A common network function in a core network, the common network function comprising: a processor arranged to: receive a Security Context request message from an initial Access and Mobility Management Function, AMF, having a co-located Security Anchor Function, SEAF, during a User Equipment, UE, Registration procedure and prior to receiving a Key Request message, wherein the Security Context request message includes at least one of: Target AMF Information, a User Subscription Identifier(s), a Reroute Security Required Indication, and a first Key Set Identifier, KSI; derive a Reroute Security Context in response to the Reroute Security Required indication being a positive indication, wherein the Reroute Security Context contains at least an integrity key for Reroute Non-Access Stratum, NAS, integrity protection and an encryption key for Reroute NAS ciphering protection, wherein the integrity key is derived from a first key associated with the common network function, wherein the encryption key is derived from the first key; derive a first authentication parameter for authenticating a Target AMF having a co-located SEAF wherein the first authentication parameter is derived using at least one of: the integrity key, the encryption key, the User Subscription Identifier, the Target AMF Information, and the first Key; send a Security Context response message to the initial AMF, the Security Context response message containing the first authentication parameter, wherein the Security Context response message further comprises the Reroute Security Context in response to the Reroute Security Required indication being a positive indication; receive a Key Request message from the SEAF co-located with the Target AMF following an AMF reallocation during a User Equipment, UE, Registration procedure, wherein the Key Request message includes at least one of: a UE identifier, Target AMF information, a second authentication parameter and a Reroute Key indication; verify the Key Request message by determining whether the second authentication parameter matches the first authentication parameter derived for authenticating the Target AMF; and derive a new security context for the Target AMF in response to successfully verifying the Key Request message, wherein the new security context is derived from a primary UE security context; and a network interface arranged to send a Key Response message to the Target AMF, wherein the Key Response message includes at least one of: the new security context, a Subscription Permanent Identifier, SUPI, associated with the UE identifier, an Anti-Bidding down Between Architectures, ABBA, parameter having a special value and a New NAS Security Context Indicator, N-NSCI. receive a Security Context request message from an initial Access and Mobility Management Function, AMF, having a co-located Security Anchor Function, SEAF, during a User Equipment, UE, Registration procedure and prior to receiving a Key Request message, wherein the Security Context request message includes at least one of: Target AMF Information, a User Subscription Identifier(s), a Reroute Security Required Indication, and a first Key Set Identifier, KSI; derive a Reroute Security Context in response to the Reroute Security Required indication being a positive indication, wherein the Reroute Security Context contains at least an integrity key for Reroute Non-Access Stratum, NAS, integrity protection and an encryption key for Reroute NAS ciphering protection, wherein the integrity key is derived from a first key associated with the common network function, wherein the encryption key is derived from the first key; derive a first authentication parameter for authenticating a Target AMF having a co-located SEAF wherein the first authentication parameter is derived using at least one of: the integrity key, the encryption key, the User Subscription Identifier, the Target AMF Information, and the first Key; send a Security Context response message to the initial AMF, the Security Context response message containing the first authentication parameter, wherein the Security Context response message further comprises the Reroute Security Context in response to the Reroute Security Required indication being a positive indication; receive a Key Request message from the SEAF co-located with the Target AMF following an AMF reallocation during a User Equipment, UE, Registration procedure, wherein the Key Request message includes at least one of: a UE identifier, Target AMF information, a second authentication parameter and a Reroute Key indication; verify the Key Request message by determining whether the second authentication parameter matches the first authentication parameter derived for authenticating the Target AMF; and derive a new security context for the Target AMF in response to successfully verifying the Key Request message, wherein the new security context is derived from a primary UE security context; and a network interface arranged to send a Key Response message to the Target AMF, wherein the Key Response message includes at least one of: the new security context, a Subscription Permanent Identifier, SUPI, associated with the UE identifier, an Anti-Bidding down Between Architectures, ABBA, parameter having a special value and a New NAS Security Context Indicator, N-NSCI.