Section: 4.3.2.14.1 PDU session with integrity protection
Content: At 5G-SRVCC from NG-RAN to UTRAN handover of a PDU session for which the "null integrity protection algorithm" 5G-IA0 has not been used (see 3GPP TS 23.216[ Single Radio Voice Call Continuity (SRVCC); Stage 2 ]  [126]), when the MS receives the command to perform handover, the MS shall derive a new KASME_SRVCC from KAMF as specified in 3GPP TS 33.501[ Security architecture and procedures for 5G System ]  [170]. The MS shall set the CKSN of the derived UMTS security context to the value of the eKSI associated with the new KASME_SRVCC and derive security keys CKSRVCC and IKSRVCC from the new KASME_SRVCC as specified in 3GPP TS 33.401[ 3GPP System Architecture Evolution (SAE); Security architecture ]  [123]. The MS shall apply these derived security keys, handle the STARTCS value as specified in 3GPP TS 25.331[ None ]  [23c] and replace an already established UMTS security context for the CS domain, if any, in the USIM, when the 5G-SRVCC handover from NG-RAN to UTRAN has been completed successfully. The network shall replace an already established UMTS security context for the CS domain, if any, when the 5G-SRVCC handover from NG-RAN to UTRAN has been completed successfully. If the 5G-SRVCC handover from NG-RAN to UTRAN has not been completed successfully, the MS and the network shall delete the new derived UMTS security context for the CS domain. Additionally, the network shall delete the already established UMTS security context for the CS domain, if the CKSN of the already established UMTS security context is equal to the CKSN of the new derived UMTS security context for the CS domain.