ctrum utilization. LTE supports full duplex FDD, half duplex FDD and TDD modes of operation as shown in Figure 3.31. 3.9.6 Security The security architecture of EPS is designed to handle IP-based networks. The enhancements have been made to the existing UMTS security mechanism to handle ever increasing threats and diverse nature of the IP networks. These enhancements include adding security (both integrity protection and ciphering) on the non-access stratum plane, additional layers of abstraction to protect important information like keys, security inter-working between 3GPP and non-3GPP networks, and SO on. 3.9.6.1 Security Improvements over UMTS The major improvement over UMTS is the addition of security functions at the NAS (Non-AS) level (between the UE and the MME), on top of the existing ones at the AS (access stratum) level. A separate security sublayer is introduced for supporting this functionality and is positioned in between EMM and RRC in the protocol stack. This sublayer would cipher and integrity protect NAS signaling messages. This would mean that all the NAS signaling (with the exception of a few 3GPP defined messages) would be ciphered and integrity protected twice - once in the NAS security sublayer and once within AS. This Next Generation Mobile Communications Ecosystem adds to the overall robustness of the architecture; even if one fails, there will be protection from the other. IPSec is implemented for the protection of IP-based internetwork interfaces in EPC and EUTRA for both the signaling and user data planes. One more improvement is that during the AKA procedure, the ciphering and integrity keys (Ck and Ik) are computed by the HSS in the user's home public land mobile network (HPLMN) when the serving network (SN) queries for the same. While in UMTS these keys are actually communicated back to the SN, it is not SO in EPC. Instead, another key, KASME, is computed by the HSS and sent back to the SN. The advantage of KASME is that it is bound to the UE identity and the identity of the SN. Ano