4.4.2.2 Establishment of a mapped 5G NAS security context during inter-system change from S1 mode to N1 mode in 5GMM-CONNECTED mode

In order for the UE operating in single-registration mode in a network supporting N26 interface to derive a mapped 5G NAS security context for an inter-system change from S1 mode to N1 mode in 5GMM-CONNECTED mode, the AMF shall construct a mapped 5G NAS security context from the EPS security context received from the source MME as indicated in 3GPP TS 33.501 [24]. The AMF shall select the 5G NAS security algorithms and derive the 5G NAS keys (i.e. KNASenc and KNASint). The AMF shall define an ngKSI for the newly derived K'AMF key such that the value field is taken from the eKSI of the KASME key and the type field is set to indicate a mapped security context and associate this ngKSI with the newly created mapped 5G NAS security context. The AMF shall then include the message authentication code, selected NAS algorithms, NCC and generated ngKSI in the S1 mode to N1 mode NAS transparent container IE (see clause 9.11.2.9).

When the UE operating in single-registration mode in a network supporting N26 interface receives the command to perform inter-system change to N1 mode in 5GMM-CONNECTED mode, the UE shall derive a mapped K'AMF, as indicated in 3GPP TS 33.501 [24], using the KASME from the EPS security context. Furthermore, the UE shall also derive the 5G NAS keys from the mapped K'AMF using the selected NAS algorithm identifiers included in the S1 mode to N1 mode NAS transparent container IE and associate this mapped 5G NAS security context with the ngKSI value received. The UE shall then verify the received NAS MAC. In case the received NAS MAC is not verified successfully (see clause 4.4.3.3) the UE shall discard the content of the received S1 mode to N1 mode NAS transparent container IE and inform the lower layers that the received S1 mode to N1 mode NAS transparent container is invalid.

When the UE operating in single-registration mode in a network supporting N26 interface has a PDN connection for emergency bearer services and has no current EPS security context, the AMF shall set 5G-IA0 and 5G-EA0 as the selected 5G NAS security algorithms in the S1 mode to N1 mode NAS transparent container IE. The AMF shall create a locally generated K'AMF. The AMF shall set the ngKSI value of the associated security context to "000" and the type of security context flag to "mapped security context" in the S1 mode to N1 mode NAS transparent container IE.

When the UE operating in single-registration mode in a network supporting N26 interface receives the command to perform inter-system change to N1 mode in 5GMM-CONNECTED mode (see 3GPP TS 38.331 [30]) and has a PDN connection for emergency bearer services, if 5G-IA0 and 5G-EA0 as the selected 5G NAS security algorithms are included in the S1 mode to N1 mode NAS transparent container IE, the UE shall create a locally generated K'AMF. Furthermore, the UE shall set the ngKSI value of the associated security context to the KSI value received.

After the new mapped 5G NAS security context is taken into use for the 3GPP access following a successful inter system change from S1 mode to N1 mode in 5GMM-CONNECTED mode and the UE is registered with the same PLMN over the 3GPP access and non-3GPP access:

• if a native 5G NAS security context is used on the non-3GPP access and:
• the UE is in 5GMM-IDLE mode over non-3GPP access, then the AMF and the UE shall activate and take into use the new mapped 5G NAS security context on the 3GPP access for the non-3GPP access as described in 3GPP TS 33.501 [24] after the AMF sends or the UE receives the REGISTRATION ACCEPT message respectively. The UE and AMF shall keep the native 5G NAS security context which was used on the non-3GPP access and make it a non-current native 5G NAS security context. The non-current native 5G NAS security context may be re-activated later using the security mode control procedure; or
• the UE is in 5GMM-CONNECTED mode over non-3GPP access, in order to activate the native 5G NAS security context over the 3GPP access that is active on the non-3GPP access the AMF shall send the SECURITY MODE COMMAND message over the 3GPP access as described in 3GPP TS 33.501 [24]. The SECURITY MODE COMMAND message shall include the same ngKSI to identify the native 5G NAS security context that is used on the non-3GPP access; or
• if a mapped 5G NAS security context is used on the non-3GPP access and:
• the UE is in 5GMM-IDLE mode over non-3GPP access, the AMF and the UE shall activate and take into use the new mapped 5G NAS security context active on the 3GPP access for the non-3GPP access as described in 3GPP TS 33.501 [24] after the AMF sends or the UE receives the REGISTRATION ACCEPT message respectively; or
• the UE is in 5GMM-CONNECTED mode over non-3GPP access, in order to activate the same mapped 5G NAS security context over one access that is used on the other access the AMF shall send the SECURITY MODE COMMAND message over one-access as described in 3GPP TS 33.501 [24]. The SECURITY MODE COMMAND message shall include the same ngKSI to identify the mapped 5G NAS security context that is used over the other access.

If the inter-system change from S1 mode to N1 mode in 5GMM-CONNECTED mode is not completed successfully, the AMF and the UE operating in single-registration mode in a network supporting N26 interface shall delete the new mapped 5G NAS security context.