Section: 8.3.2 Procedure
Content: Figure 8.3.2-1 Handover from 5GS to EPC over N26 NOTE 1: This procedure is based on clause 4.11.1.2.1 in TS 23.502[ Procedures for the 5G System (5GS) ]  and only includes steps and description that are relevant to security. If the UE is initially registered and connected to the 5GC, the 5GC has a current security context for the UE. The current 5G security context may be a mapped 5G security context resulting from a previous mobility from EPC, or a native 5G security context resulting from a primary authentication with the 5GC. 1. The gNB/ng-eNB sends a Handover Required message to the AMF, including UE’s identity . 2. When the source AMF performs a handover procedure to the EPC, after checking the UE's access rights and security capabilities, the source AMF shall prepare a UE context including a mapped EPS security context for the target MME. To construct the mapped EPS security context, the source AMF shall derive a K’ASME using the KAMF key and the current downlink 5G NAS COUNT of the current 5G security context as described in clause 8.6.1 and then increments its stored downlink 5G NAS COUNT value by one. The source AMF shall select the EPS NAS algorithms identifiers (it has stored) to be used in the target MME at interworking handover to EPS, for encryption and integrity protection. NOTE 2: A legacy target MME is expecting to receive the selected EPS NAS algorithms identifiers over N26 from the source AMF as the target MME believes the source AMF is another MME. The source AMF has therefore provisioned the EPS NAS security algorithms identifiers to be used at interworking handover to EPS to the UE in the 5G NAS SMC in 5G access as described in clause 6.7.2. The target MME could re-select different EPS NAS algorithms though to be used with the UE by running a NAS SMC in the following Tracking Area Update procedure. The uplink and downlink EPS NAS COUNT associated with the newly derived KASME' key are set to the values as described in clause 8.6.1. The eKSI for the newly derived KASME' key is defined as described in clause 8.6.1. The source AMF shall also derive the initial KeNB key from the KASME' key and the uplink NAS COUNT as specified in Annex A.3 of TS 33.401[ 3GPP System Architecture Evolution (SAE); Security architecture ]  [10] using 232-1 as the value of the uplink NAS COUNT parameter. NOTE 3: The source AMF and the UE only uses the 232-1 as the value of the uplink NAS COUNT for the purpose of deriving KeNB and do not actually set the uplink NAS COUNT to 232-1. The reason for choosing such a value not in the normal NAS COUNT range, i.e., [0, 224-1] is to avoid any possibility that the value may be used to derive the same KeNB again. The source AMF subsequently derives NH two times as specified in clause A.4 of TS 33.401[ 3GPP System Architecture Evolution (SAE); Security architecture ]  [10]. The {NH, NCC=2} pair is provided to the target MME as a part of UE security context in the Forward Relocation Request message. 3. The source AMF shall transfer the UE security context (including new KASME', eKSI, uplink and downlink EPS NAS COUNT’s, UE EPS security capabilities, selected EPS NAS algorithms identifiers) to the target MME in the Forward Relocation Request message. The UE NR security capabilities may be sent by the source AMF as well. 4. When the target MME receives Forward Relocation Request message from source AMF, then the target MME shall derive EPS NAS keys (i.e., KNASenc and KNASint) from the received KASME' key with the received EPS NAS security algorithm identifiers as input, to be used in EPC as described in Annex A.7 in TS 33.401[ 3GPP System Architecture Evolution (SAE); Security architecture ]  [10]. The target MME needs to include the {NH, NCC=2} pair and the UE security capabilities in the S1 HANDOVER REQUEST message to the target LTE eNB. The UE security capabilities include the UE EPS security capabilities received from the source AMF. 5. Upon receipt of the S1 HANDOVER REQUEST from the target MME, the target LTE eNB selects AS security algorithmsfrom the UE EPS security capabilities as described in clause 7.2.4.2.3 in TS 33.401[ 3GPP System Architecture Evolution (SAE); Security architecture ]  [10] and computes the KeNB to be used with the UE and proceed as described in clause 7.2.8.4.3 in TS 33.401[ 3GPP System Architecture Evolution (SAE); Security architecture ] [10]. The target LTE eNB then sends the selected AS security algorithms in the target to source transparent container in the S1 Handover Request Ack Message to the target MME. 6. The target MME shall include the target to source transparent container received from the target LTE eNB in the Forward Relocation Response message sent to the source AMF. 7. The source AMF shall include the target to source transparent container and the 8 LSB of the downlink NAS COUNT value used in KASME’ derivation in step 2, in the Handover command sent to the source gNB/ng-eNB. 8. The source gNB/ng-eNB shall include the target to source transparent container and the 8 LSB of the downlink NAS COUNT value in the Handover command sent to the UE. Upon the reception of the Handover Command message, the UE shall estimate the downlink NAS COUNT value using the received 8 LSB of the downlink NAS COUNT value and its stored downlink NAS COUNT value. The UE shall ensure that the estimated downlink NAS COUNT value is greater than the stored downlink NAS COUNT value. Then, the UE shall derive the mapped EPS security context, i.e. derive KASME' from KAMF as described in clause 8.6.1 using the estimated downlink 5G NAS COUNT value. After the derivation the UE shall set the downlink NAS COUNT value in the 5G NAS security context to the received downlink NAS COUNT value. 9. The eKSI for the newly derived KASME' key is defined as described in clause 8.6.1. The UE shall also derive the EPS NAS keys (i.e. KNASenc and KNASint) as the MME did in step 4 using the EPS NAS security algorithms identifiers stored in the ME and provisioned by the AMF to the UE in 5G NAS SMC in earlier 5G access. The UE shall also derive the initial KeNB from the KASME' and the uplink NAS COUNT as specified in Annex A.3 of TS 33.401[ 3GPP System Architecture Evolution (SAE); Security architecture ]  [10] using 232-1 as the value of the uplink NAS COUNT parameter. The UE shall also derive the {NH, NCC=2} pair as described in A.4 of TS 33.401[ 3GPP System Architecture Evolution (SAE); Security architecture ]  [10] and further derive the KeNB to be used with the UE by performing the key derivation defined in Annex A.5 in TS 33.401[ 3GPP System Architecture Evolution (SAE); Security architecture ] [10]. The UE shall derive the AS RRC keys and the AS UP keys based on the KeNB and the received AS EPS security algorithms identifiers selected by the target eNB as described in Annex A.7 in TS 33.401[ 3GPP System Architecture Evolution (SAE); Security architecture ]  [10]. The uplink and downlink EPS NAS COUNT associated with the derived EPS NAS keys are set to the values as described in clause 8.6.1. The UE shall immediately take into use the newly created mapped EPS security context, both for NAS and AS communication. 10. The UE sends the Handover Complete message to the target LTE eNB. The UE shall cipher and integrity protect this message using the newly created mapped EPS security context. 11. The target LTE eNB notifies the target MME with a Handover Notify message. After successful completion of the Handover procedure, the UE shall delete any mapped 5G security context. After deleting the mapped 5G security context, if the UE has a full non-current native 5G NAS security context then the UE shall make the non-current native 5G NAS security context the current one.