 secret between the MS and the BS. The shared secret is then used to exchange or derive other keying material. This two-tiered mechanism allows frequent traffic key refreshing without additional computational complexity. 8.3.1 Key Derivation The PKMv3 key hierarchy defines what keys are present in the system and how keys are generated. The IEEE 802.16m uses one authentication scheme based on EAP; therefore, there is only one primary source of keying material. The key that is used to protect the integrity of control messages is derived from the source keying material generated by authentication/authorization processes. The EAP-based CHAPTER 8 The IEEE 802. 16m Security Sub-Layer authentication process provides the master key. All security keys are derived directly or indirectly from the master key. The master key is the shared key that is derived in the course of executing the EAP functions. The Pair-wise Master Key (PMK) is derived from the master key and is used to derive the Authorization Key (AK). The AK is used to derive other keys, including the Traffic Encryption Key (TEK) and the Cipher-based Message Authentication Code (CMAC) key. After completing the authentication or reauthentication process, key agreement is performed to derive a PMK and an AK to verify the recently created PMK and AK, and to exchange other required security parameters. The PMK is derived by feeding parameters such as the master key, NONCE_MS, NONCE_BS, etc., where NONCE_MS is a random number generated by the MS that is sent to the BS during key agreement, and NONCE_BS is a random number generated by the BS that is sent to the MS during key agreement. After EAP authentication is complete, the MS (requester), AAA, and authenticator hold a 512-bit master key, which is transferred to the authenticator from AAA using EAP attributes, and the BS starts a key agreement three-way handshake to derive a fresh PMK in both MS and authenticator [2]. 8.3.2 Key Exchange The key exchange procedure is controlled by the security key state machine, which