CONTROL-PLANE SIGNALING PROTECTION The MAC management/control messages are selectively protected in IEEE 802. 16m systems, if such capability is enabled during basic capability negotiation. If the selective confidentiality protection is enabled, the negotiated keying materials and cipher suites are used to encrypt MAC management messages. Figure 8-5 illustrates three levels of selective confidentiality protection used for MAC management/control messages in IEEE 802.16m as follows [2]: No protection: if the MS and BS have no shared security context (or protection is not required), the MAC management messages are neither encrypted nor authenticated. The MAC management messages before the authorization phase also fall into this category. "Advanced Encryption Standard in Counter with CBC-MAC mode is a mode of operation of a block cipher that combines the existing Counter (CTR) and CBC-MAC modes. It uses an encryption algorithm to generate encrypted and authenticated data at the same time. The AES-CCM process requires two AES cores. In order to achieve higher throughput, two separate AES cores, one for CBC-MAC and the other for Counter Mode, are developed. In AES CBC-MAC, the first AES core is working in cipher feedback mode. It XORs the new input to previously encrypted data. The core is used to calculate the MIC for the authenticity of data. The process starts with encrypting the first block and then successively XORs subsequent blocks, and encrypts the result. The final MIC is one 128-bit block. Once the first block has been prepared, XORing the current block with the previously encrypted block computes the MIC one block at a time. If the last block is not exactly 128-bit, it is padded with zeros. The final output is one 128-bit block, but the CCM requires only a 64-bit MIC, SO the low order 64-bit of final output is discarded [12]. 8.6 Control-plane signaling protection Convergence Sublayer MAC SDUs MAC SDUs Flow ID = A Flow ID = B Unencrypted Payload A Unencrypted Payload B PN, EKS Encrypted Payload A Encrypted P