Difference between security mode procedure and AS Security setup?

Question

What is the difference between security mode procedure after authentication and AS Security setup during initial context setup after attach accept?

Answer 1

LTE provides two level of security for an UE . First, LTE network establishes/completes NAS level security using Security mode procedure. Once NAS level i.e. between MME and UE security is established, MME initiates "Initial Context Setup Procedure" towards eNodeB for an UE. This S1-AP "Initial Context Setup Request" message contains security related parameter likes "UE Security Capabilities (encryption and integrity algorithms)" and "Security Key (Kenb)" . Once eNodeB receives these parameters, it generates AS security keys (RRCint, RRCenc, UP-enc) and establishes security context with UE using RRC "security mode procedure" .

References:
3GPP TS 24.301 for NAS-security mode procedure
3GPP TS 36.331 for AS-security mode procedure
3GPP TS 33.401 for security keys derivation.