Section: 6.3.1.4 Distribution of subscriber identities and security data between 5G and EPS serving network domains
Content: NOTE 1: No direct interworking between 5G networks and network of generations prior to EPS are foreseen. Therefore, only the interaction between 5G and EPS serving network domains is addressed here. The transmission of the SUPI in the clear is permitted between 5G and EPS core network entities if it has the form of an IMSI. The transmission of any unmodified 5G security contexts to a EPS core network entity is not permitted. Details of security context transfer between EPS and 5G core network entities can be found in clause 8. The transmission of a 5G authentication vector to an EPS core network entity is not permitted. The transmission of any unused EPS authentication vectors to a 5G core network entity is not permitted. If SEAF receives any unused authentication vectors (e.g. in mobility scenarios from legacy MME) they shall be dropped without any processing. NOTE 2: The rules above differ from the corresponding rules in 3GPP TS 33.401[ 3GPP System Architecture Evolution (SAE); Security architecture ] , clause 6.1.6: The latter allows forwarding of UMTS authentication vectors from an SGSN to an MME and back to the same SGSN under certain conditions. But this feature goes against a strict security separation of EPS and 5G domains. As its performance advantage is questionable it was not copied into 5G. NOTE 3: Security context mapping between EPS and 5G serving networks is allowed, according to clause 8.