and antennas 252a-r. Wireless radios 600a-r include various components and hardware illustrated in FIG. 2, including modulator/demodulators 254a-r, MIMO detector 256, receive processor 258, transmit processor 264, and TX MIMO processor 266.

The memory 282 is configured to store instructions executable by the controller/processor 280 to perform, initiate, or control one or more operations described herein. To illustrate, in FIG. 6, the memory 282 stores MAC-I computation instructions 601 executable by the controller/processor 280 to determine one or more MAC-I values, such as the second MAC-I 330 and the fourth MAC-I 332. As another example, the memory 282 stores comparison instructions 602 executable by the controller/processor 280 to compare MAC-I values (e.g., to detect a MAC-I match or a MAC-I mismatch) , such as to compare the first MAC-I 308 to the second MAC-I 330, to compare the third MAC-I 316 to the fourth MAC-I 332, or both.

FIG. 6 also illustrates that the memory 282 may be configured to store list access instructions 603 executable by the controller/processor 280 to access the list 342 (e.g., to search the list 342 for the source indication 310, for the source indication 318, or for other indications of the

base stations

105a, 105b) . The memory 282 may be configured to store list update instructions 604 executable by the controller/processor 280 to update the list 342 (e.g., to add the indication 344 of the base station 105a to the list 342) .

In a first aspect, a method of wireless communication includes: receiving, by a user equipment (UE) device, a message indicating a first message authentication code for integrity (MAC-I) and further indicating a first base station as a source of the message; in response to detecting that the first MAC-I differs from a second MAC-I determined by the UE device, adding an indication of the first base station to control information stored by the UE device; and selecting a second base station for camping based at least in part on the control information.

In a second aspect, the method further includes initiating operation of a counter in response to detecting that the second MAC-I differs from the first MAC-I, and the UE device accesses the control information to identify the second base station in response to detecting that a value of the counter satisfies a threshold counter value.

In a third aspect, the control information indicates a list of cells barred by the UE device due to detecting MAC-I mismatch conditions associated with the cells.

In a fourth aspect, the method further includes receiving a control message from the second base station; determining, based on the control message, that the second base station is a candidate for camping; and accessing the control information to determine that the second base station is not indicated in the list of cells.

In a fifth aspect, the second base station is selected prior to completion of a MAC-I verification procedure with the first base station.

In a sixth aspect, completion of the MAC-I verification procedure is associated with selection of a public land mobile network (PLMN) device for camping, and selecting the second base station prior to completion of the MAC-I verification procedure enables the UE device to avoid selecting the PLMN device for camping.

In a seventh aspect, the first base station and the second base station are associated with a common wireless communication protocol.

In an eighth aspect, the common wireless communication protocol is a fourth-generation long term evolution (4G LTE) wireless communication protocol.

In a ninth aspect, the method further includes detecting a trigger event; and in response to detecting the trigger event, deleting one or more entries of the control information.

In a tenth aspect, detecting the trigger event includes detecting that a value of a timer satisfies a threshold timer value.

In an eleventh aspect, detecting the trigger event includes detecting a power-cycle event of the UE device.

In a twelfth aspect, detecting the trigger event includes detecting removal or insertion of a subscriber identity module (SIM) card of the UE device.

In a thirteenth aspect, the UE device executes instructions of a wireless communication protocol stack that includes a first layer and a second layer.

In a fourteenth aspect, the UE device executes instructions associated with the first layer to detect that the second MAC-I differs from the first MAC-I.

In a fifteenth aspect, the method further includes executing instructions of the first layer to generate a request to update the control information to indicate the first base station.

In a sixteenth aspect, the method further includes executing instructions of the second layer to generate confirmation of updating the control information to indicate the first base station.

In a seventeenth aspect, the first layer includes a non-access stratum (NAS) layer, and wherein the second layer includes a radio resource control (RRC) layer.

In an eighteenth aspect, a method is in accordance with any combination of the first through seventeenth aspects.

In a nineteenth aspect, an apparatus includes a memory; and one or more processors coupled to the memory and configured to: receive, at a user equipment (UE) device, a message indicating a first message authentication code for integrity (MAC-I) and further indicating a first base station as a source of the message; in response to detecting that the first MAC-I differs from a second MAC-I determined by the UE device, add an indication of the first base station to control information stored by the UE device; and select a second base station for camping based at least in part on the control information.

In a twentieth aspect, the one or more processors are further configured to initiate operation of a counter in response to detecting that the second MAC-I differs from the first MAC-I and to access the control information to identify the second base station in response to detecting that a value of the counter satisfies a threshold counter value.

In a twenty-first aspect, the control information indicates a list of cells barred by the UE device due to detecting MAC-I mismatch conditions associated with the cells.

In a twenty-second aspect, the one or more processors are further configured to: receive a control message from the second base station; determine, based on the control message, that the second base station is a candidate for camping; and access the control information to determine that the second base station is not indicated in the list of cells.

In a twenty-third aspect, the one or more processors are further configured to select the second base station prior to completion of a MAC-I verification procedure with the first base station.

In a twenty-fourth aspect, completion of the MAC-I verification procedure is associated with selection of a public land mobile network (PLMN) device for camping, and the one or more processors are further configured to select the second base station prior to completion of the MAC-I verification procedure to enable the UE device to avoid selecting the PLMN device for camping.

In a twenty-fifth aspect, the first base station and the second base station are associated with a common wireless communication protocol.

In a twenty-sixth aspect, the common wireless communication protocol is a fourth-generation long term evolution (4G LTE) wireless communication protocol.

In a twenty-seventh aspect, the one or more processors are further configured to: detect a trigger event; and in response to detecting the trigger event, delete one or more entries of the control information.

In a twenty-eighth aspect, the one or more processors are further configured to detect the trigger event by detecting that a value of a timer satisfies a threshold timer value.

In a twenty-ninth aspect, the one or more processors are further configured to detect the trigger event by detecting a power-cycle event of the UE device.

In a thirtieth aspect, the one or more processors are further configured to detect the trigger event by detecting removal or insertion of a subscriber identity module (SIM) card of the UE device.

In a thirty-first aspect, the one or more processors are further configured to execute instructions of a wireless communication protocol stack that includes a first layer and a second layer.

In a thirty-second aspect, the one or more processors are further configured to execute instructions associated with the first layer to detect that the second MAC-I differs from the first MAC-I.

In a thirty-third aspect, the one or more processors are further configured to execute instructions of the first layer to generate a request to update the control information to indicate the first base station.

In a thirty-fourth aspect, the one or more processors are further configured to execute instructions of the second layer to generate confirmation of updating the control information to indicate the first base station.

In a thirty-fifth aspect, the first layer includes a non-access stratum (NAS) layer, and wherein the second layer includes a radio resource control (RRC) layer.

In a thirty-sixth aspect, an apparatus is in accordance with any combination of the nineteenth through thirty-fifth aspects.

In a thirty-seventh aspect, a non-transitory computer-readable medium stores instructions executable by a processor to perform operations, the operations comprising: receiving, by a user equipment (UE) device, a message indicating a first message authentication code for integrity (MAC-I) and further indicating a first base station as a source of the message; in response to detecting that the first MAC-I differs from a second MAC-I determined by the UE device, adding an indication of the first base station to control information stored by the UE device; and selecting a second base station for camping based at least in part on the control information.

In a thirty-eighth aspect, the operations further include initiating operation of a counter in response to detecting that the second MAC-I differs from the first MAC-I, and wherein the UE device accesses the control information to identify the second base station in response to detecting that a value of the counter satisfies a threshold counter value.

In a thirty-ninth aspect, the control information indicates a list of cells barred by the UE device due to detecting MAC-I mismatch conditions associated with the cells.

In a fortieth aspect, the operations further include: receiving a control message from the second base station; determining, based on the control message, that the second base station is a candidate for camping; and accessing the control information to determine that the second base station is not indicated in the list of cells.

In a forty-first aspect, the second base station is selected prior to completion of a MAC-I verification procedure with the first base station.

In a forty-second aspect, completion of the MAC-I verification procedure is associated with selection of a public land mobile network (PLMN) device for camping, and selecting the second base station prior to completion of the MAC-I verification procedure enables the UE device to avoid selecting the PLMN device for camping.

In a forty-third aspect, the first base station and the second base station are associated with a common wireless communication protocol.

In a forty-fourth aspect, the common wireless communication protocol is a fourth-generation long term evolution (4G LTE) wireless communication protocol.

In a forty-fifth aspect, the operations further include: detecting a trigger event; and in response to detecting the trigger event, deleting one or more entries of the control information.

In a forty-sixth aspect, detecting the trigger event includes detecting that a value of a timer satisfies a threshold timer value.

In a forty-seventh aspect, detecting the trigger event includes detecting a power-cycle event of the UE device.

In a forty-eighth aspect, detecting the trigger event includes detecting removal or insertion of a subscriber identity module (SIM) card of the UE device.

In a forty-ninth aspect, the UE device executes instructions of a wireless communication protocol stack that includes a first layer and a second layer.

In a fiftieth aspect, the UE device executes instructions associated with the first layer to detect that the second MAC-I differs from the first MAC-I.

In a fifty-first aspect, the operations further include executing instructions of the first layer to generate a request to update the control information to indicate the first base station.

In a fifty-second aspect, the operations further include executing instructions of the second layer to generate confirmation of updating the control information to indicate the first base station.

In a fifty-third aspect, the first layer includes a non-access stratum (NAS) layer, and wherein the second layer includes a radio resource control (RRC) layer.

In a fifty-fourth aspect, a non-transitory computer-readable medium is in accordance with any combination of the thirty-seventh through fifty-third aspects.

In a fifty-fifth aspect, an apparatus for wireless communication includes means for storing instructions; and means for executing the instructions to receive, at a user equipment (UE) device, a message indicating a first message authentication code for integrity (MAC-I) and further indicating a first base station as a source of the message to add, in response to detecting that the first MAC-I differs from a second MAC-I determined by the UE device, an indication of the first base station to control information stored by the UE device, and to select a second base station for camping based at least in part on the control information.

In a fifty-sixth aspect, the means for executing is further configured to initiate operation of a counter in response to detecting that the second MAC-I differs from the first MAC-I and to access the control information to identify the second base station in response to detecting that a value of the counter satisfies a threshold counter value.

In a fifty-seventh aspect, the control information indicates a list of cells barred by the UE device due to detecting MAC-I mismatch conditions associated with the cells.

In a fifty-eighth aspect, the means for executing is further configured to: receive a control message from the second base station; determine, based on the control message, that the second base station is a candidate for camping; and access the control information to determine that the second base station is not indicated in the list of cells.

In a fifty-ninth aspect, the means for executing is further configured to select the second base station prior to completion of a MAC-I verification procedure with the first base station.

In a sixtieth aspect, completion of the MAC-I verification procedure is associated with selection of a public land mobile network (PLMN) device for camping, and the means for executing is further configured to select the second base station prior to completion of the MAC-I verification procedure to enable the UE device to avoid selecting the PLMN device for camping.

In a sixty-first aspect, the first base station and the second base station are associated with a common wireless communication protocol.

In a sixty-second aspect, the common wireless communication protocol is a fourth-generation long term evolution (4G LTE) wireless communication protocol.

In a sixty-third aspect, the means for executing is further configured to: detect a trigger event; and in response to detecting the trigger event, delete one or more entries of the control information.

In a sixty-fourth aspect, the means for executing is further configured to detect the trigger event by detecting that a value of a timer satisfies a threshold timer value.

In a sixty-fifth aspect, the means for executing is further configured to detect the trigger event by detecting a power-cycle event of the UE device.

In a sixty-sixth aspect, the means for executing is further configured to detect the trigger event by detecting removal or insertion of a subscriber identity module (SIM) card of the UE device.

In a sixty-seventh aspect, the means for executing is further configured to execute instructions of a wireless communication protocol stack that includes a first layer and a second layer.

In a sixty-eighth aspect, the means for executing is further configured to execute instructions associated with the first layer to detect that the second MAC-I differs from the first MAC-I.

In a sixty-ninth aspect, the means for executing is further configured to execute instructions of the first layer to generate a request to update the control information to indicate the first base station.

In a seventieth aspect, the means for executing is further configured to execute instructions of the second layer to generate confirmation of updating the control information to indicate the first base station.

In a seventy-first aspect, the first layer includes a non-access stratum (NAS) layer, and wherein the second layer includes a radio resource control (RRC) layer.

In a seventy-second aspect, an apparatus is in accordance with any combination of the fifty-fifth through seventy-first aspects.

Those of skill in the art would understand that information and signals may be represented using any of a variety of different technologies and techniques. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referenced throughout the above description may be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof.

The functional blocks and modules described herein (e.g., the functional blocks and modules in FIG. 2) may comprise processors, electronics devices, hardware devices, electronics components, logical circuits, memories, software codes, firmware codes, etc., or any combination thereof. In addition, one or more features described with reference to FIGS. 1-6 may be implemented via specialized processor circuitry, via executable instructions, and/or combinations thereof.

Those of skill would further appreciate that the various illustrative logical blocks, modules, circuits, and operations (e.g., the logical blocks in FIG. 5) described in connection with the disclosure herein may be implemented as electronic hardware, computer software, or combinations of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and operations have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present disclosure. Skilled artisans will also readily recognize that the order or combination of components, methods, or interactions that are described herein are merely examples and that the components, methods, or interactions of the various aspects of the present disclosure may be combined or performed in ways other than those illustrated and described herein.

The various illustrative logical blocks, modules, and circuits described in connection with the disclosure herein may be implemented or performed with a general-purpose processor, a digital signal processor (DSP) , an application specific integrated circuit (ASIC) , a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general-purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.

The operations of a method or process described in connection with the disclosure herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor. The processor and the storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In the alternative, the processor and the storage medium may reside as discrete components in a user terminal.

In one or more exemplary designs, the functions described may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. Computer-readable storage media may be any available media that can be accessed by a general purpose or special purpose computer. By way of example, and not limitation, such computer-readable media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code means in the form of instructions or data structures and that can be accessed by a general-purpose or special-purpose computer, or a general-purpose or special-purpose processor. Also, a connection may be properly termed a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, or digital subscriber line (DSL) , then the coaxial cable, fiber optic cable, twisted pair, or DSL, are included in the definition of medium. Disk and disc, as used herein, includes compact disc (CD) , laser disc, optical disc, digital versatile disc (DVD) , hard disk, solid state disk, and blu-ray disc where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above should also be included within the scope of computer-readable media.

As used herein, including in the claims, the term “and/or, ” when used in a list of two or more items, means that any one of the listed items can be employed by itself, or any combination of two or more of the listed items can be employed. For example, if a composition is described as containing components A, B, and/or C, the composition can contain A alone; B alone; C alone; A and B in combination; A and C in combination; B and C in combination; or A, B, and C in combination. Also, as used herein, including in the claims, “or” as used in a list of items prefaced by “at least one of” indicates a disjunctive list such that, for example, a list of “at least one of A, B, or C” means A or B or C or AB or AC or BC or ABC (i.e., A and B and C) or any of these in any combination thereof.

The previous description of the disclosure is provided to enable any person skilled in the art to make or use the disclosure. Various modifications to the disclosure will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other variations without departing from the spirit or scope of the disclosure. Thus, the disclosure is not intended to be limited to the examples and designs described herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

A method of wireless communication, comprising:

receiving, by a user equipment (UE) device, a message indicating a first message authentication code for integrity (MAC-I) and further indicating a first base station as a source of the message;

in response to detecting that the first MAC-I differs from a second MAC-I determined by the UE device, adding an indication of the first base station to control information stored by the UE device; and

selecting a second base station for camping based at least in part on the control information.
The method of claim 1, further including initiating operation of a counter in response to detecting that the second MAC-I differs from the first MAC-I, wherein the UE device accesses the control information to identify the second base station in response to detecting that a value of the counter satisfies a threshold counter value.
The method of claim 1, wherein the control information indicates a list of cells barred by the UE device due to detecting MAC-I mismatch conditions associated with the cells.
The method of claim 3, further including:

receiving a control message from the second base station;

determining, based on the control message, that the second base station is a candidate for camping; and

accessing the control information to determine that the second base station is not indicated in the list of cells.
The method of claim 1, wherein the second base station is selected prior to completion of a MAC-I verification procedure with the first base station.
The method of claim 5, wherein completion of the MAC-I verification procedure is associated with selection of a public land mobile network (PLMN) device for camping, and wherein selecting the second base station prior to completion of the MAC-I verification procedure enables the UE device to avoid selecting the PLMN device for camping.
The method of claim 1, wherein the first base station and the second base station are associated with a common wireless communication protocol.
The method of claim 7, wherein the common wireless communication protocol is a fourth-generation long term evolution (4G LTE) wireless communication protocol.
The method of claim 1, further including:

detecting a trigger event; and

in response to detecting the trigger event, deleting one or more entries of the control information.
The method of claim 9, wherein detecting the trigger event includes detecting that a value of a timer satisfies a threshold timer value.
The method of claim 9, wherein detecting the trigger event includes detecting a power-cycle event of the UE device.
The method of claim 9, wherein detecting the trigger event includes detecting removal or insertion of a subscriber identity module (SIM) card of the UE device.
The method of claim 1, wherein the UE device executes instructions of a wireless communication protocol stack that includes a first layer and a second layer.
The method of claim 13, wherein the UE device executes instructions associated with the first layer to detect that the second MAC-I differs from the first MAC-I.
The method of claim 13, further including executing instructions of the first layer to generate a request to update the control information to indicate the first base station.
The method of claim 13, further including executing instructions of the second layer to generate confirmation of updating the control information to indicate the first base station.
The method of claim 13, wherein the first layer includes a non-access stratum (NAS) layer, and wherein the second layer includes a radio resource control (RRC) layer.
The method of any combination of claims 1-17.
An apparatus comprising:

a memory; and

one or more processors coupled to the memory and configured to:

receive, at a user equipment (UE) device, a message indicating a first message authentication code for integrity (MAC-I) and further indicating a first base station as a source of the message;

in response to detecting that the first MAC-I differs from a second MAC-I determined by the UE device, add an indication of the first base station to control information stored by the UE device; and

select a second base station for camping based at least in part on the control information.
The apparatus of claim 19, wherein the one or more processors are further configured to initiate operation of a counter in response to detecting that the second MAC-I differs from the first MAC-I and to access the control information to identify the second base station in response to detecting that a value of the counter satisfies a threshold counter value.
The apparatus of claim 19, wherein the control information indicates a list of cells barred by the UE device due to detecting MAC-I mismatch conditions associated with the cells.
The apparatus of claim 21, wherein the one or more processors are further configured to:

receive a control message from the second base station;

determine, based on the control message, that the second base station is a candidate for camping; and

access the control information to determine that the second base station is not indicated in the list of cells.
The apparatus of claim 19, wherein the one or more processors are further configured to select the second base station prior to completion of a MAC-I verification procedure with the first base station.
The apparatus of claim 23, wherein completion of the MAC-I verification procedure is associated with selection of a public land mobile network (PLMN) device for camping, and wherein the one or more processors are further configured to select the second base station prior to completion of the MAC-I verification procedure to enable the UE device to avoid selecting the PLMN device for camping.
The apparatus of claim 19, wherein the first base station and the second base station are associated with a common wireless communication protocol.
The apparatus of claim 25, wherein the common wireless communication protocol is a fourth-generation long term evolution (4G LTE) wireless communication protocol.
The apparatus of claim 19, wherein the one or more processors are further configured to:

detect a trigger event; and

in response to detecting the trigger event, delete one or more entries of the control information.
The apparatus of claim 27, wherein the one or more processors are further configured to detect the trigger event by detecting that a value of a timer satisfies a threshold timer value.
The apparatus of claim 27, wherein the one or more processors are further configured to detect the trigger event by detecting a power-cycle event of the UE device.
The apparatus of claim 27, wherein the one or more processors are further configured to detect the trigger event by detecting removal or insertion of a subscriber identity module (SIM) card of the UE device.
The apparatus of claim 19, wherein the one or more processors are further configured to execute instructions of a wireless communication protocol stack that includes a first layer and a second layer.
The apparatus of claim 31, wherein the one or more processors are further configured to execute instructions associated with the first layer to detect that the second MAC-I differs from the first MAC-I.
The apparatus of claim 31, wherein the one or more processors are further configured to execute instructions of the first layer to generate a request to update the control information to indicate the first base station.
The apparatus of claim 31, wherein the one or more processors are further configured to execute instructions of the second layer to generate confirmation of updating the control information to indicate the first base station.
The apparatus of claim 31, wherein the first layer includes a non-access stratum (NAS) layer, and wherein the second layer includes a radio resource control (RRC) layer.
The apparatus of any combination of claims 19-35.
A non-transitory computer-readable medium storing instructions executable by a processor to perform operations, the operations comprising:

receiving, by a user equipment (UE) device, a message indicating a first message authentication code for integrity (MAC-I) and further indicating a first base station as a source of the message;

in response to detecting that the first MAC-I differs from a second MAC-I determined by the UE device, adding an indication of the first base station to control information stored by the UE device; and

selecting a second base station for camping based at least in part on the control information.
The non-transitory computer-readable medium of claim 37, wherein the operations further include initiating operation of a counter in response to detecting that the second MAC-I differs from the first MAC-I, and wherein the UE device accesses the control information to identify the second base station in response to detecting that a value of the counter satisfies a threshold counter value.
The non-transitory computer-readable medium of claim 37, wherein the control information indicates a list of cells barred by the UE device due to detecting MAC-I mismatch conditions associated with the cells.
The non-transitory computer-readable medium of claim 39, wherein the operations further include:

receiving a control message from the second base station;

determining, based on the control message, that the second base station is a candidate for camping; and

accessing the control information to determine that the second base station is not indicated in the list of cells.
The non-transitory computer-readable medium of claim 37, wherein the second base station is selected prior to completion of a MAC-I verification procedure with the first base station.
The non-transitory computer-readable medium of claim 41, wherein completion of the MAC-I verification procedure is associated with selection of a public land mobile network (PLMN) device for camping, and wherein selecting the second base station prior to completion of the MAC-I verification procedure enables the UE device to avoid selecting the PLMN device for camping.
The non-transitory computer-readable medium of claim 37, wherein the first base station and the second base station are associated with a common wireless communication protocol.
The non-transitory computer-readable medium of claim 43, wherein the common wireless communication protocol is a fourth-generation long term evolution (4G LTE) wireless communication protocol.
The non-transitory computer-readable medium of claim 37, wherein the operations further include:

detecting a trigger event; and

in response to detecting the trigger event, deleting one or more entries of the control information.
The non-transitory computer-readable medium of claim 45, wherein detecting the trigger event includes detecting that a value of a timer satisfies a threshold timer value.
The non-transitory computer-readable medium of claim 45, wherein detecting the trigger event includes detecting a power-cycle event of the UE device.
The non-transitory computer-readable medium of claim 45, wherein detecting the trigger event includes detecting removal or insertion of a subscriber identity module (SIM) card of the UE device.
The non-transitory computer-readable medium of claim 37, wherein the UE device executes instructions of a wireless communication protocol stack that includes a first layer and a second layer.
The non-transitory computer-readable medium of claim 49, wherein the UE device executes instructions associated with the first layer to detect that the second MAC-I differs from the first MAC-I.
The non-transitory computer-readable medium of claim 49, wherein the operations further include executing instructions of the first layer to generate a request to update the control information to indicate the first base station.
The non-transitory computer-readable medium of claim 49, wherein the operations further include executing instructions of the second layer to generate confirmation of updating the control information to indicate the first base station.
The non-transitory computer-readable medium of claim 49, wherein the first layer includes a non-access stratum (NAS) layer, and wherein the second layer includes a radio resource control (RRC) layer.
The non-transitory computer-readable medium of any combination of claims 37-53.
An apparatus for wireless communication, the apparatus comprising:

means for storing instructions; and

means for executing the instructions to receive, at a user equipment (UE) device, a message indicating a first message authentication code for integrity (MAC-I) and further indicating a first base station as a source of the message to add, in response to detecting that the first MAC-I differs from a second MAC-I determined by the UE device, an indication of the first base station to control information stored by the UE device, and to select a second base station for camping based at least in part on the control information.
The apparatus of claim 55, wherein the means for executing is further configured to initiate operation of a counter in response to detecting that the second MAC-I differs from the first MAC-I and to access the control information to identify the second base station in response to detecting that a value of the counter satisfies a threshold counter value.
The apparatus of claim 55, wherein the control information indicates a list of cells barred by the UE device due to detecting MAC-I mismatch conditions associated with the cells.
The apparatus of claim 57, wherein the means for executing is further configured to:

receive a control message from the second base station;

determine, based on the control message, that the second base station is a candidate for camping; and

access the control information to determine that the second base station is not indicated in the list of cells.
The apparatus of claim 55, wherein the means for executing is further configured to select the second base station prior to completion of a MAC-I verification procedure with the first base station.
The apparatus of claim 59, wherein completion of the MAC-I verification procedure is associated with selection of a public land mobile network (PLMN) device for camping, and wherein the means for executing is further configured to select the second base station prior to completion of the MAC-I verification procedure to enable the UE device to avoid selecting the PLMN device for camping.
The apparatus of claim 55, wherein the first base station and the second base station are associated with a common wireless communication protocol.
The apparatus of claim 61, wherein the common wireless communication protocol is a fourth-generation long term evolution (4G LTE) wireless communication protocol.
The apparatus of claim 55, wherein the means for executing is further configured to:

detect a trigger event; and

in response to detecting the trigger event, delete one or more entries of the control information.
The apparatus of claim 63, wherein the means for executing is further configured to detect the trigger event by detecting that a value of a timer satisfies a threshold timer value.
The apparatus of claim 63, wherein the means for executing is further configured to detect the trigger event by detecting a power-cycle event of the UE device.
The apparatus of claim 63, wherein the means for executing is further configured to detect the trigger event by detecting removal or insertion of a subscriber identity module (SIM) card of the UE device.
The apparatus of claim 55, wherein the means for executing is further configured to execute instructions of a wireless communication protocol stack that includes a first layer and a second layer.
The apparatus of claim 67, wherein the means for executing is further configured to execute instructions associated with the first layer to detect that the second MAC-I differs from the first MAC-I.
The apparatus of claim 67, wherein the means for executing is further configured to execute instructions of the first layer to generate a request to update the control information to indicate the first base station.
The apparatus of claim 67, wherein the means for executing is further configured to execute instructions of the second layer to generate confirmation of updating the control information to indicate the first base station.
The apparatus of claim 67, wherein the first layer includes a non-access stratum (NAS) layer, and wherein the second layer includes a radio resource control (RRC) layer.
The apparatus of any combination of claims 55-71.