ges exchanged between the mobile and the AMF; - AS security through the 5G-NR radio interface between the mobile and the NG-RAN node. Security concerns the integrity control and encryption of RRC messages and IP packets. Integrity on IP packets is optional. Data integrity: - ensures that the data have not been altered by a third party between transmission and reception; - verifies the transmitting source; - ensures that a message already received is not reused. Encryption ensures the confidentiality of data exchanged between two entities. The security of the NAS and AS messages consists of deriving different keys the level of the mobile and at the level of the following entities (Figure 1.11): - The AMF: - KAMF key; - KNASint key from the KAMF key for the integrity check of the NAS signaling; - KNASenc key from the KAMF key for the encryption of the NAS signaling. - The radio node: - KgNB key from the KAMF key; - KRRCenc key derived from the KgNB key for the encryption of RRC signaling on the 5G-NR interface; - KRRCint key derived from the KgNB key for the integrity check of RRC signaling on the 5G-NR interface; - KUPenc key derived from the KgNB key for encrypting IP traffic on the 5G-NR interface; - optionally, a KUPint key derived from the KgNB key for the integrity check of IP traffic on the 5G-NR interface. NG-RAN Network - Functional Architecture KNASint / KNA Sene Kup per session KUPCAN KNASint / KNAS KUPint/KUPenc NAS Security AS Security Figure 1.11. Security architecture The mobile must support the NAS security based on information transmitted by the 5G core network and AS security, according to the indications sent by the NG-RAN access node. 5G security is based on the use of: - NEA encryption algorithms (Encryption Algorithm for 5G); - NIA (Integrity Algorithm for 5G) integrity control algorithms; - the KUPenc, KRRCenc, KNASenc encryption keys consist of 128 bits. The encryption and integrity control algorithms are similar to those used on the LTE interface: - NEA0/NIA0: no ciphering; - 128-NEA1/128-N