Apparatus, method and computer program

Abstract

The subject disclosure relates to an apparatus configured to: receive (900) a request originating from a network function service consumer in a source network and relating to a network function service producer in a target network, where the request comprises at least one forwarding node identifier identifying a forwarding node that has forwarded the request; determining (902) whether the at least one forwarding node identifier is part of a list of at least one of allowed or prohibited forwarding node identifiers; and controlling (904) the request based on the determination.

Description

Technical Field

[0001] Various example embodiments of the subject disclosure are directed to apparatus, methods, and computer programs for controlling (eg, allowing or disallowing) requests originating from network function service consumers and involving network function service producers in a communication system. Background Art

[0002] A communication system can be viewed as a facility that enables communication sessions between two or more entities (eg, communication devices, base stations, and / or other nodes) by providing carrier waves between the entities involved in the communication path.

[0003] The communication system may be a wireless communication system. Examples of wireless systems include public land mobile networks (PLMNs) operating based on radio standards (e.g., standards provided by 3GPP), satellite-based communication systems, and different wireless local networks. The wireless local network may be implemented, for example, as a wireless local area network (WLAN). Wireless systems may typically be divided into cells and are therefore often referred to as cellular systems.

[0004] Communication systems and associated equipment typically operate in accordance with a given standard or specification, which specifies what the various entities associated with the system are allowed to do and how it should be achieved. Communication protocols and / or parameters for the connection are also typically defined. An example of a set of standards is the so-called 5G standards. Summary of the invention

[0005] Several aspects of various example embodiments are detailed below.

[0006] According to one aspect, an apparatus is provided, comprising at least one processor and at least one memory, the memory storing instructions that, when executed by the at least one processor, cause the apparatus to at least: receive a request originating from a network function service consumer in a source network and associated with a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node that has forwarded the request; determine whether the at least one forwarding node identifier is part of a list of at least one of allowed or prohibited forwarding node identifiers; and control the request based on the determination.

[0007] The at least one memory may store instructions that, when executed by the at least one processor, cause the apparatus to at least: determine whether the at least one forwarding node identifier is part of an allowed forwarding node identifier list or is not part of a prohibited forwarding node identifier list; and allow the request based on the determination.

[0008] The at least one memory may store instructions that, when executed by the at least one processor, cause the apparatus to at least: determine that the at least one forwarding node identifier is not part of an allowed forwarding node identifier list or is part of a prohibited forwarding node identifier list; and prohibit the request based on the determination.

[0009] The at least one forwarding node identifier may identify at least one network that provides roaming services to other networks; and the operator of the other network may have a roaming agreement with the operator of the at least one network, or the operator of the other network may belong to the same operator group as the operator of the at least one network.

[0010] The request may include at least one of the following: a forwarding node identifier identifying the forwarding node that first forwards the request from the network function service consumer in the source network; or a forwarding node identifier identifying the forwarding node that finally forwards the request to the network function service producer in the target network.

[0011] The request may include at least one of the following: a forwarding node identifier identifying a forwarding node that first forwards the request received from the network function service consumer in the source network through a service communication agent; or a forwarding node identifier identifying a forwarding node that finally forwards the request sent to the network function service producer in the target network through a service communication agent.

[0012] The forwarding node identifier of the forwarding node that first forwards the request from the network function service consumer in the source network can be added to the request by the network function service consumer, the service communication agent or the security edge protection agent in the source network; or the forwarding node identifier of the forwarding node that finally forwards the request to the network function service producer in the target network can be added to the request by the security edge protection agent in the target network.

[0013] The allowed or forbidden forwarding node identifier list may be one of a plurality of allowed or forbidden forwarding node identifier lists.

[0014] The plurality of allowed or prohibited forwarding node identifier lists may include at least one of: an allowed or prohibited forwarding node identifier list that forwards the request first; and an allowed or prohibited forwarding node identifier list that forwards the request last.

[0015] The request may be received from a roaming hub, a service communication agent, or a security edge protection agent.

[0016] The request may include at least one of: a discovery request for discovering the network function service producer in the target network; an access token request for obtaining authorization to access the services of the network function service producer in the target network; or a service request for receiving the services produced by the network function service producer in the target network.

[0017] The at least one memory may store instructions that, when executed by the at least one processor, cause the apparatus to at least: receive the allowed or prohibited forwarding node identifier list from the target network; and store the allowed or prohibited forwarding node identifier list.

[0018] The list of allowed or forbidden forwarding node identifiers may be specific to at least one of: a target network, a source network, a network function service consumer type, a network function service producer type, a service type, an instance of a network function service consumer, or an instance of a network function service producer.

[0019] The at least one memory may store instructions which, when executed by the at least one processor, cause the apparatus to at least: store a network function service producer profile; store the allowed or prohibited forwarding node identifier list within the network function service producer profile; and register the network function service producer profile with a network repository function.

[0020] The at least one memory may store instructions that, when executed by the at least one processor, cause the apparatus to at least: store roaming profiles; and store the allowed or forbidden forwarding node identifier list in one of the roaming profiles.

[0021] The at least one memory may store instructions which, when executed by the at least one processor, cause the apparatus to at least: store a network function service producer profile; store a roaming profile identifier list identifying roaming profiles within the network function service producer profile; and register the network function service producer profile with a network repository function.

[0022] The at least one memory may store instructions which, when executed by the at least one processor, cause the apparatus to at least: store a network function service producer profile; store within the network function service producer profile an indication that the network function service producer is discoverable and accessible by a network function service consumer in a source network; and register the network function service producer profile with a network repository function.

[0023] The at least one memory may store instructions that, when executed by the at least one processor, cause the device to at least: determine whether the at least one forwarding node identifier is part of an allowed or prohibited hub identifier list using an allowed or prohibited forwarding node identifier list within a network function service producer profile.

[0024] The at least one memory may store instructions that, when executed by the at least one processor, cause the apparatus to at least: determine whether the received at least one forwarding node identifier is part of an allowed or forbidden forwarding node identifier list using an allowed or forbidden forwarding node identifier list within a roaming profile or within a local configuration.

[0025] The apparatus may be configured to perform the functions of a core network function.

[0026] The core network function may be the network function service producer, a network repository function, a service communication agent, or a security edge protection agent.

[0027] The device may be a network repository function; the request may be an access token request including at least one forwarding node identifier; the at least one memory may store instructions which, when executed by the at least one processor, cause the device to at least: determine that the at least one forwarding node identifier is part of an allowed forwarding node identifier list; allow the request based on the determination; and send an access token including the at least one forwarding node identifier to the network function service consumer.

[0028] The access token may indicate whether the at least one forwarding node identifier identifies a forwarding node that first forwarded the request from the network function service consumer in the source network or a forwarding node that last forwarded the request to the network function service producer in the target network.

[0029] The device may be the network function service producer; the request may be a service request, the service request including at least one first forwarding node identifier identifying the forwarding node that has forwarded the request, and the service request including an access token, the access token including at least one second forwarding node identifier, the second forwarding node identifier being part of an allowed forwarding node identifier list; the at least one memory may store instructions, which when executed by the at least one processor causes the device to at least: determine that the at least one first forwarding node identifier matches the at least one second forwarding node identifier; and allow the request based on the determination.

[0030] The forwarding node can be a roaming hub.

[0031] According to one aspect, a device is provided, comprising means for: receiving a request originating from a network function service consumer in a source network and associated with a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node that has forwarded the request; determining whether the at least one forwarding node identifier is part of at least one list of allowed or prohibited forwarding node identifiers; and controlling the request based on the determination.

[0032] According to one aspect, a device is provided, the device comprising a circuit configured to perform the following operations: receive a request originating from a network function service consumer in a source network and associated with a network function service producer in a target network, wherein the request includes at least one forwarding node identifier identifying a forwarding node that has forwarded the request; determine whether the at least one forwarding node identifier is part of at least one list of allowed or prohibited forwarding node identifiers; and control the request based on the determination.

[0033] According to one aspect, a method is provided, comprising: receiving a request originating from a network function service consumer in a source network and associated with a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node that has forwarded the request; determining whether the at least one forwarding node identifier is part of at least one list of allowed or prohibited forwarding node identifiers; and controlling the request based on the determination.

[0034] The method may be performed by a device.

[0035] The method may include determining that the at least one forwarding node identifier is part of an allowed forwarding node identifier list or is not part of a forbidden forwarding node identifier list; and allowing the request based on the determination.

[0036] The method may include determining that the at least one forwarding node identifier is not part of an allowed forwarding node identifier list or is part of a forbidden forwarding node identifier list; and prohibiting the request based on the determination.

[0037] The at least one forwarding node identifier may identify at least one network that provides roaming services to other networks; and the operator of the other network may have a roaming agreement with the operator of the at least one network, or the operator of the other network may belong to the same operator group as the operator of the at least one network.

[0038] The request may include at least one of the following: a forwarding node identifier identifying the forwarding node that first forwards the request from the network function service consumer in the source network; or a forwarding node identifier identifying the forwarding node that finally forwards the request to the network function service producer in the target network.

[0039] The request may include at least one of the following: a forwarding node identifier identifying a forwarding node that first forwards the request received from the network function service consumer in the source network through a service communication agent; or a forwarding node identifier identifying a forwarding node that finally forwards the request sent to the network function service producer in the target network through a service communication agent.

[0040] The forwarding node identifier of the forwarding node that first forwards the request from the network function service consumer in the source network can be added to the request by the network function service consumer, the service communication agent or the security edge protection agent in the source network; or the forwarding node identifier of the forwarding node that finally forwards the request to the network function service producer in the target network can be added to the request by the security edge protection agent in the target network.

[0041] The allowed or forbidden forwarding node identifier list may be one of a plurality of allowed or forbidden forwarding node identifier lists.

[0042] The plurality of allowed or prohibited forwarding node identifier lists may include at least one of: an allowed or prohibited forwarding node identifier list that forwards the request first; and an allowed or prohibited forwarding node identifier list that forwards the request last.

[0043] The request may be received from a roaming hub, a service communication agent, or a security edge protection agent.

[0044] The request may include at least one of: a discovery request for discovering the network function service producer in the target network; an access token request for obtaining authorization to access the services of the network function service producer in the target network; or a service request for receiving the services produced by the network function service producer in the target network.

[0045] The method may include receiving the allowed or forbidden forwarding node identifier list from the target network; and storing the allowed or forbidden forwarding node identifier list.

[0046] The list of allowed or forbidden forwarding node identifiers may be specific to at least one of: a target network, a source network, a network function service consumer type, a network function service producer type, a service type, an instance of a network function service consumer, or an instance of a network function service producer.

[0047] The method may include storing a network function service producer profile; storing the allowed or prohibited forwarding node identifier list within the network function service producer profile; and registering the network function service producer profile with a network repository function.

[0048] The method may comprise storing roaming profiles; and storing the allowed or forbidden forwarding node identifier list in one of the roaming profiles.

[0049] The method may include storing a network function service producer profile; storing a roaming profile identifier list identifying roaming profiles within the network function service producer profile; and registering the network function service producer profile with a network repository function.

[0050] The method may include storing a network function service producer profile; storing within the network function service producer profile an indication that the network function service producer is discoverable and accessible by a network function service consumer in a source network; and registering the network function service producer profile with a network repository function.

[0051] The method may include determining whether the at least one forwarding node identifier is part of an allowed or forbidden list of hub identifiers using an allowed or forbidden list of forwarding node identifiers within a network function service producer profile.

[0052] The method may comprise determining whether the received at least one forwarding node identifier is part of a list of allowed or forbidden forwarding node identifiers using a list of allowed or forbidden forwarding node identifiers within a roaming profile or within a local configuration.

[0053] The apparatus for executing the method may be configured to perform the functions of a core network function.

[0054] The core network function may be the network function service producer, a network repository function, a service communication agent, or a security edge protection agent.

[0055] The core network function may be the network function service producer, a network repository function, a service communication agent, or a security edge protection agent.

[0056] The device performing the method may be a network repository function; the request may be an access token request including at least one forwarding node identifier; and the method may include: determining that the at least one forwarding node identifier is part of an allowed forwarding node identifier list; allowing the request based on the determination; and sending an access token including the at least one forwarding node identifier to the network function service consumer.

[0057] The access token may indicate whether the at least one forwarding node identifier identifies a forwarding node that first forwarded the request from the network function service consumer in the source network or a forwarding node that last forwarded the request to the network function service producer in the target network.

[0058] The device may be the network function service producer; the request may be a service request, the service request including at least one first forwarding node identifier identifying the forwarding node that has forwarded the request, and the service request including an access token, the access token including at least one second forwarding node identifier, the second forwarding node identifier being part of an allowed forwarding node identifier list; and the method may include: determining that the at least one first forwarding node identifier matches the at least one second forwarding node identifier; and allowing the request based on the determination.

[0059] The forwarding node can be a roaming hub.

[0060] According to one aspect, a computer program is provided, comprising computer executable code, which, when executed on at least one processor, is configured to: receive a request originating from a network function service consumer in a source network and associated with a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node that has forwarded the request; determine whether the at least one forwarding node identifier is part of at least one list of allowed or prohibited forwarding node identifiers; and control the request based on the determination.

[0061] According to one aspect, a device is provided, comprising at least one processor and at least one memory, wherein the memory stores instructions that, when executed by the at least one processor, cause the device to at least: receive a request originating from a network function service consumer in a source network and associated with a network function service producer in a target network, wherein the request includes at least one forwarding node identifier identifying a forwarding node that has forwarded the request; and send another request to a network function repository, wherein the other request includes the at least one forwarding node identifier identifying the forwarding node that has forwarded the request.

[0062] The request may be a service request and the other request may be at least one of a discovery request or an access token request.

[0063] According to one aspect, an apparatus is provided, comprising components for performing the following operations: receiving a request originating from a network function service consumer in a source network and associated with a network function service producer in a target network, wherein the request includes at least one forwarding node identifier identifying a forwarding node that has forwarded the request; and sending another request to a network function repository, wherein the other request includes the at least one forwarding node identifier identifying the forwarding node that has forwarded the request.

[0064] According to one aspect, an apparatus is provided, comprising a circuit configured to: receive a request originating from a network function service consumer in a source network and associated with a network function service producer in a target network, wherein the request includes at least one forwarding node identifier identifying a forwarding node that has forwarded the request; and send another request to a network function repository, wherein the another request includes the at least one forwarding node identifier identifying the forwarding node that has forwarded the request.

[0065] According to one aspect, a method is provided, comprising: receiving a request originating from a network function service consumer in a source network and associated with a network function service producer in a target network, wherein the request includes at least one forwarding node identifier identifying a forwarding node that has forwarded the request; and sending another request to a network function repository, wherein the other request includes the at least one forwarding node identifier identifying the forwarding node that has forwarded the request.

[0066] The request may be a service request and the other request may be at least one of a discovery request or an access token request.

[0067] According to one aspect, a computer program is provided, the computer program comprising computer executable code, which, when executed on at least one processor, is configured to: receive a request originating from a network function service consumer in a source network and related to a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node that has forwarded the request; and send another request to a network function repository, the other request comprising the at least one forwarding node identifier identifying the forwarding node that has forwarded the request.

[0068] According to one aspect, a computer readable medium is provided, on which program instructions for executing at least one of the above methods are stored.

[0069] According to one aspect, a non-transitory computer-readable medium having stored thereon program instructions for executing at least one of the above methods is provided.

[0070] According to one aspect, a non-volatile tangible storage medium is provided, on which program instructions for executing at least one of the above methods are stored.

[0071] In the above, many different aspects of various exemplary embodiments have been described. It should be understood that further aspects can be provided by combining any two or more of the above aspects.

[0072] Various other aspects are also described in the following detailed description and claims.

[0073] List of abbreviations

[0074] AF: Application Function

[0075] AMF: Access and Mobility Management Function

[0076] API: Application Programming Interface

[0077] BS: Base Station

[0078] CU: Centralized Unit

[0079] DL: Downlink

[0080] DU: Distributed Unit

[0081] gNB: gNodeB

[0082] GSM: Global System for Mobile Communications

[0083] GSMA: Global System for Mobile Communications Association

[0084] HSS: Home Subscriber Server

[0085] IoT: Internet of Things

[0086] IPx: Internet Protocol Exchange

[0087] LTE: Long Term Evolution

[0088] MAC: Media Access Control

[0089] MS: Mobile Station

[0090] MTC: Machine Type Communication

[0091] NEF: Network Exposure Function

[0092] NF: Network Function

[0093] NFc: Network Function Service Consumer

[0094] NFp: Network Function Service Producer

[0095] NR: New Radio

[0096] NRF: Network Repository Function

[0097] NSSAIA: Network Slice Selection Auxiliary Information

[0098] PDU: Packet Data Unit

[0099] PLMN: Public Land Mobile Network

[0100] RAM: Random Access Memory

[0101] (R)AN: (Radio) Access Network

[0102] RHUB: Roaming Hub

[0103] ROM: Read Only Memory

[0104] SBA: Service Based Architecture

[0105] SCP: Service Communication Proxy

[0106] SEPP: Security Edge Protection Proxy

[0107] SMF: Session Management Function

[0108] SNPN: Standalone Non-Private Network

[0109] SUPI: Subscription Persistent Identifier

[0110] TR: Technical Report

[0111] TS: Technical Specification

[0112] UDR: Unified Data Repository

[0113] UE: User Equipment

[0114] UMTS: Universal Mobile Telecommunications System

[0115] 3GPP: Third Generation Partnership Project

[0116] 5G: Fifth Generation

[0117] 5GC: 5G Core Network

[0118] 5GS: 5G System BRIEF DESCRIPTION OF THE DRAWINGS

[0119] Some example embodiments will now be described, by way of example only, with reference to the accompanying drawings, in which:

[0120] Figure 1 A schematic representation of a 5G system is shown;

[0121] Figure 2 A schematic representation of the control arrangement is shown;

[0122] Figure 3 A schematic representation of a user equipment is shown;

[0123] Figure 4 A signaling diagram showing a process for controlling (e.g. allowing or disabling) discovery requests originating from a network function service consumer and associated with a network function service producer;

[0124] Figure 5 A signaling diagram showing a process for controlling (e.g. allowing or disabling) a service request originating from a network function service consumer and associated with a network function service producer;

[0125] Figure 6 A signaling diagram showing a process for controlling (e.g. allowing or disallowing) access token requests originating from a network function service consumer and associated with a network function service producer;

[0126] Figure 7 A signaling diagram showing a process for controlling (e.g. allowing or disabling) a service request originating from a network function service consumer and associated with a network function service producer;

[0127] Figure 8 A signaling diagram showing a process for controlling (e.g. allowing or disabling) a service request originating from a network function service consumer and associated with a network function service producer;

[0128] Fig. 9 A block diagram illustrating a method for controlling (e.g., allowing or disabling) a service request originating from a network function service consumer and associated with a network function service producer, the method being performed by a device such as a network repository function, a network function service producer, a service communication agent, or a security edge protection agent;

[0129] Fig.10 A block diagram showing a method for controlling (e.g., allowing or disabling) a service request originating from a network function service consumer and associated with a network function service producer, the method being performed by a device such as a service communication agent; and

[0130] Fig.11 A schematic diagram of a non-volatile storage medium storing instructions that, when executed by a processor, allow the processor to perform Fig. 9 and 10 One or more steps of a method. DETAILED DESCRIPTION

[0131] In the following, various exemplary embodiments will be explained with reference to a mobile communication device capable of communicating via a wireless cellular system and a mobile communication system providing services for such mobile communication devices. Figure 1 , 2 and 3 briefly explain certain general aspects of wireless communication systems, their access systems and mobile communication devices to help understanding the technology on which the examples are based.

[0132] Figure 1 A schematic representation of a 5G system (5GS) is shown. The 5GS may include a public land mobile network (PLMN). The PLMN may include a user equipment (UE), a (radio) access network ((R)AN), a 5G core network (5GC), one or more application functions (AFs), and one or more data networks (DNs).

[0133] The 5G(R)AN may include one or more gNodeB (gNB) distributed unit functions connected to one or more gNodeB (gNB) centralized unit functions.

[0134] 5GC may include access and mobility management function (AMF), session management function (SMF), authentication server function (AUSF), user data management (UDM), user plane function (UPF), network exposure function (NEF), unified data repository (UDR), application function (AF), network repository function (NRF) and / or security edge protection proxy (SEPP).

[0135] Figure 2 A method for controlling a (R)AN or a 5GC (e.g. Figure 1 2. The example of a control device 200 for controlling the functions of a (R)AN or 5GC) shown in FIG. The control device may include at least one random access memory (RAM) 211a, at least one read-only memory (ROM) 211b, at least one processor 212, 213, and an input / output interface 214. At least one processor 212, 213 may be coupled to the RAM 211a and the ROM 211b. At least one processor 212, 213 may be configured to execute appropriate software code 215. The software code 215 may, for example, allow one or more steps to be executed to perform one or more aspects described herein. The software code 215 may be stored in the ROM 211b. The control device 200 may be interconnected with another control device 200 that controls another function of a 5G (R)AN or 5GC. In some example embodiments, each function of the (R)AN or 5GC includes a control device 200. In an alternative example embodiment, two or more functions of the (R)AN or 5GC may share a control device.

[0136] Figure 3 An example of a UE 300 is shown, for example Figure 1 UE 300 is a UE shown in . UE 300 may be provided by any device capable of sending and receiving radio signals. Non-limiting examples include user equipment, mobile stations (MS) or mobile devices, such as mobile phones or so-called "smart phones", computers equipped with wireless interface cards or other wireless interface facilities (such as USB dongles), personal data assistants (PDAs) or tablets equipped with wireless communication capabilities, machine type communication (MTC) devices, cellular Internet of Things (CIoT) devices, or any combination of these devices or similar devices. UE 300 may provide communications, such as data for carrying communications. The communications may be one or more of voice, email, text messaging, multimedia, data, machine data, etc.

[0137] The UE 300 may receive signals over the air or radio interface 307 by appropriate means for receiving, and may transmit signals by appropriate means for transmitting radio signals. Figure 3 In the mobile device, the transceiver arrangement is schematically designated by block 306. The transceiver arrangement 306 may be provided, for example, by a radio part and an associated antenna arrangement. The antenna arrangement may be arranged internally or externally to the mobile device.

[0138] The UE 300 may be equipped with at least one processor 301, at least one memory ROM 302a, at least one RAM 302b and other possible components 303 for software and hardware assistance to perform the tasks it is designed to perform, including controlling access to and communication with access systems and other communication devices. The at least one processor 301 is coupled to the RAM 302b and the ROM 302a. The at least one processor 301 may be configured to execute appropriate software code 308. The software code 308 may, for example, allow the execution of one or more aspects described herein. The software code 308 may be stored in the ROM 302a.

[0139] The processor, memory and other related control means may be provided on an appropriate circuit board and / or in a chipset. This feature is indicated by reference 304. The device may optionally have a user interface, such as a keyboard 305, a touch sensitive screen or touch sensitive pad, a combination thereof, etc. Depending on the type of device, one or more displays, speakers and microphones may be provided.

[0140] 5GC is defined as a service-based architecture (SBA) where one or more NF service producers (NFp) expose services to one or more NF service consumers (NFc). NFp can register NFp profile with NRF. NFp profile may include NF level specific information and a list of NF service instances supported by NFp and their associated attributes.

[0141] NFc or Service Communication Agent (SCP) can discover NFp by performing NF Discovery procedure to NRF, where query parameters describe the services or characteristics of the NFp they wish to discover. NRF can return the NF profiles of candidate NFp matching the query parameters in NF Discovery Response.

[0142] During the NF discovery process, the NRF can ensure that the requesting NFc is authorized to discover the services or features of the NFp they wish to discover. This can be achieved by including authorization parameters in the NFp profile registered with the NRF. The authorization parameters can indicate which NFc(s) are allowed to discover and access NFp services.

[0143] The authorization parameters may include, for example, allowed PLMN (Public Land Mobile Network), allowed SNPN (Standalone Non-Private Network), allowed NF Type (Network Function Type), allowed NF Domain, allowed NSSAIS (Network Slice Selection Assistance Information). The authorization parameters may be included at the NFp instance level and / or the NFp service instance level.

[0144] When the Oauth2.0 framework is used to authorize access to 5GC services, the NRF can use the authorization parameters to decide whether to grant an access token to the NFc that requested the access token to access the NFp service.

[0145] A roaming hub (RHUB) may refer to a commercial entity that may be contracted by a network operator to enable fast and efficient access to various roaming agreements. An RHUB may have many roaming agreements and technical interconnections that have been fully negotiated and put into operation with other network operators, and the contracting network operator "buys" these agreements (e.g., some or all). Because negotiating roaming agreements with all the network operators in the world can require a lot of time and resources, some contracting network operators use RHUBs to quickly access extensive roaming coverage. From a commercial and technical perspective, the RHUB may act on behalf of the contracting operator and be financially responsible for the roaming agreements enabled through them. When an RHUB is used, the commercial agreements may not be signed directly between the network operators, but rather between the RHUB and the home and visited network operators.

[0146] Many network operators may have or have partners in one or more countries, thus forming a network operator group. For reasons of cost, efficiency and security, these network operator groups may have a common, centralized roaming aggregation point. The roaming aggregation point may form a network operator group RHUB, and may establish centralized roaming services (e.g., business and technical services) between all network operator group members and with all or some of the roaming partners of the network operator group (e.g., each roaming partner of the network operator group RHUB can reach each network operator group member, and vice versa).

[0147] GSMA defines the concept of a hosted SEPP (Security Edge Protection Proxy), which is a SEPP that a network operator outsources to a provider outside the network (for example, to an Internet Protocol Exchange (IPX) provider or a RHUB operator).

[0148] In a deployment using RHUB, several issues may arise regarding service access control and authorization of service requests across networks.

[0149] How can a target network operator control (e.g., allow or prohibit) service requests received through an RHUB from a NFc of a source network operator with which it has no direct roaming agreement?

[0150] How can the target network operator allow NFp to be discovered and accessed by NFc if the service request comes from RHUBx which has a roaming agreement with the target network operator, but prohibit if the service request comes from RHUBy which has no roaming agreement with the target network operator?

[0151] If a service request comes from a NFc of a source network operator that has no direct roaming agreement with a target network operator, but is forwarded by a network operator group RHUB of the network operator group to which the target network operator belongs, how can the target network operator allow the NFp to be discovered and accessed by the NFc?

[0152] One or more aspects of the subject disclosure propose enhancements to the discovery and service access control process to address one or more of the above-mentioned issues.

[0153] In the following, NFc may be located in the source network, NFp may be located in the target network, and NRF may be located in the target network. The source network is different from the target network. RHUB may be located in the source network, the intermediate network, or the target network.

[0154] One or more aspects of the subject disclosure enhance the discovery and service access control process by enabling an NRF or NFp to control (e.g., allow or disallow) requests received from an NFc through an RHUB, where a target network operator may or may not have a direct service level agreement or roaming agreement with a source network operator.

[0155] The NRF or NFp may store multiple lists of allowed and / or prohibited RHUB IDs.

[0156] The allowed and / or forbidden RHUB ID list may be specific to at least one of: a target network, a source network, a network function service consumer type, a network function service producer type, a service type, an instance of a network function service consumer, or an instance of a network function service producer.

[0157] The allowed and / or forbidden network group operator RHUB ID list may include an allowed and / or forbidden first-forwarding RHUB ID list (eg, in the signaling path between NFc and NFp).

[0158] The RHUB ID may identify at least one network that provides roaming services to other networks. The operators of the other networks may sign a roaming agreement with the operator of the at least one network. Alternatively, the operators of the other networks may belong to the same operator group as the operator of the at least one network.

[0159] The RHUB ID may include a PLMN ID, a SNPN ID, or a FQDN.

[0160] In an example embodiment, the NFp may receive an allowed and / or prohibited RHUB ID list from the target network. The NFp may store the allowed and / or prohibited RHUB ID list in a NFp profile. The NFp may register the NFp profile with the NRF. The NFp may store the allowed and / or prohibited RHUB ID list outside the NFp profile (e.g., in addition to the NFp profile). The NFp may store the allowed and / or prohibited RHUB ID list in a local configuration.

[0161] In an example embodiment, the NRF may receive an allowed and / or prohibited RHUB ID list from the target network. The NRF may store the allowed and / or prohibited RHUB ID list outside of the NFp profile (e.g., in addition to the NFp profile). The NRF may store the allowed and / or prohibited RHUB ID list in a roaming profile or a local configuration.

[0162] The NRF may store roaming profiles. Each roaming profile may be identified by a roaming profile ID. Each roaming profile may include a list of allowed and / or prohibited RHUB IDs. Each roaming profile may be associated with a NFc type, a NFp type, a NFp service, or a NFc instance or a NFp instance. The NRF may store a list of allowed and / or prohibited RHUB IDs in a roaming profile.

[0163] The NFp may store a roaming profile ID list identifying the roaming profile stored at the NRF. The NFp may store the roaming profile ID list or an identifier of the roaming profile ID list in the NFp profile. The NFp may register the NFp profile with the NRF.

[0164] The NFp may store in the NFp profile an indication that the NFp may be discovered and accessed by a NFc in a source network operator different from the target network operator. The indication may be a Boolean value (eg, a value of yes or no).

[0165] The NFp may store an indication of the allowed or forbidden RHUB ID list using within the NFp profile (eg, local / distributed determination) or outside (eg, in addition to) the NFp profile (eg, global / central determination). The indication may be stored within the NFp profile.

[0166] In an example embodiment, the NRF may receive a request originating from a NFc in a source network and associated with a NFp in a target network.

[0167] The request may include at least one RHUB ID. The at least one RHUB ID may include at least one of a first forwarding RHUB ID or a last forwarding RHUB ID. The first forwarding RHUB ID may be added to the request by an NFc, an SCP, or a SEPP in the source network. The last forwarding RHUB ID may be added to the request by a SEPP in the target network.

[0168] The request may be received from the RHUB, SCP or SEPP.

[0169] The request may include at least one of a discovery request or an access token request.

[0170] The NRF may control (e.g., allow or prohibit) the request as follows. For example, the NRF may determine whether to allow or prohibit the request based on (e.g., using) an allowed or prohibited RHUB ID list stored at the NRF. The allowed or prohibited RHUB ID list may be stored at the NRF in an NFp profile, a roaming profile, or a local configuration.

[0171] The NRF may retrieve a list of allowed or prohibited RHUB IDs stored at the NRF.

[0172] The NRF may determine whether the at least one RHUB ID is part of an allowed or forbidden RHUB ID list stored at the NRF. If the at least one RHUB ID is part of an allowed RHUB ID list stored at the NRF, the NRF may allow the request. If the at least one RHUB ID is part of a forbidden RHUB ID list stored at the NRF, the NRF may prohibit the request.

[0173] The NRF may check the last forwarded RHUB ID and / or the first forwarded RHUB ID or all RHUB IDs, depending on the local configuration. If the NRF stores an allowed first forwarded RHUB ID list, the NRF may check if the first forwarded RHUB ID is part of the allowed first forwarded RHUB ID list. If the NRF stores an allowed last forwarded RHUB ID list, the NRF may check if the last forwarded RHUB ID is part of the allowed last forwarded RHUB ID list. If the NRF stores an allowed first forwarded RHUB ID list and an allowed last forwarded RHUB ID list, the NRF may check if the first forwarded RHUB ID is part of the allowed first forwarded RHUB ID list and if the last forwarded RHUB ID is part of the allowed last forwarded RHUB ID list.

[0174] In an example embodiment, the NFp may receive a request originating from the NFc in the source network and associated with the NFp in the target network.

[0175] The request may include at least one RHUB ID. The at least one RHUB ID may include at least one of a first forwarding RHUB ID or a last forwarding RHUB ID. The first forwarding RHUB ID may be added to the request by an NFc, an SCP, or a SEPP in the source network. The last forwarding RHUB ID may be added to the request by a SEPP in the target network.

[0176] The request may be received from the RHUB, SCP or SEPP.

[0177] The request may include a service request.

[0178] The NFp may control (e.g., allow or prohibit) the request as follows. For example, the NFp may determine whether to allow or prohibit the request based on (e.g., using) an allowed or prohibited RHUB ID list stored at the NFp or NRF. The allowed or prohibited RHUB ID list may be stored in the NFp profile at the NFp. The allowed or prohibited RHUB ID list may be stored outside the NFp profile at the NFp (e.g., separate from the NFp profile). The allowed or prohibited RHUB ID list may be stored in the local configuration at the NFp. The allowed or prohibited RHUB ID list may be stored outside the NRp profile at the NRF (e.g., separate from the NFp profile). The allowed or prohibited RHUB ID list may be stored in the roaming profile or in the local configuration at the NRF.

[0179] The NFp may retrieve a list of allowed or forbidden RHUB IDs stored at the NFp or NRF.

[0180] The NFp may determine whether the at least one RHUB ID is part of an allowed or forbidden RHUB ID list stored at the NFp or NRF. If the at least one RHUB ID is part of an allowed RHUB ID list stored at the NFp or NRF, the NFp may allow the request. If the at least one RHUB ID is part of a forbidden RHUB ID list stored at the NFp or NRF, the NFp may prohibit the request.

[0181] If an allowed first forward RHUB ID list or a last forward RHUB ID list is stored at the NFp, the NFp may check whether the last forward RHUB ID is part of the allowed last forward RHUB ID list or whether the first forward RHUB ID is part of the allowed first forward RHUB ID list.

[0182] When the Oauth2.0 process is used for service access control, the NFp may check whether the service request includes an access token, and whether the access token includes the RHUB ID of the RHUB that forwarded the service request.

[0183] Otherwise, the NFp may check whether the service request includes the RHUB ID of the RHUB that forwarded the service request.

[0184] In an example embodiment, when forwarding a request, the RHUB may add its RHUB ID to the request. If the request is sent from NFc and is related to NFp through multiple RHUBs, each RHUB may add its own RHUB ID. If the request includes a RHUB ID list, the RHUB may append its RHUB ID to the RHUB ID list, or may replace the RHUB ID list with its own ID.

[0185] In an example embodiment, when receiving a service request related to NFp from NFc, and when the service request includes a RHUB ID list, the SCP may include the RHUB ID in a discovery request or an access token request, and may send the discovery request or the access token request to an NRF in a target network.

[0186] In an example embodiment, the NRF in the source network may forward the discovery request or access token request to the NRF in the target network, possibly through the RHUB. The RHUB that forwards the discovery request or access token request may add its RHUB ID to the discovery request or access token request. If the discovery request or access token request includes a RHUB ID list, the RHUB may append its RHUB ID to the RHUB ID list, or may replace the RHUB ID list with its RHUB ID.

[0187] Can support multiple roaming models.

[0188] In the first roaming model, the target network operator may have a roaming agreement with the RHUB. The target network operator may inherit all roaming agreements supported by the RHUB (e.g., roaming agreements with all source network operators x, y, and z). There may be direct signaling between the RHUB and the NFp of the target PLMN.

[0189] Source PLMNx, y, z<------------>RHUB<------------->Target PLMN

[0190] In the second roaming model, the target network operator may have a roaming agreement with the RHUB. The target network operator may inherit some roaming agreements supported by the RHUB (e.g., roaming agreements with source network operators x and y, but no roaming agreement with source network operator z). There may be direct signaling between the RHUB and the NFp of the target PLMN.

[0191] Source PLMNx, y, z<------------>RHUB<------------->Target PLMN

[0192] In the third roaming model, the target network operator may have a roaming agreement with RHUB 1. The target network operator may inherit all roaming agreements supported by RHUB 1 (e.g., roaming agreements with all source network operators x, y, and z) based on the roaming agreement between the target PLMN and RHUB 2. There may be indirect signaling between RHUB 1 and the NFp in the target PLMN through RHUB 2.

[0193] Source PLMNx, y, z<--------->RHUB 1<---------->RHUB 2<---------->Target PLMN

[0194] In the fourth roaming model, the target network operator may have a roaming agreement with RHUB 1. Based on the roaming agreement between the target PLMN and RHUB 2, the target network operator may inherit some roaming agreements supported by RHUB 1 (e.g., roaming agreements with source network operators x and y, but no roaming agreement with source network operator z). There may be indirect signaling between RHUB 1 and the NFp in the target PLMN through RHUB 2.

[0195] Source PLMNx, y, z<--------->RHUB 1<---------->RHUB 2<----------->Target PLMN

[0196] Other roaming models may be considered.

[0197] It is understood that it is not a prerequisite that the UE is configured with two subscription permanent identifiers (SUPIs) (e.g., its home PLMN SUPI and the RHUB network operator SUPI) to support a roaming hub. There may be limitations and restrictions on doing so. However, it is conceivable that the UE is configured with different SUPIs to be able to register with different networks.

[0198] One or more aspects of the subject disclosure are applicable regardless of the number of SUPIs within a UE because it provides a generic solution that enables communication across two PLMNs, two SNPNs, or between a PLMN and a SNPN.

[0199] One or more aspects of the subject disclosure may be applicable to SEPP deployments, including hosted SEPP deployments.

[0200] One or more aspects of the subject disclosure may be applicable to other intermediaries besides RHUB.

[0201] Figure 4A signaling diagram of a procedure for controlling (eg, allowing or disabling) a discovery request originating from a NFc in a source network (eg, source PLMN) and relating to a NFp in a target network (eg, target PLMN) is shown.

[0202] NFc may send a discovery request to RHUB 1. RHUB 1 may include RHUB 1ID in the discovery request and may forward the discovery request to RHUB 2. RHUB 2 may include RHUB 2ID in the discovery request and may forward the discovery request to NRF. NRF may determine whether to allow or prohibit the discovery request based on at least one of RHUB 1ID or RHUB 2ID and an allowed or prohibited RHUB ID list stored at NRF. If at least one of RHUB 1ID or RHUB 2ID is part of the allowed RHUB ID list stored at NRF, NRF may allow the discovery request. If at least one of RHUB 1ID or RHUB 2ID is part of the prohibited RHUB ID list stored at NRF, NRF may prohibit the discovery request. NRF may send a discovery response to NFc, indicating that the discovery request is allowed. The discovery response may include NFp profile.

[0203] Figure 5 A signaling diagram of a procedure for controlling (eg, allowing or disabling) a service request originating from a NFc in a source network (eg, source PLMN) and associated with a NFp in a target network (eg, target PLMN) is shown.

[0204] NFc may send a service request to RHUB 1. RHUB 1 may include RHUB 1ID in the service request and may forward the service request to RHUB 2. RHUB 2 may include RHUB 2ID in the service request and may forward the service request to SCP. SCP may be part of the source network or the target network. SCP may send a discovery request including RHUB ID 1 and RHUB ID 2 to NRF. SCP may indicate RHUB 1ID and RHUB 2ID, for example, using a new query parameter or using an http header. NRF may determine whether to allow or prohibit the service request based on at least one of RHUB 1ID or RHUB 2ID and a list of allowed or prohibited RHUB IDs stored at NRF. If at least one of RHUB 1ID or RHUB 2ID is part of the allowed RHUB ID list stored in NRF, NRF may allow the service request. If at least one of RHUB 1ID or RHUB 2ID is part of the prohibited RHUB ID list stored in NRF, NRF may prohibit the service request. The SCP may receive a discovery response from the NRF indicating that the discovery request is allowed. The discovery response may include the NFp profile. The SCP may send a service request including RHUB ID 1 and RHUB ID 2 to the NFp. The NFp may send a service response to the NFc.

[0205] Figure 6 A signaling diagram of a procedure for controlling (eg, allowing or disabling) an access token request originating from a NFc in a source network (eg, source PLMN) and associated with a NFp in a target network (eg, target PLMN) is shown.

[0206] NFc may send an access token request to RHUB 1. RHUB 1 may include RHUB1ID in the access token request and may forward the access token request to RHUB 2. RHUB 2 may include RHUB2ID in the access token request and may forward the access token request to NRF. NRF may determine whether to allow or prohibit the access token request based on at least one of RHUB 1ID or RHUB 2ID and a list of allowed or prohibited RHUB IDs stored at NRF. If at least one of RHUB 1ID or RHUB 2ID is part of the allowed RHUB ID list stored on NRF, NRF may allow the access token request. If at least one of RHUB 1ID or RHUB 2ID is part of the prohibited RHUB ID list stored on NRF, NRF may prohibit the access token request. NRF may send an access token response including an access token to NFc. The access token may include at least one RHUB ID that is part of the allowed RHUB ID list stored on NRF. Here, the access token may include RHUB ID 1 and RHUB ID 2.

[0207] Figure 7 A signaling diagram of a procedure for controlling (eg, allowing or disabling) a service request originating from a NFc in a source network (eg, source PLMN) and associated with a NFp in a target network (eg, target PLMN) is shown.

[0208] NFc may send a service request to RHUB 1. RHUB 1 may include RHUB 1ID in the service request and may forward the service request to RHUB 2. RHUB 2 may include RHUB 2ID in the service request and may forward the service request to SCP. SCP may be part of a target network (e.g., the same network as NRF and NFp). SCP may send an access token request including RHUB 1ID and RHUB 2ID to NRF. SCP may indicate RHUB 1ID and RHUB 2ID, for example, using a new query parameter or using an http header. NRF may determine whether to allow or prohibit the access token request based on at least one of RHUB 1ID or RHUB 2ID and a list of allowed or prohibited RHUB IDs stored at NRF. If at least one of RHUB 1ID or RHUB 2ID is part of the allowed RHUB ID list stored on NRF, NRF may allow the access token request. If at least one of RHUB 1ID or RHUB 2ID is part of the prohibited RHUB ID list stored on NRF, NRF may prohibit the access token request. The SCP may receive an access token response including an access token from the NRF. The access token may include RHUB ID 1 and RHUB ID 2. The SCP may send a service request including RHUB ID 1 and RHUB ID 2 and an access token including RHUB ID 1 and RHUB ID 2 to the NFp. The SCP may determine whether to forward the service request to the NFp based on whether the received RHUB ID matches the RHUB ID in the access token. The NFp may determine whether to allow or prohibit the service request based on whether at least one of the RHUB 1ID or RHUB 2ID matches the RHUB 1ID or RHUB 2ID included in the access token. If at least one of the RHUB 1ID or RHUB 2ID matches the RHUB 1ID or RHUB 2ID included in the access token, the NFp may allow the service request. If at least one of the RHUB 1ID or RHUB 2ID does not match the RHUB 1ID or RHUB 2ID included in the access token, the NFp may prohibit the service request. If the service request requires, the NFp may send a service response to the NFc.

[0209] Figure 8 A signaling diagram illustrating a procedure for allowing or disabling a service request originating from a NFc in a source network (eg, source PLMN) and involving a NFp in a target network (eg, target PLMN).

[0210] NFc may send a service request including an access token to RHUB 1. The access token may include RHUB 1ID and RHUB 2ID. RHUB 1 may include RHUB 1ID in the service request and may forward the service request to RHUB 2. RHUB 2 may include RHUB 2ID in the service request and may forward the service request to NFp. NFp may determine whether to allow or prohibit the service request based on whether at least one of RHUB 1ID or RHUB 2ID added by RHUB 1 and RHUB 2 matches RHUB 1ID or RHUB 2ID included in the access token. If at least one of RHUB 1ID or RHUB 2ID added by RHUB 1 and RHUB 2 matches RHUB 1ID or RHUB 2ID included in the access token, NFp may allow the service request. If at least one of RHUB 1ID or RHUB 2ID added by RHUB 1 and RHUB 2 does not match RHUB 1ID or RHUB 2ID included in the access token, NFp may prohibit the service request. If the service request requires, NFp may send a service response to NFc.

[0211] Fig. 9 A block diagram of a method performed by a device such as an NRF, NFp, SCP or SEPP for controlling (eg, allowing or prohibiting) a service request originating from a NFc and associated with a NFp is shown.

[0212] In step 900, the apparatus may receive a request originating from an nNFc in a source network and associated with an NFp in a target network, wherein the request includes at least one forwarding node identifier of a forwarding node that has forwarded the request.

[0213] In step 902, the apparatus may determine whether the at least one forwarding node identifier is part of a list of at least one of allowed or forbidden forwarding node identifiers.

[0214] In step 904, the device may control the request based on the determination.

[0215] The apparatus may determine that the at least one forwarding node identifier is part of an allowed forwarding node identifier list or is not part of a forbidden forwarding node identifier list. The apparatus may allow the request based on the determination.

[0216] The apparatus may determine that the at least one forwarding node identifier is not part of an allowed forwarding node identifier list or is not part of a forbidden forwarding node identifier list.The apparatus may prohibit the request based on the determination.

[0217] The at least one forwarding node identifier may identify at least one network that provides roaming services to other networks. The operator of the other network may have a roaming agreement with the operator of the at least one network, or the operator of the other network belongs to the same operator group as the operator of the at least one network.

[0218] The request may include at least one of: a forwarding node identifier identifying a forwarding node that first forwarded the request from the NFc in the source network, or a forwarding node identifier identifying a forwarding node that last forwarded the request to the NFp in the target network.

[0219] The request may include at least one of: a forwarding node identifier identifying a forwarding node that first forwarded a request received from a NFc in a source network through the SCP, or a forwarding node identifier identifying a forwarding node that finally forwarded a request sent to a NFp in a target network through the SCP.

[0220] The NFc, SCP or SEPP may add to the request a forwarding node identifier identifying the forwarding node that first forwarded the request from the NFc in the source network, or the SEPP in the target network may add to the request a forwarding node identifier identifying the forwarding node that last forwarded the request to the NFp in the target network.

[0221] The allowed or forbidden forwarding node identifier list may be one of a plurality of allowed or forbidden forwarding node identifier lists.

[0222] The plurality of allowed or prohibited forwarding node identifier lists may include at least one of: an allowed or prohibited forwarding node identifier list that first forwarded the request; and an allowed or prohibited forwarding node identifier list that last forwarded the request.

[0223] The request may be received from the RHUB, SCP or SEPP.

[0224] The request may include at least one of: a discovery request for discovering a NFp in the target network, an access token request for obtaining authorization to access a service of the NFp in the target network, or a service request for receiving a service generated by the NFp in the target network.

[0225] The apparatus may receive a list of allowed or forbidden forwarding node identifiers from a target network.The apparatus may store the list of allowed or forbidden forwarding node identifiers.

[0226] The list of allowed or forbidden forwarding node identifiers may be specific to at least one of: a target network, a source network, a NFc type, a NFp type, a service type, an instance of NFc, or an instance of NFp.

[0227] The device may store a network function service producer profile. The device may store a list of allowed or prohibited forwarding node identifiers within the NFp profile. The device may register the NFp profile with the NRF.

[0228] The apparatus may store roaming profiles.The apparatus may store a list of allowed or forbidden forwarding node identifiers within one of the roaming profiles.

[0229] The device may store a network function service producer profile. The device may store a roaming profile identifier list identifying a roaming profile within the NFp profile. The device may register the NFp profile with the NRF.

[0230] The device may store a NFp profile. The device may store within the NFp profile an indication that the NFp is discoverable and accessible by a NFc in a source network. The device may register the NFp profile with the NRF.

[0231] The apparatus may use the allowed or forbidden forwarding node identifier list within the NFp profile to determine whether at least one forwarding node identifier is part of the allowed or forbidden hub identifier list.

[0232] The apparatus may use the allowed or forbidden forwarding node identifier list within the roaming profile or within the local configuration to determine whether the received at least one forwarding node identifier is part of the allowed or forbidden forwarding node identifier list.

[0233] The apparatus may be configured to perform the functions of a CN function.

[0234] CN function is NFp, NRF, SCP or SEPP.

[0235] The request may be an access token request including at least one forwarding node identifier. The apparatus may determine that the at least one forwarding node identifier is part of an allowed forwarding node identifier list. The apparatus may allow the request based on the determination. The apparatus may send an access token including the at least one forwarding node identifier to the NFc.

[0236] The access token may indicate whether the at least one forwarding node identifier identifies a forwarding node that first forwarded the request from the NFc in the source network or a forwarding node that last forwarded the request to the NFp in the target network.

[0237] The device may be an NFp. The request may be a service request, including at least one first forwarding node identifier identifying a forwarding node that has forwarded the request, and including an access token, the access token including at least one second forwarding node identifier as part of an allowed forwarding node identifier list. The device may determine that the at least one first forwarding node identifier matches the at least one second forwarding node identifier. The device may allow the request based on the determination.

[0238] The forwarding node can be a roaming hub.

[0239] Fig.10 A block diagram of a method performed by a device such as an SCP for controlling (eg, allowing or disabling) a service request originating from a NFc and associated with a NFp is shown.

[0240] In step 1000, the apparatus receives a request originating from an NFc in a source network and associated with a network function service producer in a target network, wherein the request includes at least one forwarding node identifier identifying a forwarding node that has forwarded the request.

[0241] In step 1002, the apparatus may send another request to the network function repository, the request including at least one forwarding node identifier identifying a forwarding node that has forwarded the request.

[0242] The request may be a service request and the other request may be at least one of a discovery request or an access token request.

[0243] Fig.11 A schematic diagram of a non-volatile memory medium 1100 storing instructions that, when executed by a processor, allow the processor to perform Fig. 9 and 10 One or more steps of a method.

[0244] It should be noted that while various example embodiments have been described above, many changes and modifications may be made without departing from the scope of the example embodiments.

[0245] It will be appreciated that while the above concepts are discussed in the context of 5GS, one or more of these concepts may be applied to other cellular standards and systems.

[0246] Therefore, the example embodiments may vary within the scope of the claims. In general, certain example embodiments may be implemented in hardware or dedicated circuits, software, logic, or any combination thereof. For example, some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software, which may be executed by a controller, microprocessor, or other computing device, although the embodiments are not limited thereto. Although various example embodiments may be illustrated and described with block diagrams, flow charts, or using some other graphical representations, it is fully understood that the blocks, devices, systems, techniques, or methods described herein may be implemented in hardware, software, firmware, dedicated circuits or logic, general hardware or controllers or other computing devices, or some combination thereof as non-limiting examples.

[0247] The various exemplary embodiments may be implemented by computer software stored in a memory and executable by at least one data processor of the entity involved, or by hardware, or by a combination of software and hardware. Furthermore, in this regard, it should be noted that any program, such as Fig. 9 The software may be stored on physical media such as memory chips or memory blocks implemented in processors, magnetic media (e.g., hard disks or floppy disks), and optical media (e.g., DVDs and their data variants, CDs).

[0248] The memory may be of any type suitable for the local technical environment and may be implemented using any suitable data storage technology, such as semiconductor-based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory, and removable memory. The data processor may be of any type suitable for the local technical environment and may include one or more of a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a gate-level circuit, and a processor based on a multi-core processor architecture, as non-limiting examples.

[0249] Additionally or alternatively, some example embodiments may be implemented using circuits. The circuits may be configured to perform one or more functions and / or method steps described previously. The circuits may be provided in a base station, a network function, and / or a communication device.

[0250] As used herein, the term "circuitry" may refer to one or more or all of the following example embodiments:

[0251] (a) hardware circuit implementation only (e.g., implementation only in analog and / or digital circuits);

[0252] (b) A combination of hardware circuits and software, such as:

[0253] (i) a combination of analog and / or digital hardware circuitry and software / firmware, and

[0254] (ii) any portion of a hardware processor (including a digital signal processor), software and memory with software that works together to enable an apparatus such as a communication device or base station to perform the various functions described above, and

[0255] (c) Hardware circuits and / or processors (such as a microprocessor or portion of a microprocessor) that require software (such as firmware) for operation, but the software may not be present when it is not needed for operation.

[0256] This definition of circuitry applies to all uses of the term herein, including in any claims. As another example, as used herein, the term circuitry also covers implementations of merely a hardware circuit or processor (or multiple processors) or portions of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term circuitry also covers, for example, an integrated device.

[0257] The foregoing provides a complete and informative description of various example embodiments of the subject disclosure by way of illustrative and non-limiting examples. However, various modifications and adaptations may become apparent to those skilled in the relevant art in view of the foregoing when read in conjunction with the accompanying drawings and claims. However, all such and similar modifications to the teachings will still fall within the scope of the example embodiments.

Claims

1. An apparatus comprising at least one processor and at least one memory, the at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to at least: A request originating from a network function service consumer in a source network and associated with a network function service producer in a target network is received, wherein: The request includes at least one forwarding node identifier identifying a forwarding node that has forwarded the request; determining whether the at least one forwarding node identifier is part of a list of at least one of allowed or prohibited forwarding node identifiers; as well as Based on the determination, the request is controlled.

2. The device according to claim 1, wherein: The at least one memory stores instructions that, when executed by the at least one processor, cause the apparatus to at least: determining whether the at least one forwarding node identifier is part of a list of allowed forwarding node identifiers or is not part of a list of forbidden forwarding node identifiers; as well as Based on the determination, the request is allowed.

3. The device according to claim 1, wherein: The at least one memory stores instructions that, when executed by the at least one processor, cause the apparatus to at least: determining that the at least one forwarding node identifier is not part of a list of allowed forwarding node identifiers or is part of a list of prohibited forwarding node identifiers; as well as Based on the determination, the request is prohibited.

4. The device according to any one of claims 1 to 3, wherein: The at least one forwarding node identifier identifies at least one network that provides roaming services to other networks; and The operator of the other network has a roaming agreement with the operator of the at least one network, or the operator of the other network belongs to the same operator group as the operator of the at least one network.

5. The device according to any one of claims 1 to 3, wherein: The request includes at least one of the following: a forwarding node identifier identifying a forwarding node that first forwards the request from the network function service consumer in the source network; or A forwarding node identifier identifying a forwarding node that last forwarded the request to the network function service producer in the target network.

6. An apparatus comprising at least one processor and at least one memory, the memory storing instructions that, when executed by the at least one processor, cause the apparatus to at least: A request originating from a network function service consumer in a source network and associated with a network function service producer in a target network is received, wherein: The request includes at least one forwarding node identifier identifying a forwarding node that has forwarded the request; as well as Another request is sent to a network function repository, the another request including the at least one forwarding node identifier identifying the forwarding node that has forwarded the request.

7. The device according to claim 6, wherein: The request is a service request and the other request is at least one of a discovery request or an access token request.

8. A method comprising: receiving a request originating from a network function service consumer in a source network and associated with a network function service producer in a target network, wherein the request includes at least one forwarding node identifier identifying a forwarding node that has forwarded the request; determining whether the at least one forwarding node identifier is part of a list of at least one of allowed or prohibited forwarding node identifiers; and Based on the determination, the request is controlled.

9. A method comprising: receiving a request originating from a network function service consumer in a source network and associated with a network function service producer in a target network, wherein the request includes at least one forwarding node identifier identifying a forwarding node that has forwarded the request; and Another request is sent to a network function repository, the another request including the at least one forwarding node identifier identifying the forwarding node that has forwarded the request.

10. A computer program comprising computer executable instructions which, when executed on one or more processors, perform the steps of the method according to claim 8 or claim 9.

Images