s and the rules for applying those algorithms to a MAC PDU payload; and (2) a Key Management Protocol (PKM) providing the secure distribution of keying data from the BS to the MS. The MS and the BS can synchronize keying data via the key management protocol. The BS can use protocol to enforce conditional access to network services, as well. In IEEE 802.16m, the encryption of the user data is done after the MAC PDUs are generated. This marks a significant difference between IEEE 802.16n and 3GPP LTE, where the ciphering is per- formed in the PDCP sub-layer and prior to formation of the MAC PDUs. In this chapter the security functions of both standards are described to allow the readers to better understand the similarities and differences of security functions by drawing analogies [3,7-9]. Another important aspect of the IEEE 802.16m security relative to the legacy systems is the encryption of MAC management messages to protect the integrity of Layer 2 messaging and signaling over the air interface [1,2]. 8.1 SECURITY ARCHITECTURE The security architecture of IEEE 802. 16m consists of the MS, the BS, and the Authenticator, as shown in Figure 8-2 [4,5]. Mobile WiMAX. DOI: 10.1016/B978-0-12-374964-2.10008-6 Copyright © 2011 Elsevier Inc. CHAPTER 8 The IEEE 802.16m Security Sub-Layer Network Layer CS SAP Radio Resource Service Specific Control and Convergence Management Sublayer MAC SAP MAC Sublayer Security Sublayer PHY SAP Physical Layer Control Plane Data Plane FIGURE 8-1 Location of the security sub-layer in the IEEE 802.16m protocol stack Extensible Authentication Protocol (Outside the Scope of IEEE 802.16m Specification) Authorization/Security Association Control EAP Encapsulation/De-encapsulation Location Privacy Enhanced Key Management PKM Control Standalone Signaling Header User Data and Management Message Authentication Management Message Authentication Encryption Encryption and Authentication Functions FIGURE 8-2 Functional blocks of IEEE 802.16m security architecture [3] 8.3 Key management protocol (PKMv3