Section: W.4.1 Key derivation, management and distribution W.4.1.1 General
Content: If the security protection of MBS traffic is required, confidentiality and integrity protection as specified in clause 5.3 of TS 33.246[ 3G Security; Security of Multimedia Broadcast/Multicast Service (MBMS) ]  [102] apply. The control-plane procedure and user-plane procedure are optionally supported in service layer. The control-plane procedure is only applicable for multicast sessions, while the user-plane procedure is applicable for both multicast sessions and broadcast sessions. The user plane security between UE and RAN shall be deactivated when 5GC shared MBS traffic delivery method for MBS data transmission is used to avoid redundant protection. The MBS Security Function (MBSSF) is a logical function, which needs to be collocated with either MBSF or MBSTF and the according interfaces are up to the implementation of the deployment options. In case of the control-plane procedure, the key derivation, management and distribution in MBSF and MBSTF can be achieved in MBSSF.