1. Introduction: AS Security Landscape and Emerging Challenges

Access Stratum (AS) security protects the communication between the UE and the radio access network, evolving continuously with each cellular generation. Access Stratum (AS) security historically established its boundary at the PDCP layer, protecting RRC signaling and user-plane traffic while leaving crucial MAC-layer control elements entirely unprotected. However, the radio access network envisioned for 6G is evolving far beyond the environment for which the foundations of 5G AS security were designed. As time-critical operations like mobility, scheduling, and energy saving increasingly migrate to the lower layers, this legacy security gap becomes a critical vulnerability. Consequently, the AS security boundary must evolve in tandem with the RAN, extending robust cryptographic protection directly down to the MAC layer.

At the same time, the broader security landscape has changed considerably. Advances such as quantum computing introduce new considerations for long-term cryptographic security via Post-Quantum Cryptography (PQC), while increasingly capable and pervasive smartphones and emerging device categories such as XR devices expand both device capabilities and the potential attack surface. New 6G use cases, including AI-native services and immersive communication, further introduce diverse security, performance, and reliability requirements. 6G AS security therefore needs to evolve along multiple dimensions—from stronger and more efficient cryptographic protection to extending security to broadcast signaling, control signaling in lower layers and others.

1.1 Secure by design, not secured afterward

The organizing principle for 6G AS security is to design protection in from the first release, guided by threat modeling, trust-boundary analysis and risk-based protection. Crypto-agility should also be an architectural property, with negotiable algorithm identifiers and protocol headroom for larger keys and signatures so that cryptographic primitives can evolve without redesigning the radio interface.

2. Key Areas for Enhancement in 6G AS Security

Building on the 5G NR security foundation, 6G AS security can extend protection to new functions and trust boundaries introduced by the evolving radio architecture. The main enhancement areas discussed in this article are:

Figure 1. UE RAN Security high level

3. Enhanced Cryptographic Algorithms for 6G

3.1 Overview of Algorithm Evolution

For 6G, 3GPP has agreed to introduce 256-bit algorithms and AEAD. Security algorithms are a long-lived design choice. 6G infrastructure may remain in service for decades, so its security architecture must account for future growth in computing capability and data value. Quantum computing does not make today's symmetric algorithms obsolete: Grover's algorithm provides a theoretical quadratic speed-up for key search, so 256-bit algorithms provide additional long-term security margin, while AEAD can combine confidentiality and integrity protection efficiently.

Current 5G AS security uses 128-bit NEA confidentiality and NIA integrity algorithms. For native 6G operation, 256-bit algorithm sets can provide a larger cryptographic margin, while AEAD enables combined confidentiality and integrity protection.

For 6G RAN, the agreed 256-bit algorithm set includes:

SNOW 5G [1]: 256-NEA4 and 256-NCA4;

AES-256 [2]: 256-NEA5 and 256-NCA5; and

ZUC-256 [3]: 256-NEA6 and 256-NCA6.

The 256-bit NEA algorithms provide confidentiality-only protection and 256-bit NCA algorithms provide integrity-only protection or combined confidentiality and integrity protection using AEAD. With NCA supporting integrity protection, a separate 256-bit NIA algorithm is not required for native 6G RAN operation.

3.2 What is AEAD and how it works?

AEAD combines encryption and authentication in one cryptographic operation. It takes plaintext, a secret key, a nonce and, where needed, Additional Authenticated Data (AAD), and produces ciphertext together with an authentication tag.

At the receiver, the corresponding key, nonce and AAD are used to decrypt the ciphertext and verify the tag. PDCP accepts the recovered plaintext only after successful verification, preventing unverified data from being delivered to higher layers.

Figure 2. AEAD encryption

For PDCP traffic requiring both confidentiality and integrity, the 256-NCA4/5/6 algorithms provide a combined operation instead of separate ciphering and integrity invocations [4]. Information that must remain readable but authenticated can be supplied as AAD. Integrity-only protection can be realized by supplying the message as AAD with no plaintext input, while confidentiality-only protection can use the corresponding 256-NEA algorithm.

These modes support different signaling and user-plane requirements, but require consistent algorithm selection and mapping of PDCP packet contents to the cryptographic inputs.

3.3 Impacts on RAN and AS security

Supporting 256-bit algorithms affects algorithm selection, key handling and packet protection. The UE and network need to agree securely on the selected algorithm and protection mode, with RRC carrying the security configuration and PDCP applying it.

For combined-mode operation, PDCP provides the NCA algorithm with the security key and the packet-specific inputs needed for encryption and authentication, including COUNT, bearer identity, direction, nonce and any associated data. Figure 3 summarizes these inputs and outputs.

- Input parameters: KEY, COUNT, BEARER (bearer identity), DIRECTION (UL or DL transmission), EXTRA_IV (nonce), MODE (1-bit indication for encryption or decryption), IBS (Input Bit Stream i.e., MESSAGE or PLAINTEXT), S_LENGTH, MAC_BYTES (Length of MAC tag), AAD, AAD_LENGTH (length of AAD)

- Output parameters: OBS (Output Bit Stream i.e., CIPHERTEXT or PLAINTEXT), MAC (Authentication Tag)

Figure 3. AEAD Combined Mode Algorithm

For bearers requiring both confidentiality and integrity, AEAD can be invoked once at PDCP instead of using separate NEA and NIA operations. The same framework can support integrity-only protection, while confidentiality-only traffic can continue to use the appropriate confidentiality algorithm. This allows the protection mode to match the security needs of each bearer.

AEAD also affects AS key derivation: instead of separate ciphering and integrity keys, combined protection uses a dedicated AEAD key for the applicable RRC or user-plane context.

The move to stronger algorithms also provides an opportunity to revisit MAC-I length. Key strength and authentication-tag length address different attacks: increasing the key length does not by itself reduce the probability of guessing a short MAC-I.

For an ideal tag, extending MAC-I from 32 to 64 bits reduces the random-guess success probability from about 1/2^32 to 1/2^64 per attempt. The trade-off is four additional bytes for each packet carrying the tag, so 6G needs a fixed length that balances integrity margin and radio overhead.

Together, 256-bit algorithms and AEAD strengthen the long-term cryptographic margin while affecting capability negotiation, RRC configuration, PDCP processing and key derivation across the AS-security architecture.

4. MAC CE Security – Protecting Critical Lower-Layer Signaling

As lower-layer signaling expands, MAC Control Elements (MAC CEs) increasingly influence connectivity, scheduling, mobility, power consumption and privacy. Protecting security-sensitive MAC CEs therefore becomes important for 6G.

For example, tampering with a Buffer Status Report can distort scheduling, DRX commands can affect sleep/wake behavior, and a manipulated Timing Advance command can disturb uplink synchronization. Lower-Layer Triggered Mobility raises the impact further: manipulation of a cell-switch command can cause handover failure or security-context desynchronization, particularly when security-related information such as NCC is carried in lower-layer signaling.

4.1 Bringing Security Protection to the MAC Layer

MAC CE protection remains under discussion in 3GPP. 6G can extend AS security directly to security-sensitive MAC CEs, applying integrity protection at the MAC layer. A dedicated KMAC can be established within the AS key hierarchy, with KMACint derived using inputs such as PCI, ARFCN-DL and the integrity-algorithm identifier. A MAC-key epoch can provide an additional MAC-specific KDF input so that a fresh key can be derived even when the parent AS key and cell-related inputs are unchanged, avoiding reuse when a UE returns to a previously used cell or DU.

The sender computes a MAC-I over the protected MAC information using KMACint. The receiver calculates XMAC-I and processes the MAC CE only after successful verification; a failed check causes the MAC CE to be discarded.

A MAC-specific COUNT included in the MAC-I calculation provides freshness and replay protection. Keeping it independent of the PDCP COUNT allows MAC security to evolve separately. Before the MAC COUNT wraps around, the UE and network can establish a fresh MAC context, for example by incrementing the MAC-key epoch, deriving a new KMACint and re-initializing the MAC COUNT.

MAC CE integrity protection is activated after AS security activation, under network control through RRC signaling. State transitions and recovery procedures require corresponding context handling: RRC Resume can establish a fresh MAC context before protected MAC CEs are exchanged, while RRC Reestablishment does not reuse the previous MAC context. Mobility similarly establishes a fresh context at a new MAC-security termination point with a new COUNT. MAC CE integrity protection is not activated in limited service for unauthenticated emergency services, avoiding an additional dependency for essential connectivity.

Figure 4. MAC CE Security in 6G

5. False Base Station (FBS) Mitigation: Digital-Signature-Based SI Protection

5.1 System Information (SI) Protection

False base stations can impersonate legitimate cells and influence nearby UEs before AS security is established. Potential consequences include user tracking, denial of service, downgrade attempts and performance or battery impact.

The underlying challenge is that essential broadcast information such as the MIB and SIBs is available before a UE has established a security context. A false base station can therefore transmit manipulated system information that influences cell selection or access behavior. One countermeasure is to digitally sign selected system information so that the UE can verify its origin and integrity before relying on it.

Digital-signature-based system-information protection for false-base-station mitigation remains under discussion in 3GPP. 6G provides an opportunity to accommodate such authentication from the outset. Digital signatures, including post-quantum-capable schemes where appropriate, can allow a UE to verify that protected system information originates from an authorized network and has not been modified.

The main AS challenge is balancing stronger authentication with radio overhead. Post-quantum signatures can be larger than classical signatures, so the selected algorithm and security level need to account for radio resources, latency and UE energy consumption.

As illustrated in Figure 5, the aNB generates a digital signature over the protected system information and broadcasts the signature with, or in association with, that information. The UE verifies the signature before trusting the protected parameters, enabling detection of spoofed or modified system information.

Figure 5. System-information protection—(a) false-base-station scenario; (b) digital-signature generation for protecting broadcast system information

6. Key Separation: Independent MAC and PDCP Security Contexts

Key separation for 6G remains under discussion in 3GPP. There are three related aspects to consider: separation of MAC security keys from CU-terminated keys, independent management of CP and UP key lifecycles, and separation of UP keys across different CU-UP entities. The latter two are independent of MAC CE protection and address issues already present in the 5G security architecture.

6.1 MAC Key Separation in the CU-DU Split

A CU-DU split of base station functions places higher-layer functions such as RRC and PDCP in the Centralized Unit (CU), while RLC, MAC and PHY processing reside in the DU. This separation keeps time-sensitive radio functions close to the radio equipment.

It also determines security termination: PDCP confidentiality and integrity protection terminate in the CU, so the DU does not require the corresponding RRC or user-plane protection keys.

With MAC-layer protection, the DU becomes a security termination point and therefore needs dedicated key material. Reusing CU-side RRC or user-plane keys at the DU would expose secrets beyond the functions that require them, making cryptographic key separation important.

Figure 6. Key separation – Independent RRC, UP and MAC keys derived from the AS security context

For MAC layer security, the design objective is to provide dedicated keys for DU-terminated protection, cryptographically separated from CU-terminated RRC and user-plane keys. The DU receives only the key material required for its function, limiting the impact of a DU compromise.

Key separation also applies across DUs. When a UE moves to a target DU, a separate MAC security context can prevent the source DU from deriving the target DU's keys, while the CU-side security context follows its own lifecycle.

6.2 Independent CP and UP Key Lifecycles

Another consideration is the independent management of control-plane (CP) and user-plane (UP) key lifecycles. In 5G, both are derived from the same KgNB, so refreshing KgNB refreshes both sets of protection keys. During mobility, however, the CP security context may change while the UP termination point remains unchanged. Managing the UP key lifecycle independently can avoid unnecessary UP security-context updates.

This is particularly useful in a deployment with CU-CP/CU-UP separation: if the CU-CP changes while the CU-UP remains unchanged, the existing UP security context can be retained instead of being refreshed together with the CP keys.

6.3 UP Key Separation across CU-UPs

Another consideration is cryptographic separation between CU-UP entities. If the same UP key material is shared across multiple CU-UPs, compromise of one entity can expose traffic protected at another. Deriving distinct UP keys per CU-UP ensures that the keys used at one CU-UP cannot be derived from those used at another, so compromise of one CU-UP does not affect the UP traffic between the UE and other CU-UPs.

7. Conclusion: 6G Security Evolution

6G AS security builds on the proven 5G security model while extending protection to the new functions and trust boundaries of the 6G radio network. Stronger and more flexible cryptography, protection of critical MAC signaling, authenticated system information and better key separation together provide a more comprehensive security framework. By considering these mechanisms from the beginning of the 6G design, the radio access network can evolve toward a security architecture that is both stronger and better aligned with future services.