acturers X.509 Certificate, issued by an external authority. Authorization Request Sent from an SS to its BS to request an AK and list of authorized SAIDs. Authorization Reply Sent from a BS to an SS to reply an AK and a list of authorized SAIDs Authorization Reject Send from a BS to an SS in rejection of an Authorization Request message sent by the SS. Authorization Invalid Send from a BS to an SS as an unsolicited indication or a response to a message received from that SS. Key Request Sent from an SS to its BS requesting a TEK for the privacy of one of its authorized SAIDs. Key Reply Sent from a BS to an SS carrying the two active sets of traffic keying material for the SAID. Key Reject Sent from a BS to an SS indicating that the SAID is no longer valid and no key will be sent. TEK Invalid Sent from a BS to an SS if it determines that the SS encrypted uplink traffic with an invalid TEK. SA Add Sent from a BS to an SS to establish one or more additional SAs. Legend: PKM, privacy key management; TEK, traffic encryption key; AK, authorization key; SA, security association; SAID, security association identifier. METROPOLITAN AREA NETWORKS State Event or Op Wait Op Reauth Start Rcvd msg Operational Rekey Rekey Wait Reaut Wait Start Start Start Start Start Authorized Op Wait Op Reauth Rekey Reauth Auth Pend Auth Comp Op Wait Rekey Wait Op Wait Op Wait Op Reauth Invalid Timeout Op Wait Rekey Wait Refresh Rekey Wait Timeout Key Reply Operational Operational Start Start Key Reject Figure 13.19 Traffic encryption key(s) - Finite State Machine Transition Matrix. State Event or Reauth Start Auth Wait Authorized Silent Rcvd msg Reject Wait Auth Wait Provisioned Auth Reject Auth Reject Auth Reject (non-perm) Auth Reject Silent Silent (perm) Authorized Authorized Auth Reply Reauth Auth Wait Start Timeout Reauth Auth Grace Timeout Reauth Reauth Auth Invalid Reauth Reauth Figure 13.20 Auth. (security) FSM (finite state machine) transition matrix. operator. There is the possibility to accommodate "root authority" if required. T