The WiMAX forum has designed the physical and MAC layers of the mobile WiMAX based on the amendments of the IEEE 802.16e to offer broadband services including voice, data, and video at the metropolitan scale for mobile users. The mobile WiMAX network comprises BSs and subscriber stations (SSs). Each SS is assigned a 48-bit MAC universal address that it used to uniquely identify it toward a BS. Mobile WiMAX uses UL and DL maps to prevent collisions. More specifically, SSs implement the time division multiple access (TDMA) to share the UL while BSs use the time division multiplexing.
UL and DL schedules are exchanged between the BS and the managed SSs in every frame using the UL-MAP and the DL-MAP messages. The MAC layer is connection-oriented; besides, all data communication is associated with a connection. Each connection with its QoS parameters forms a service flow and is identified by a 16-bit connection identifier (CID). MAC layer connections can be compared to TCP connections.
In fact, thanks to TCP, a computer may have simultaneously different active connections for different applications using different ports. With MAC connections, an SS may have many connections to a BS for different services such as network management or user data transport; every connection is characterized by its own bandwidth, security, and priority parameters. When a new SS joins the network, the managing BS assigns to it three CIDs with different QoS requirements used by different management levels which are the basic, the primary, and the secondary management connections. The basic connection enables the transfer of short, time-critical MAC and radio link control messages; the primary management connection is used to transfer larger but more delay-tolerant messages while the secondary management connection is used to transfer standards-based management messages such as DHCP ones. Note that a CID may carry traffic for many different higher-layer sessions. The mobile WiMAX version adapts dynamic modulation and forward error codes to correctly serve the SSs located far from the BS in the rural areas and resists the weather conditions.
Both the BS and the SS can adapt the transmission of the burst profiles by lowering the bandwidth for higher robustness. For instance, the BS always begins by adopting the most robust modulation and forwards error code scheme so that all SSs in the coverage area can correctly receive the DL-MAP and the UL-MAP messages. Meanwhile, an SS may ask its BS to have a longer UL window when needed. The BS and the managed SSs exchange MAC protocol data units (PDUs) carrying MAC management messages or convergence sublayer MAC service data units (MAC SDUs). The MAC PDU has a fixed MAC header, a variable length payload and a cyclic redundancy check (CRC) field. The MAC header may be a generic MAC header (GMH) or a bandwidth request header. The GMH is used to transfer the standard MAC management messages while the bandwidth request header is a header sent without payload to request additional bandwidth.
Both the payload and the CRC fields are optional. It is worth noticing that the MAC header and the MAC management messages are never encrypted to facilitate registration, ranging, and normal operation of the MAC sublayer; however, this decision has opened the door to eavesdropping and other serious attacks. An SS which enters the network may be programmed to register with a certain BS; but generally speaking, it begins by scanning its frequency to detect an operating channel. Scanning consists in listening to each possible frequency until the frame preamble is heard. After detecting that channel, the SS tries to synchronize to the DL transmission by waiting for the DL-MAP stating the map of the timeslot locations in use for the frame. After that, the MS waits for the downlink channel descriptor (DCD) and the uplink channel descriptor (UCD) messages that are periodically broadcasted to specify the modulation and the FEC schemes used on the carrier. After gathering the required information describing the parameters needed for initial ranging transmission, the SS scans the UL-MAP to find an opportunity to perform the ranging. Initial ranging is used to determine the transmit power requirements of the MS to reach the BS. It is worth noticing that each SS should be informed about when to send the ranging request as many SSs may try to join simultaneously the network and highly affect the networks efficiency. Therefore, each new SS will send a ranging request (RNG-REQ) message and wait for the corresponding ranging response (RNG-RSP) message, indicating the timing advance, the power adjustment, and the basic and the primary management CIDs. After correctly determining the timing advance of SS transmissions, the SS and the BS will continue exchanging RNG-REQ and RNG-RSP messages until an acceptable radio link is established. Then, the SS should perform the authentication and the registration processes to enter the network. First, the BS asks the SS for strong authentication. Upon successful authentication, the SS will be able to register to the network. The SS will then establish a secondary management CID to receive secondary messages for different services. For instance, the SS will get an IP address through DHCP and a Trivial File Transfer Protocol (TFTP) address to request configuration files when needed.
QoS is guaranteed thanks to five QoS classes implementing different scheduling mechanisms. Those classes are the unsolicited grant service (UGS), the real-time polling service (rtPS), the extended rtPS (ErtPS), the nonreal-time polling service (nrtPS), and the best effort (BE). UGS fulfils the requirements of real-time communications occurring at periodic intervals such as voice over IP (VoIP); it is given a grant by BS that accommodates the maximum sustained traffic rate of such applications. rtPS uses unicast polling to support periodic real-time variable-size transmissions such as MPEG video streams, but generates more overhead than UGS. ErtPS is a combination of UGS and rtPS; in fact, the bandwidth is allocated without solicitation, but the allocation is done in a dynamic fashion. ErtPS fits well in the case of voice with activity detection like VoIP with silence suppression applications. nrtPS uses unicast polling regularly and allows contention requests to guarantee a minimum data rate for delay-tolerant applications, which generate variable-sized traffic such as FTP. Finally, the BE class guarantees a minimum QoS level for the associated traffic. Therefore, the SSs are never polled individually but are rather permitted to use contention requests and unicast requests.
