15, the SEAF is co-located with the AMF. Support various types of devices that have different security capabilities and require- ments: Secondary authentication enables support for non-3GPP access links and ses- sions authorized by third-party servers, such as for industrial IoT, V2X, and automation. This functionality is related to the access control for network slices. For example, vari- ous IoT devices may require different credential provisioning and authentication meth- ods. The details for this type of industrial scenarios are being investigated. Support user data and signaling encryption and integrity protection: These features are essential for a secure system. A new feature is data path integrity protection, which may be especially important for certain new services such as industrial IoT. There is also the potential for the user-plane security to be terminated in the network instead of the base station. Separate device credential management and access authentication from data session setup and management: This split results in a separate security context between device and the AMF which is used for mobility management. A different security context is established for session management, between device and the SMF, used to authorize access of the device to specific services; for example, network slices or specific data networks such as enterprise networks. This new type of access control employs a sepa- rate and flexible authentication and authorization procedure; for example, extensible authentication protocol (EAP). Support secure slicing: There could be several services instantiated as a network slice, each with different security requirements. The access to a slice is granted based on the primary authentication and subscription information, but this authorization is carried out Extensible authentication protocol (EAP), defined in IETF RFC 5247, is an authentication framework fre- quently used in wireless networks and point-to-point connections which provides an authentication frame- work for transport