Section: W.4.4 Security handling in network sharing scenario
Content: In Multiple-Operator Core Network (MOCN) network sharing scenarios, if MBS content protection is needed, then the content may be protected at the application layer (c.f., W.4.2). NOTE 1: The content protection mechanism used at the application layer is outside the scope of 3GPP. If service-layer security specified in clause W.4.1.3 of the present document is used in MOCN network sharing scenarios, the AF may be required to generate the MSK, MSK ID, MTK and MTK ID common to the participating PLMNs. The AF provides the generated MSK, MSK ID, MTK and MTK ID to the MBSSF(s) of the participating PLMNs, when creating broadcast MBS sessions and also when key update is required. Furthermore, it is up to the AF to select a MCC and MNC among the PLMNs for the Key Domain ID. As mentioned in clause 6.3.2.1 of TS 33.246[ 3G Security; Security of Multimedia Broadcast/Multicast Service (MBMS) ]  [102], the UE should not try to use the MCC and MNC in another context, e.g., the UE should not compare the received MCC || MNC to parameters in radio level. NOTE 2: Security aspects between the AF and the MBSSF(s) is outside the scope of 3GPP. NOTE 3: If the MBSSF uses MSK and MTK generated by itself to protect the traffic, the resource sharing during network sharing will not be used.