Where 5G meets 4G — and security can quietly step down a generation
“A 5G subscriber who drifts onto 4G keeps moving — but their security context may have just dropped a generation. The handoff is seamless; the security difference is not.”
— THE INTERWORKING RISK
For years, 5G and 4G coexist. Subscribers move between 5GS and EPS constantly — onto LTE for coverage, back to NR for capacity. Each move transfers a security context across the boundary, and a context "mapped" from 4G carries 4G's security ceiling. This chapter covers the N26 interface, context mapping in both directions, key conversion, and the LTE-vs-5G security comparison that explains what's at stake.
🎯 Learning objectives
Explain why interworking exists and the N26 interface.
Walk 5GS→EPS and EPS→5GS context transfer (idle & connected).
Explain key mapping (K_AMF ↔ K_ASME).
Distinguish native vs mapped contexts and the downgrade risk.
Compare LTE and 5G security features.
📘 Standards reference box — Chapter 17
Specification
Title
Release / version verified
TS 33.501
5G security — interworking with EPS (clause 8)
Rel-18, v18.11.0 (2026-04)
TS 33.401
EPS security architecture
Rel-18 edition
TS 23.501 / 23.502
5GS-EPS interworking architecture & procedures
Rel-19 edition
Checked June 2026 — verify against the latest 3GPP version.
Purpose: the interworking picture. N26 is the bridge between the 5G AMF and the 4G MME that carries security context, enabling seamless mobility — and the path along which a context can be mapped/downgraded.
FIGURE 17.2Native vs Mapped Security Context
Purpose: the distinction that drives the whole chapter. A 5G context mapped from 4G is mathematically 5G-shaped but security-wise inherits 4G's properties — no SUCI freshness, no UP integrity origin, etc.
Purpose: a 5G subscriber drifting onto LTE. The AMF maps its 5G context down to an EPS context for the MME — seamless, but now running at LTE's security level (mapped).
FIGURE 17.45GS → EPS Connected Handover
Purpose: the in-call version. A voice call or active data session survives the move to LTE (relevant to EPS Fallback, §17.6), with keys mapped on the fly.
FIGURE 17.5EPS → 5GS Idle Mobility
Purpose: coming up to 5G. The AMF can accept the mapped context — but the security-best practice is to trigger a fresh 5G authentication so the subscriber gets a native 5G context with full 5G properties.
FIGURE 17.6EPS → 5GS Connected Handover
Purpose: the in-call upgrade path. The session survives the move to NR on a mapped context; a subsequent re-authentication promotes it to native 5G security.
17.3 Key Mapping
FIGURE 17.7Key Mapping — KAMF ↔ KASME
Purpose: the conversion math. Keys cross the boundary via one-way KDFs — but cryptographic freshness doesn't appear from nowhere; a mapped key is only as fresh/strong as its source.
FIGURE 17.8NAS COUNT Handling Across Systems
Purpose: a subtle correctness/security requirement. The boundary must never produce a repeated (key, COUNT) — the same keystream-reuse danger as Chapter 7, now at the interworking seam.
17.4 LTE vs 5G Security — the Master Comparison
FIGURE 17.9LTE vs 5G Security Feature Comparison
Purpose: the comparison that quantifies the downgrade. Each green-vs-red row is a property a mapped context lacks — so "subscriber on a mapped context" means "subscriber missing these protections."
FIGURE 17.10Downgrade Risk at the 4G/5G Boundary
Purpose: the interworking attack and its defenses. Forcing fallback is a way to strip 5G protections; policy (re-auth, restricted fallback, monitoring) keeps the downgrade from being silent or permanent.
Purpose: a security/UX trade-off. N26-less interworking forfeits seamlessness but guarantees a native context (fresh auth) on each move — a legitimate choice for security-sensitive deployments.
Purpose: the most frequent real-world interworking event. Many networks still fall back to LTE for voice (EPS Fallback) — so the 5GS→EPS handover security applies to a huge share of calls.
17.5 The Practical Operator View
Set a re-authentication policy to promote mapped contexts to native when a UE returns to 5G — don't leave subscribers indefinitely at 4G security.
Track the share on mapped contexts as a standing KPI (Chapter 26).
Protect N26 like any inter-node interface (Chapter 14).
For critical slices, restrict or forbid fallback, or require re-auth on return.
Remember EPS Fallback routes most voice through this path — secure it accordingly.
Common misconfiguration risks
Mapped contexts accepted without any re-authentication policy → persistent 4G-level security.
N26 unprotected.
No monitoring of fallback frequency or mapped-context share.
Critical slices allowed to fall back to LTE, losing UP integrity.
17.6 Threats and Mitigations
Threat
Vector
Defense
Generation downgrade
force fallback to LTE
re-auth on return, restrict fallback for critical slices
Persistent weak security
indefinite mapped context
re-authentication policy, mapped-context KPI
N26 interception/injection
unprotected N26
IPsec (NDS/IP)
Keystream reuse at boundary
careless COUNT handling
correct COUNT freshness on mapping
Voice-path exposure
EPS Fallback to LTE
secure handover path, monitor
17.7 Terminology, Example, Checklist
Term
Meaning
N26
AMF↔MME interface carrying security context across 5GS/EPS
native / mapped context
From a fresh auth in that system / converted from the other system
K_AMF / K_ASME
5G AMF-level key / LTE anchor key (mapped to one another)
EPS Fallback
Moving a voice call from NR to LTE (VoLTE) when VoNR is unavailable
Real network example. An operator with patchy 5G SA coverage and no VoNR relied heavily on EPS Fallback for voice. A security review discovered that subscribers, once fallen back to LTE for a call, stayed on the mapped (4G-level) context even after returning to good 5G coverage — because no re-authentication was triggered on return. Effectively, frequent callers spent much of their day at 4G security: no user-plane integrity, identity privacy reduced. Fix: a policy to trigger a fresh 5G-AKA (promoting to a native context) when a UE returns to NR after a fallback, plus a KPI tracking the mapped-context population. "Seamless" mobility had quietly become "permanently downgraded" for the network's most active users.
Confirm a re-auth policy promotes mapped → native on return to 5G.
Track mapped-context share as a KPI.
Verify N26 is IPsec-protected.
For critical slices, confirm fallback is restricted or re-auth enforced.
Confirm COUNT freshness is correct across the boundary.
★ Chapter Summary
Interworking lets subscribers move between 5GS and EPS; N26 carries the security context (seamless), or N26-less forces re-auth (always native).
A mapped context (converted from the other system) carries the source's security ceiling; a native context comes from a fresh authentication.
Keys map via one-way KDFs (K_AMF ↔ K_ASME), but freshness/strength don't appear from mapping.
Every LTE-vs-5G difference (SUCI, UP integrity, home control, SBA/SEPP) is a property a mapped context lacks until a native 5G auth runs.
Downgrade attacks force fallback to strip 5G protections; re-auth policy, restricted fallback, and mapped-context monitoring defend against it. EPS Fallback makes this path very common.
? Review Questions
What does N26 carry, and how does its absence change interworking security?
Distinguish native and mapped contexts and why the difference matters.
Explain key mapping and why a mapped key can't be "fresher" than its source.
List four security properties a mapped (4G-origin) context lacks compared to a native 5G context.
Describe the generation-downgrade attack and three defenses.
Why does EPS Fallback make 5GS→EPS handover security broadly relevant?
What COUNT-handling danger exists at the boundary, and how is it avoided?
A frequent caller stays on a mapped context all day. Diagnose and fix.
🧪 Mini lab — measure the downgrade
On paper or in a lab with both 5G and LTE: (1) Trace a UE moving from NR to LTE and back, noting whether the 5G context is native or mapped after return. (2) For each state, list which of these are active: SUCI privacy, UP integrity, AUSF home control, SBA-era core security. (3) Design the re-authentication policy that would promote a mapped context to native on return, and the KPI that would tell you how many subscribers are currently on mapped contexts. (4) Decide which of your slices (e.g., an enterprise/IoT slice) should forbid LTE fallback entirely and why. You've now turned "seamless mobility" into a measurable security property.