r in the evolved NodeB (eNB), i.e., 3GPP LTE base station, makes handover decisions based on neighbor cell measurements reported by the UE, performs paging of the users over the air interface, broadcasts system information, controls UE measurement and reporting functions such as the periodicity of channel quality indicator reports, and further allocates cell-level temporary identifiers to active users. It also executes transfer of UE context from the serving eNB to the target eNB during handover, and performs integrity protection of RRC messages. The RRC layer is responsible for setting up and maintenance of radio bearers. Note that RRC layer in 3GPP protocol hierarchy is considered as Layer 3. The main services and functions of the RRC sub-layer include [29,30]: Broadcast of system information; Paging; CHAPTER 3 IEEE 802. 16m Reference Model and Protocol Structure Establishment, maintenance, and release of a RRC connection between the UE and E-UTRAN, including allocation of temporary identifiers between UE and E-UTRAN and configuration of signaling radio bearers for RRC connection; Security functions, including key management; Establishment, configuration, maintenance, and release of point-to-point radio bearers; Mobility functions, including UE measurement reporting and control of the reporting for inter-cell and inter-RAT mobility, handover, UE cell selection and reselection, control of cell selection and reselection, context transfer at handover; Establishment, configuration, maintenance, and release of radio bearers for Multimedia Broadcast Multicast Service (MBMS); QoS management functions. The 3GPP LTE RRC consists of the following states: RRC_IDLE is a state where a UE specific Discontinuous Reception (DRX) may be configured by upper layers. In the idle mode, the UE conserves power and does not inform the network of each cell change. The network knows the location of the UE to the granularity of a few cells, called the Tracking Area (TA). The UE monitors a paging channel to detect incoming traffic, perfor