umber. The authentication vector contains a random part, an authenticator part used for authenticating the network to the identity module, an expected result part, a 128-bit session key for integrity check, and a 128-bit session key for encryption [13]. CHAPTER 8 The IEEE 802. 16m Security Sub-Layer level security mode procedure configures NAS security. Both integrity protection and ciphering for RRC are activated within the same AS security mode command procedure, but not necessarily within the same message [7]. The user-plane ciphering is activated at the same time as RRC ciphering. The keys that are stored in the eNBs never leave a secure environment, and user-plane data ciphering/deciphering is conducted within the secure environment where the related keys are stored. Key material for the eNB keys is sent between the eNBs during ECM-CONNECTED intra-E-UTRAN mobility. A sequence number denoted as COUNT is used as an input to ciphering and integrity protection. A given sequence number must only be used once for a given eNB key, except for identical re-transmission on the same radio bearer in the same direction. The same sequence number can be used for both ciphering and integrity protection. A Hyper Frame Number (HFN), i.e., an overflow counter mechanism, is used in the eNB and the UE in order to limit the actual number of sequence number bits that need to be sent over the radio air interface. The HFN is synchronized between the UE and the eNB. If corruption of keys is detected, the UE has to restart the radio level attachment procedure, e.g., a similar radio level procedure for RRC_IDLE to C_CON- NECTED mode transition or initial attachment. Since SIM access is not granted in E-UTRAN, the idle mode UE that is not equipped with USIM cannot attempt to reselect the E-UTRAN. To prevent handover to E-UTRAN, the UE which is not equipped with USIM indicates E-UTRA support in UE capability signaling in other RATs. A simplified key derivation is illustrated in Figure 8-7, where [7-9]: KNASint is a key which is only used