Section: 6.7.4 AS security mode command procedure
Content: The AS SMC procedure is for RRC and UP security algorithms negotiation and RRC security activation. for the gNB/ng-eNB. AS SMC procedure can be triggered to establish a secure RRC signalling-only connection during UE registration or PDU session establishment as specified in TS 38.413[ NG-RAN; NG Application Protocol (NGAP) ]  [34] and TS 23.502[ Procedures for the 5G System (5GS) ]  [8]. The activation of UP security is as described in clause 6.6.2. AS SMC procedure consists of a roundtrip of messages between gNB/ng-eNB and UE. The gNB/ng-eNB sends the AS security mode command to the UE and the UE replies with the AS security mode complete message. See Figure 6.7.4-1. The AS security mode command message sent from gNB/ng-eNB to UE shall contain the selected RRC and UP encryption and integrity algorithms. This AS security mode command message shall be integrity protected with RRC integrity key based on the current KgNB. The AS security mode complete message from UE to gNB/ng-eNB shall be integrity protected with the selected RRC algorithm indicated in the AS security mode command message and RRC integrity key based on the current KgNB. RRC downlink ciphering (encryption) at the gNB/ng-eNB shall start after sending the AS security mode command message. RRC uplink deciphering (decryption) at the gNB/ng-eNB shall start after receiving and successful verification of the AS security mode complete message. RRC uplink ciphering (encryption) at the UE shall start after sending the AS security mode complete message. RRC downlink deciphering (decryption) at the UE shall start after receiving and successful verification of the AS security mode command message. If any control of the AS security mode command is not successful in the UE, the UE shall reply with an unprotected security mode failure message (see TS 38.331[ NR; Radio Resource Control (RRC); Protocol specification ] [22]). Ciphering and integrity protection of UP downlink and uplink, at the UE and the gNB/ng-eNB, shall start as defined by clause 6.6.2. AS SMC shall be used only during an initial context setup between the UE and the gNB/ng-eNB (i.e., to activate an initial KgNB at RRC_IDLE to RRC_CONNECTED state transition). NOTE: Derivation of a KgNB at RRC_IDLE to RRC_CONNECTED state ensures that AS SMC establishes a fresh KgNB. Consequently, the PDCP COUNTs can be reset. Figure 6.7.4-1: AS Security Mode Command Procedure