Clarification on security mode procedure in LTE

Question

I have couple of question regarding security procedure in case of NAS and AS Security procedure.
1> In case of NAS security procedure, MME sends Security mode command to UE with with only integrity protected, and UE sends Security mode complete after integrity verification to eNB with both integrity protected and ciphered too, as MME shared the ciphered algo with UE in command message.

But in case of AS security procedure, eNB sends security mode command with integrity protected and UE reply with only integrity protected Security mode complete message though eNB shared ciphering algo with UE.

Why in case of AS Security mode complete message it is only integrity protected and not ciphered but in case NAS security Complete message is both ciphered and integrity protected ? Any special requirement/reason for it ?

2> In case of NAS, after security is established every NAS message goes through Ciphering first and then Integrity protection added but in case AS security RRC messages why it is first integrity protection and than ciphered ?

What is the reason behind different order of integrity protection and ciphering in case of NAS and AS ?

Answer 1

I did not find any reference material by which I can give you answer. But based on my understanding of LTE, following is my input.
Since one eNodeB can be shared with multiple MME so UE want to make sure that when he responds to MME with the NAS security mode complete message, it is decoded by correct MME which can be achieved by ciphering.

However, in radio side UE has radio connection with one cell or Pcell, he knows which is the receiver of security mode complete message. That could be the reason of doing so.

Comments

"he knows which is the receiver of security mode complete message. That could be the reason of doing so. "
If we apply to this principle then all further RRC message also will go with out ciphering, so i guess some other reason exists.

---

Since I did not find any reference to give clarification on your question. I am not sure. Looking for others to respond.

---

When UE is sending SMC Complete ENB knows to which it has to send(I mean Exact MME) How come will have multiple recevicer's (MME) ?