 base stations and subscriber's stations. Encryption is always applied to the MAC PDU payload while the generic MAC header is not encrypted. The privacy employs an authenticated client/server key management protocol in which the BS acts as a server and controls the distribution of the IEEE WiMAX PDU (SFID CID) MAC Connections (QoS parameters) PDU (SFID CID) Serviceflows Service flowID: SFID ConnectionID: Direction: UL bandwidth request mechanism QoS parameters Figure 4.3 Mobile WiMAX QoS support. Reproduced from C 2006 WiMAX [5] keying material to client SS. The privacy mechanisms are more strengthened by adding EAP (Extensible Authentication Protocol) or X.509 digital-certificate-based SS authentication to the key management protocol (PKM). The PKM also uses RSA (Rivest, Shamir, Adelman) public-key encryption standards to further strengthen the key exchange process between the BS and the SS. Overall privacy has two component protocols and these are: An encapsulation protocol for encrypting packet data across the broadband network. This protocol defines (1) a set of supported cryptographic suites and (2) the rules for applying those algorithms to a MAC PDU payload. A cryptographic suite is the security association's2 2 set of methods for data encryption, data authentication, and traffic encryption key exchange. The suite includes algorithms such as DES (Data Encryption Standard), RSA and AES (Advanced Encryption Standard). A PKM provides secure distribution of keying data from BS to SS. Through this key management protocol, SS and BS synchronize keying data and BS via PKM enforces conditional access to network services. 4.2.1.4 QoS Support QoS is provided via service flows which is the transport service of MAC layer (Figure 4.3). A service flow provides unidirectional transport of data packets in both downlink and uplink. It is characterized by a set of QoS parameters that are negotiated between SS and BS during connection setup and can be dynamically adjusted according to service requirement. These parameters in