ng more flexible QoS characteristics. When reflective QoS is used, the 5G UE can create a QoS rule for the uplink traffic based on the received downlink traffic without generating control- plane signaling overhead. Table 1.5 summarizes and compares the EPS and 5GS QoS and session management features. 5G Network Architecture 185 Table 1.5: Comparison of LTE and NR QoS and session management characteristics [71]. RAN-Level Interworking 5G SA With Core-Network-Level With EPC With 5GC Interworking Network Per device Per service (enabling third-party Per service (enabling third-party slicing (dedicated core) service) service) Session Limited and Flexible and distributed (lower Flexible and distributed (lower management centralized cost, lower latency) cost, lower latency) Per-bearer Per-flow Per-flow Network-initiated UE/network-initiated (dynamic UE/network-initiated (dynamic 1.7 Security Framework We begin this section with a review of security framework in LTE to set the stage for the 5G security framework discussion. Fig. 1.89 shows the scope and overall concept of the LTE security architecture. In LTE, the authentication function performs mutual authentica- tion between the UE and the network. The NAS security performs integrity protection/veri- fication and ciphering (encryption/decryption) of NAS signaling between the UE and the MME. The AS security is responsible for integrity protection/verification and ciphering of RRC signaling between the UE and the eNB and further performs ciphering of user traffic between the UE and the eNB. In 3GPP networks, authentication refers to the process of determining whether a user is an authorized subscriber to the network that it is trying to access. Among various authentica- tion procedures, EPS AKA procedure is used in LTE networks for mutual authentication between users and networks. The EPS AKA procedure consists of two steps: (1) the home subscriber server (HSS) generates EPS authentication vector(s) (RAND, AUTN, XRES, KASME) and delivers them to the MME and (2) the MME 