tor, the SA can be selectively applied to management connections. If the MS and the BS decide to use No Authorization as their authorization policy, no security association will be established. In this case, Null SAID is used as the target SAID field in service flow CHAPTER 8 The IEEE 802. 16m Security Sub-Layer creation messages. If authorization is performed but the MS and BS decide to create an unprotected service flow, the Null SAID may be used as the target SAID field in service flow creation messages. 8.5 CRYPTOGRAPHIC METHODS The Advanced Encryption Standard (AES) is a block cipher scheme that can be used in different modes. The IETF RFC 4309 describes the use of the AES in Counter with CBC-MAC (CCM) mode with an explicit Initialization Vector (IV) as an IPsec Encapsulating Security Payload (ESP) mecha- nism to provide confidentiality, data origin authentication, and connectionless integrity [12]. The IEEE 802.16m standard specifies cryptographic algorithms that are used for MAC PDU protection or key encryption/decryption functions. The MS and the BS may support encryption methods and algorithms for secure transmission of MAC PDUs over the air interface. The Advanced Encryption Standard algorithm is the only supported cryptographic method in IEEE 802. 16m. The AES modes specified in IEEE 802.16m are: AES-CCM mode, iii which provides integrity protection, and AES-CTR mode. The AES-CCM mode is supported for unicast transport and management connections and the Packet Number (PN) size is 22 bits. The AES-CTR mode is supported for unicast transport connections and the PN size is 22 bits. When some connections identified by flow identifiers are mapped to the same SA, their payloads can be multiplexed together into one MAC PDU, where the multiplexed payloads are jointly encrypted together. For example, in Figure 8-4, the payloads associated with Flow A and Flow B, which are mapped to the same SA, are jointly encrypted. The MAC header or extended headers provides the details of payloads which are multiplexed. 8.6 