Section: 6.9.4.3 NAS key refresh
Content: If the AMF determines that NAS key refresh is required due to e.g. uplink or downlink NAS counter in the current security context is about to wrap around or based on a local operator policy to refresh the NAS keys after a certain time, the AMF may trigger a primary authentication run or may derive a new KAMF key using horizontal KAMF derivation upon the reception of an initial NAS message, e.g. a Registration Request or a Service Request using the uplink NAS COUNT value in the initial NAS message as described in clause 6.9.3 for mobility update registration. The AMF resets the corresponding uplink and downlink NAS counters and derive new NAS keys from the new KAMF key and the algorithms in use. The AMF activates the new KAMF key by running a NAS SMC with UE according to clause 6.7.2. When the new KAMF key is horizontally derived, the UE shall use the uplink NAS COUNT value that was sent in the initial NAS message to derive the same KAMF key as the AMF, reset the corresponding uplink and downlink NAS counters and then derive new NAS keys from the KAMF and the algorithms in use. In this case, if AS security is also established between the UE and gNB/ng-eNB, then the AMF and the UE shall derive a new initial KgNB from the new KAMF as specified in Annex A.9. Further, the AMF and the UE shall associate the derived new initial KgNB with a new NCC value equal to zero. Further, the derived new initial KgNB/KeNB is sent by the AMF to the gNB/ng-eNB triggering the gNB/ng-eNB to perform the AS key re-keying as described in clause 6.9.4.4.