3GPP 23.501 v20.2.0 — the document's own text
5.10.2.1 Signalling Security
Taught in 16. Who you are and who may listen (The 5G system architecture, in depth), 6. One network behaving like several (The 5G system architecture, overview).
When a UE is connected via a NG-RAN and via a standalone non-3GPP accesses, the multiple N1 instances are secured using independent NAS security contexts, each created based on the security context in the corresponding SEAF (e.g. in the common AMF when the UE is served by the same AMF) derived from the UE authentication.