Methods, systems, and computer readable media for delegated authorization at security edge protection proxy (SEPP)

A system for delegated authorization at a security edge protection proxy (SEPP), the system comprising:

• a SEPP including at least one processor and a memory;
• and
• an access token authorization client proxy implemented by the at least one processor for intercepting, from a first consumer network function (NF) separate from the SEPP and that does not support access-token-based authorization, a first service based interface (SBI) service request lacking an access token and for accessing a service provided by a first producer NF that requires access-token-based authorization, obtaining the first access token on behalf of the first consumer NF, and using the first access token to enable the first consumer NF to access the service provided by the first producer NF, wherein obtaining the first access token on behalf of the first consumer NF includes signaling with an NF repository function (NRF) that operates as an access token authorization server, to obtain the first access token from the NRF, wherein the NRF is a 5G NRF separate from the SEPP that stores NF profiles of producer NFs registered with the NRF and signaling with the NRF to obtain the first access token includes:
• forwarding request to additional separate NRF, If required, for validation;
• generating an access token request on behalf of the first consumer NF;
• transmitting the access token request to the NRF;
• and
• receiving, from the NRF, an access token response including the first access token and the access token authorization client proxy is further configured for using the first access token to access the service provided by the first producer NF by inserting, the first access token in the first SBI request and forwarding, the first SBI request to the first producer NF.

A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer controls the computer to perform steps comprising:

• intercepting, by a security edge protection proxy (SEPP) and from a consumer network function (NF) separate from the SEPP and that does not support access token based authorization, a service based interface (SBI) service request lacking an access token and for accessing a service provided by a producer NF that requires access token based authorization;
• operating, by the SEPP, as an access token authorization client proxy to obtain a first access token on behalf of the consumer NF, wherein operating as the access token authorization client proxy includes signaling, by the SEPP and with an NF repository function (NRF) that operates as an access token authorization server, to obtain the first access token from the NRF, wherein the NRF is a 5G NRF separate from the SEPP that stores NF profiles of producer NFs registered with the NRF and signaling with the NRF to obtain the first access token includes:
• forwarding request to additional separate NRF, if required, for validation;
• generating, by the SEPP, an access token request on behalf of the first consumer NF;
• transmitting the access token request from the SEPP to the NRF;
• and
• receiving, by the SEPP and from the NRF, an access token response including the first access token;
• and
• using the first access token to enable the consumer NF to access the service provided by the producer NF, wherein using the first access token to access the service provided by the first producer NF includes inserting, by the SEPP, the first access token in the first SBI request and forwarding, by the SEPP, the first SBI request to the first producer NF.