Why is Security command required at both NAS and RRC levels?

Question

Also NAS security is established before RRC security. Pls share your thoughts. Thanks.

Answer 1

There may be various reasons to apply two levels ( AS and NAS) security in lte. A Ue performs basically two operations (Control and Data ) operations. Its network responsibility to secure these two. I mean Network secure control and data. UE performs control signaling with eNB and MME like RRC message and NAS messages. UE receives and send data through ENB there is no direct interface with any other node for SGW.

So to secure NAS and RRC signalling both. There are two Security mode command sent out to UE. One for NAS and one for RRC. Kasme is used as input to generate NAS int and encryption keys for the security of NAS messages. Kenb is used as input to generate RRCint, RRCenc, RRCup keys for the security of RRC messages and Data.

NAS security mode command tells to UE about selected algorithm for NAS keys. To generate NAS Keys Kasme and selected algo is used. So NAS security keys changes only when either Kasme changes or supported algorithms changes. and Similarly AS security modes command tells to UE about selected algo for Radio.

Answer 2

Not sure if I understood it correctly -
Security in LTE can be devided into three parts
1. Network Access Security
2. Network Domain Security
3. UE security

Network Access Security primarily covers three parts
a. Encryption and Integrity Protection at RRC
b. Encryption and Integrity Protection at NAS
c. Encryption of Radio Bearers,

So RRC and NAS serves different purpose. For more details please have a look at http://www.slideshare.net/aliirfan04/lte-security-overview

Answer 3

EPS has two security stratums: AS and NAS.
There are different security associations for each of them.
AS security can start or be updated independently from NAS security. There fore, there is a need for two separate SMCs, one for AS and one for NAS.

Answer 4

one is for security between MME and UE (NAS Control messages) and other one is between UE and e-NodeB (AS messages). User plane and control plane security are done independently.
http://www.3gpp.org/ftp/information/presentations/presentations_2011/2011_05_Bangalore/DZBangalore290511.pdf