Section: 5.3.10.4 User Data and Signalling Confidentiality 5.3.10.4.0 General
Content: There are two different levels of the security associations between the UE and the network. i) RRC and UP security association is between the UE and E-UTRAN. The RRC security associations protect the RRC signalling between the UE and E-UTRAN (integrity protection and ciphering). The UP security association is between the UE and E-UTRAN and can provide user plane encryption and integrity protection. ii) NAS security association is between the UE and the MME. It provides integrity protection and encryption of NAS signalling and, when the Control Plane CIoT EPS Optimisation is used, user data. Some earlier releases of the EPS specifications do not support User Plane Integrity Protection in EPS (EPS-UPIP). Hence UEs that support EPS-UPIP indicate this capability in the security algorithm octets of the UE Network Capability IE as defined in TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [46] and use it as described in TS 33.401[ 3GPP System Architecture Evolution (SAE); Security architecture ]  [41]; and the MME copies this capability into S1-AP signalling sent to the E-UTRAN. The E-UTRAN can be locally configured with a policy (to be used when no explicit EPS UPIP policy is received from the MME), e.g. that the use of EPS-UPIP is "Preferred" for UE(s) that support User Plane Integrity Protection in EPS. For EPC networks with no 5GC interworking, E-UTRAN can have a preconfigured policy for "preferred" User Plane Integrity Protection that can be used if MME does not provide a security policy for the bearers of an UE and if the E-UTRAN has received an indication that the UE supports User Plane Integrity Protection. This preconfigured policy applies to any bearer of any UE unless the MME provides a User Plane Integrity Protection security policy to the E-UTRAN, in which case the MME policy overwrites the preconfigured E-UTRAN policy. Differentiated User plane integrity protection beyond preconfigured policy is only supported for PDN connections served by a SMF+PGW-C: to support PDN connections that "Require" the use of EPS-UPIP, the MME shall select a SMF+PGW-C. NOTE 1: See TS 23.502[ Procedures for the 5G System (5GS) ]  [84] for additional features for EPS-UPIP in case of interworking with 5GC. NOTE 2: In this Release of the specifications, EPS UPIP can only be supported by UEs that support NR-PDCP.