Section: 5.4.2 Security mode control procedure 5.4.2.1 General
Content: The purpose of the NAS security mode control procedure is to take a 5G NAS security context into use, and initialise and start NAS signalling security between the UE and the AMF with the corresponding 5G NAS keys and 5G NAS security algorithms. Furthermore, the network may also initiate the security mode control procedure in the following cases: a)- in order to change the 5G NAS security algorithms for a current 5G NAS security context already in use; b) in order to change the value of uplink NAS COUNT used in the latest SECURITY MODE COMPLETE message as described in 3GPP TS 33.501[ Security architecture and procedures for 5G System ]  [24], subclause 6.9.4.4; and c) in order to provide the Selected EPS NAS security algorithms to the UE. For restrictions concerning the concurrent running of a security mode control procedure with other security related procedures in the AS or inside the core network see 3GPP TS 33.501[ Security architecture and procedures for 5G System ]  [24], subclause 6.9.5. If the security mode control procedure is initiated after successful 5G AKA based primary authentication and key agreement procedure and the security mode control procedure intends to bring into use the partial native 5G NAS security context created by the 5G AKA based primary authentication and key agreement procedure and the UE accepts received security mode command (see subclause 5.4.2.3), the ME shall: a) delete the valid KAUSF and the valid KSEAF, if any; and b) consider the new KAUSF to be the valid KAUSF, and the new KSEAF to be the valid KSEAF, reset the SOR counter and the UE parameter update counter to zero, and store the valid KAUSF, the valid KSEAF, the SOR counter and the UE parameter update counter as specified in annex C and use the valid KAUSF in the verification of SOR transparent container and UE parameters update transparent container, if any are received. NOTE: The AMF does not perform a security mode control procedure when the 5G AKA based primary authentication procedure successfully authenticates a 5G ProSe layer-3 remote UE accessing the network via a 5G ProSe layer-3 UE-to-network relay UE served by the AMF.