) Within the MS and BS, the security functions are classified into two logical categories: (1) a security management entity; and (2) encryption and integrity. The security management entity includes the following functions [2,3]: Overall security management; Extensible Authentication Protocol (EAP) encapsulation/de-encapsulation for authentication; PKM control functions through key generation/derivation/distribution, and key state management; Authentication and Security Association (SA) control; Location privacy. Encryption and integrity protection entity consists of the following functions: User data encryption/authentication; Management message authentication; Protection of management message confidentiality. 8.2 AUTHENTICATION The authentication of user and device identities is conducted between the MS and BS entities using EAP. The choice of EAP methods and selection of credentials that are used during EAP-based authentication are outside the scope of the IEEE 802.16m standard. The authentication is performed during initial network entry following basic capability negotiation. The security capabilities and policies are negotiated in the authentication, authorization, and key exchange stage. The re-authen- tication is performed before expiration of authentication materials/credentials. The data transmission may continue during the reauthentication process by providing the MS with two sets of authentication and keying material with overlapping lifetimes. The authentication procedure is controlled by the authorization state machine, which defines the operations in each state [2,3]. 8.3 KEY MANAGEMENT PROTOCOL (PKMv3) The IEEE 802.16m uses a newer version of the PKM protocol known as PKMv3 to perform key management. The legacy standard key management procedures are based on PKMv2 [1,6]. Trans- parent exchange of authentication and authorization messages, key agreement, and security context exchange are among the services provided by PKMv3. The PKMv3 protocol provides mutual authentication and establishes a shared