according to the rules defined in reference [2]. The use of an PEH header for ARQ-enabled connections is similar to that for non-ARQ connections. It is up to the transmitting side to decide whether to pack a group of MAC SDUs and/or fragments in a single MAC PDU. The sequence number of the PEH header is used by the ARQ protocol to identify and re-transmit ARQ blocks. When transmitting a MAC PDU on a connection that is mapped to a security association, the sender performs encryption and data authentication on the MAC PDU payload as specified by that security association. When receiving a MAC PDU on a connection mapped to a security association, the receiver performs decryption and data authentication functions on the MAC PDU, as specified by that security association. The AGMH and the extended headers are not encrypted. The receiver determines whether the payload in the MAC PDU is encrypted based on the Flow ID in the AGMH or MAC PDU Extended Headers Transport Connection Payload with Security (Transport Connection FID) (Optional) Information Transport Connection Payload Encrypted MAC PDU with Single Transport Connection Payload MAC PDU Extended Headers (Transport Transport Connection Payloads with Security Information (Optional) Connection FID) Transport Connection Payloads Encrypted Payload Payload Payload MAC PDU with Multiple Transport Connection Payloads FIGURE 7-15 MAC PDU with single/multiple (authenticated and encrypted using AES-CCM) transport connection payload(s) [1,2] CHAPTER 7 The IEEE 802. 16m MAC CPS (Part II) SPMH. The encryption information required to decrypt a payload at the receiving entity is present at the beginning and at the end of the connection payload. As an example, the AES CCM, Packet Number (PN), and Encryption Key Sequence (EKS) are prefixed at the beginning of the payload and an Integrity Check Value (ICV) is suffixed to the end of the in MAC PDU, as shown in Figure 7-15. If multiple connection payloads are transmitted in the same burst and the connections are mapped to the same secu