Authorization of network request

An apparatus operating as a network function consumer and comprising at least one processing core, at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processing core, cause the apparatus at least to:

• transmit a service request for a service at a network function provider to a service communication proxy, wherein the service request includes an additional flag for additional authorization of the service communication proxy for the request and wherein the service communication proxy selects a network function provider which offer the service requested by the network function consumer from a profile message distributed by a network repository function;
• receive, from the service communication proxy, an authorization token specific to the service request, the authorization token distinct from an access token authorizing access to the service at the network function provider, wherein the network repository function is configured to request separate authorization using the authorization token in response to determination that the service communication proxy has sent more than a predefined number of requests within a predetermined time period and wherein the separate authorization is further based on at least one criterion, wherein the at least one criterion comprises whether an identity of the network function consumer is comprised in a list of network function consumer identities, and whether the network function provider is of a type for which authorization tokens shall be used;
• provide the authorization token back to the service communication proxy after cryptographically signing the authorization token using private key, wherein the network repository function provides the access token the service communication proxy responsive to validating signature of the authorization token using public key, and wherein the authorization token comprises a validity period indication, an identity of an application programming interface of the service at the network function provider, scope, additional scope defining the scope at a different level of granularity from the scope and a resource identifier;
• and
• receive, access to the service from the network function provider responsive to network function provider validating the access token received from the service communication proxy.

A method, comprising:

• receiving, in an apparatus, from a service communication proxy, a discovery message describing a service requested by a network function consumer;
• transmitting, responsive to the discovery message a profile message describing network function provider entities which offer the service requested by the network function consumer, wherein the service communication proxy selects a network function provider from the profile message;
• receiving, in the apparatus, from a service communication proxy, a request for an access token for the selected network function provider;
• determining, responsive to receiving the request for the access token whether a separate authorization is needed for the service communication proxy based on whether an identity of the network function consumer is comprised in a list of network function consumer identities and whether the network function provider is of a type for which authorization tokens shall be used;
• transmitting, responsive to determining that the separate authorization is needed, an authorization token, distinct from the access token, to the service communication proxy, the authorization token being specific to the request, wherein the separate authorization using the authorization token is needed in response to determination that the service communication proxy has sent more than a predefined number of requests within a predetermined time period, and wherein the separate authorization is performed by a network function consumer by signing the authorization token using its private key and transmitting a signed authorization token to the service communication proxy;
• verifying, the signed authorization token received from the service communication proxy using a public key of the network function consumer;
• and providing the access token to the service communication proxy responsive to verifying the signed authorization token which enables the network function provider to provide service requested by the network function consumer after validating the access token received from the service communication proxy.

A method, comprising:

• providing, by an apparatus, a service request for a service at a network function provider to a service communication proxy, wherein the service communication proxy selects a network function provider which offer the service requested by the network function consumer from a profile message distributed by a network repository function;
• receiving, from the service communication proxy, an authorization token specific to the service request, the authorization token distinct from an access token authorizing access to the service at the network function provider, wherein the network repository function is configured to request separate authorization using the authorization token in response to determination that the service communication proxy has sent more than a predefined number of requests within a predetermined time period, and wherein the separate authorization is further based on at least one criterion, wherein the at least one criterion comprises whether an identity of the network function consumer is comprised in a list of network function consumer identities, and whether the network function provider is of a type for which authorization tokens shall be used;
• providing the authorization token back to the service communication proxy after cryptographically signing the authorization token using private key, wherein the network repository function provides the access token the service communication proxy responsive to validating signature of the authorization token using public key, and wherein the authorization token comprises a validity period indication, an identity of an application programming interface of the service at the network function provider, scope, additional scope defining the scope at a different level of granularity from the scope and a resource identifier;
• and
• receiving, access to the service from the network function provider responsive to network function provider validating the access token received from the service communication proxy.