3G Americas, 3GPP LTE for TDD Spectrum in the Americas, November 2009. R. Comroe, D. Costello, "ARQ Schemes for Data Transmission in Mobile Radio Systems", IEEE Journal on Selected Areas in Communications Vol. 2 (Issue 4), July 1984. This page intentionally left blank CHAPTER The IEEE 802.16m Security Sub-Layer INTRODUCTION A wireless system uses an intrinsically open and unsecure radio channel for transmission of user signaling and traffic between the base station and mobile stations. As such, reliable and robust security and encryption procedures must be employed in order to protect confidentiality, privacy, and integrity of user traffic and credentials, and to prevent security breaches and theft of service in cellular networks. This chapter describes the security aspects of the IEEE 802. 16m standard. As shown in Figure 8-1 the security sub-layer of IEEE 802.16 is located between the MAC and the physical layers. The security functions provide users with privacy, authentication, and confidentiality by applying cryp- tographic transforms to MAC PDUs transported over the connections between the MS and the BS. In addition, the security sub-layer enables the operators to prevent unauthorized access to data transport services by securing the associated service flows across the network. The security sub-layer employs an authenticated client/server key management protocol in which the BS (the server) controls distri- bution of keying material to the MS (the client). In addition, the basic security mechanisms are reinforced by adding digital-certificate-based MS device-authentication to the key management protocol. If, during capability negotiation, the MS indicates that it does not support the IEEE 802.1 16m security protocols, the authorization and key exchange procedures are skipped and the MS will not be provided with any service (except emergency services). The privacy function has two component protocols: (1) an encapsulation protocol for securing packet data across the network, i.e., a set of cryptographic suite