encryption key KUPenc which is used for all DRBs in the SeNB for the target UE. Furthermore, when the SCG counter approaches its maximum value, the MeNB refreshes the currently active KeNB, before any further S-KeNB is derived [56,57]. 188 Chapter 1 Integral AN-CN CP CP confidentiality CP integrity AN-CN-UP UP confidentiality UP integrity NR Uu CP: Control plane UP: User plane Figure 1.90 5GS security architecture and termination points [54]. Fig. 1.90 shows 5G security architecture including the new security entities: SEAF, AUSF, authentication credential repository and processing function (ARPF), security context man- agement function (SCMF), and security policy control function (SPCF). 5GC has introduced a new security anchor called SEAF, which may be co-located with the AMF. The SEAF will create, for the primary authentication, a unified anchor key KSEAF (common for all access links) that can be used by the UE and the serving network to protect the subsequent communications. It is possible to generate two anchor keys for certain sce- narios where a UE is connected to 3GPP access (visited network) and to a non-3GPP access (home network). For normal roaming scenarios, the SEAF is located in the visited network. The AUSF terminates requests from the SEAF and further interacts with the ARPF. Depending on how the authentication functionality is split, the AUSF and the ARPF may be co-located, but an interface similar to SWx interface is defined for EAP-AKA and EAP- AKA'. The ARPF is co-located with the UDM and stores long-term security credentials such as the key K in EPS AKA or EAP-AKA for authentication. It can run cryptographic algorithms using long-term security credentials as input and can create the authentication vectors. Another new functional entity is the SCMF, which may be co-located with the SEAF in the AMF and retrieve a key from the SEAF, which is used to derive further access network specific keys. The SPCF provides the security policy to the network entities (e.g., SMF, AMF) and/or to the UE dependi