Section: W.4.1.3 User-plane procedure
Content: The UE registers to the MBS service and receives the MBS traffic as specified in TS 33.246[ 3G Security; Security of Multimedia Broadcast/Multicast Service (MBMS) ]  [102] with the following changes. - MBSSF takes the role of the BM-SC in TS 33.246[ 3G Security; Security of Multimedia Broadcast/Multicast Service (MBMS) ]  [102]. - The UE authenticates to the MBSSF (i.e. MBSF or MBSTF) based on the GBA as in MBMS security (see TS 33.246[ 3G Security; Security of Multimedia Broadcast/Multicast Service (MBMS) ]  [102]) or based on the AKMA (see TS 33.535[ Authentication and Key Management for Applications (AKMA) based on 3GPP credentials in the 5G System (5GS) ]  [104]). When the AKMA is used, the MRK is derived from the KAF as specified in Annex F of TS 33.246[ 3G Security; Security of Multimedia Broadcast/Multicast Service (MBMS) ]  [102] by replacing the Ks_NAF for the GBA_ME run with KAF. Furthermore, when the AKMA is used, the MUK is set to KAF. When the authorization of MBS service to the UE is required, the user id (e.g., GPSI) provided to the MBSSF by the AAnF shall be used. NOTE a: Void - The identifier(s) of MBS user service(s) in TS 26.502[ 5G multicast-broadcast services; User service architecture ] [108] is included in local configuration in MBSSF or in UDM as part of MBS subscription data for a UE, which identifies the user service(s) that the UE is allowed to join. After receiving the HTTP POST message (see clause 6.3.2 of TS 33.246[ 3G Security; Security of Multimedia Broadcast/Multicast Service (MBMS) ]  [102]) that] includes the identifier(s) of MBS user service(s), MBSSF shall authorize the UE based on local configuration if available. If no local configuration is available, the MBSSF should send verification request with user id (e.g., IMPI in GBA or GPSI in AKMA) and identifier(s) of MBS user service(s) to UDM to acquire the authorization result. If the UE is authorized, the MBSSF registers the UE to the MBS user service(s). NOTE: the local configuration in MBSSF may be preconfigured or provided by AF.