ther advantage is that KASME is returned to the SN only after the UE authentication response is validated by the HSS. The NAS security context has a longer lifetime than the AS (access stratum) security context. It can also stay alive when the UE goes to idle [26]. 3.9.6.2 Key Aspects The key aspects of EPS security are as follows [11, 14, and 26]: 3.9.6.2.1 Key Management Keys whether master or temporary play a very crucial role in the overall security process. Their lifetimes, scope, hierarchy, and properties are clearly defined in 3GPP TS 33.401 [27]. The E-UTRAN keys are cryptographically separated from the EPC keys used, making it impossible to figure out one from the other. A new functional entity called Access Security Management Entity (ASME) has been introduced which will be collocated with the MME for NAS signaling protection (encryption and integrity verification). The various keys are derived using the Key Derivation Function (KDF)²0 interface. Figure 3.32 shows EPS key hierarchy and a simple key derivation process where CK/IK keys are confined to the home network. The MME invokes the AKA procedures by requesting authentication vectors to the HE (Home environment) if no unused EPS authentication vectors have been stored. The HE sends an authentication response back to the MME that contains a fresh authentication vector, including a base-key named KASME. Thus, as a result of an AKA run, the EPC and the UE share KASME; that is, the keys derived from KASME are shared with both MME and UE. From KASME, the NAS keys, (and indirectly) KeNB keys and Next Hop (NH) are derived. The KASME is never transported to an entity outside of the EPC, but KeNB and NH are transported to the eNB from the EPC when the UE transitions to ECM-CONNECTED From the KeNB, the eNB and UE can derive the UP (user plane) and RRC keys. While the MME keeps the keys, the eNodeB deletes all the keys when the UE goes into idle mode. ASME keeps the (LASME for future reuse. The keys that are used in the overall process are: Kenb is a key deriv