A method comprising: performing, by a communications terminal of a mobile communications network, an authentication and key agreement function with a remote gateway node of the mobile communication network, including generating a first data encryption key configured for a first level of encryption for session data of a communications session of the communications terminal and an authentication key configured for authentication security protection for control layer messaging, wherein the session data and the control layer messaging are to be transmitted between the communications terminal and the remote gateway node over one or more channels of the communications network; receiving, by the communications terminal, a security mode command from the satellite base station subsystem (605; 705; 805) of the remote gateway node, wherein the security mode command includes a key initiator; generating, by the communications terminal, a second data encryption key based on the key initiator and a first key algorithm known only to the communications terminal, wherein the second data encryption key is generated for a second level of encryption for the session data, wherein the second level of encryption is at a higher security level as compared to the first level of encryption; and generating, by the communications terminal, a key response value, and transmitting a security mode complete command including the key response value to the satellite base station subsystem (605; 705; 805) of the remote gateway node, wherein the key response value is configured to enable the satellite base station subsystem (605; 705; 805) of the remote gateway node to generate the second data encryption key based on the key response value and a second key algorithm known only to the satellite base station subsystem (605; 705; 805) of the remote gateway node; characterized in that the signaling between the satellite base station subsystem (605; 705; 805) of the remote gateway node and the communications terminal regarding the security mode command and security mode complete command, and all subsequent control layer signaling, is integrity protected based on the authentication security protection for the control layer messaging, and, once the processing for generation of the second data encryption key is completed, communication session data exchanged between the remote gateway node and the communications terminal is protected based on the second level of encryption of a higher level than the first encryption level. performing, by a communications terminal of a mobile communications network, an authentication and key agreement function with a remote gateway node of the mobile communication network, including generating a first data encryption key configured for a first level of encryption for session data of a communications session of the communications terminal and an authentication key configured for authentication security protection for control layer messaging, wherein the session data and the control layer messaging are to be transmitted between the communications terminal and the remote gateway node over one or more channels of the communications network; receiving, by the communications terminal, a security mode command from the satellite base station subsystem (605; 705; 805) of the remote gateway node, wherein the security mode command includes a key initiator; generating, by the communications terminal, a second data encryption key based on the key initiator and a first key algorithm known only to the communications terminal, wherein the second data encryption key is generated for a second level of encryption for the session data, wherein the second level of encryption is at a higher security level as compared to the first level of encryption; and generating, by the communications terminal, a key response value, and transmitting a security mode complete command including the key response value to the satellite base station subsystem (605; 705; 805) of the remote gateway node, wherein the key response value is configured to enable the satellite base station subsystem (605; 705; 805) of the remote gateway node to generate the second data encryption key based on the key response value and a second key algorithm known only to the satellite base station subsystem (605; 705; 805) of the remote gateway node; characterized in that the signaling between the satellite base station subsystem (605; 705; 805) of the remote gateway node and the communications terminal regarding the security mode command and security mode complete command, and all subsequent control layer signaling, is integrity protected based on the authentication security protection for the control layer messaging, and, once the processing for generation of the second data encryption key is completed, communication session data exchanged between the remote gateway node and the communications terminal is protected based on the second level of encryption of a higher level than the first encryption level.