System and method for protecting MAC control messages

1. A method for protecting medium access control (MAC) control messages in a wireless communication network comprising:

determining, by a network device, that a first MAC control message content is protected if an indicator within the first MAC control message content is set;

validating, if the indicator is set, integrity of the first MAC control message content in conjunction with a cipher-message authentication code (CMAC) tuple concatenated with the first MAC control message content, the CMAC tuple comprising a portion of a CMAC value that is truncated to a first predetermined number of most-significant bits of the CMAC value;

locating the CMAC tuple in the MAC control message based on a byte alignment of the CMAC tuple in the MAC control message, wherein a length of the first MAC control message content has been padded to provide byte alignment of the CMAC tuple; and

decoding the MAC control message using the CMAC tuple.

2. The method of claim 1 , wherein first MAC control message content is coupled with padding bits if a packed encoding rule with byte unaligned option is applied.

3. The method of claim 1 , further comprising discarding the first MAC control message content if the validating fails.

4. The method of claim 1 , further comprising determining that the first MAC control message content is not protected if the indicator does not exist.

5. The method of claim 1 , wherein a first payload contains the first MAC control message content and the CMAC tuple, wherein the first payload is not modified prior to extracting the CMAC tuple.

6. The method of claim 1 , wherein a first payload contains the first MAC control message content and the CMAC tuple, wherein the first MAC control message content is to be merged with a second MAC control message content from a second payload if the first MAC control message content and the second MAC control message content are MAC control message fragments.

7. The method of claim 1 , further comprising detecting presence of the indicator or whether the indicator is set or otherwise only if the first MAC control message content is one of the message types including RNG-REQ, PKM-REQ, and PKM-RSP.

8. The method of claim 1 , wherein a first payload comprises the first MAC control message content with the indicator set, wherein a second payload comprises a second MAC control message content without the indicator or with the indicator is clear, wherein the first payload is at least 12 bytes longer than the second payload if the first MAC control message content and the second MAC control message content are of a same length.

9. A method for protecting medium access control (MAC) control messages in a mobile communication network comprising:

setting an indicator within a MAC control message content if the MAC control message content is to be authenticated in conjunction with a cipher-message authentication code (CMAC) tuple;

clearing the indicator if the MAC control message content is not to be authenticated in conjunction with the CMAC tuple;

generating a CMAC value based at least on the MAC control message content; and

generating a first payload comprising the MAC control message content with the indicator and the CMAC tuple which includes a portion of the CMAC value truncated to a first predetermined number of most-significant bits of the CMAC value; and

aligning the CMAC tuple in the MAC control message by padding the MAC control message content if byte alignment is needed, wherein a length of the MAC control message content is padded to provide byte alignment of the CMAC tuple.

10. The method of claim 9 , further comprising dividing the MAC control message content into two or more fragments, wherein the CMAC value is generated based at least on the MAC control message content, wherein the first payload comprises a fragment of the MAC control message content and the CMAC tuple.

11. The method of claim 9 , wherein a second payload comprises a second MAC control message content without the indicator or with the indicator is clear, wherein the first payload is at least N bytes longer than the second payload if the first MAC control message content and the second MAC control message content are of a same length.

12. A network system comprising:

a processor;

a memory coupled to the processor; and

a communication device coupled to the processor to communicate wirelessly over multiple sub-channels in an orthogonal frequency division multiple access (OFDMA) wireless network, wherein the communication device is operable to

determine that a first media access control (MAC) control message content is protected if an indicator within the first MAC control message content is set;

validate, if the indicator is set, integrity of the first MAC control message content in conjunction with a first cipher-message authentication code (CMAC) tuple concatenated with the first MAC control message content, the CMAC tuple comprising a portion of a CMAC value that is truncated to a first predetermined number of most-significant bits of the CMAC value;

locate the CMAC tuple in the MAC control message based on a byte alignment of the CMAC tuple in the MAC control message, wherein a length of the first MAC control message content has been padded to provide byte alignment of the CMAC tuple; and

decode the MAC control message using the CMAC tuple.

13. The system of claim 12 , wherein the communication device is operable to further determine that the first MAC control message content is not to be protected if the indicator does not exist.

14. The system of claim 12 , wherein a first payload comprises the first MAC control message content with the indicator set, wherein a second payload comprises a second MAC control message content without the indicator or with the indicator is clear, wherein the first payload is 12 bytes longer than the second payload if the first MAC control message content and the second MAC control message content are of a same length.

15. The system of claim 12 , wherein the communication device is operable to

set an indicator within a second MAC control message content if the second MAC control message content is to protected in conjunction with a second CMAC tuple;

generate a CMAC value based at least on the second MAC control message content; and

generate a first payload comprising the second MAC control message content with the indicator set and the second CMAC tuple which includes at least a part of the CMAC value.

16. The method of claim 1 , wherein the first predetermined number of most-significant bits comprises 64 bits.

17. The method of claim 16 , further comprising generating the CMAC value based on an encryption of the first MAC control message content.

18. The method of claim 9 , wherein the first predetermined number of most-significant bits comprises 64 bits, and

wherein the CMAC value that is generated based on an encryption of the first MAC control message content comprises 128 bits.

19. The system of claim 12 , wherein the first predetermined number of most-significant bits comprises 64 bits.

20. The system of claim 19 , wherein the communication device is operable to further generate the CMAC value based on an encryption of the first MAC control message content.