Apparatus, method, and computer program

Abstract

An apparatus receives 900 a request originating from a network function service consumer (NFc) in a source network, the request relating to a network function service producer (NFp) in a target networ

Description

Technical Field Various example embodiments of this subject disclosure relate to an apparatus, a method, and a computer program for controlling (e.g. allowing or disallowing) a request originating from a network function service consumer and relating to a network function service producer in a communication system. Background A communication system can be seen as a facility that enables communication sessions between two or more entities such as communication devices, base stations and / or other nodes by providing carriers between the various entities involved in the communications path. The communication system may be a wireless communication system. Examples of wireless systems comprise public land mobile networks (PLMN) operating based on radio standards (such as, those provided by 3GPP), satellite based communication systems and different wireless local networks. A wireless local network may, for example, be implemented as a wireless local area network (WLAN). The wireless systems can typically be divided into cells, and are therefore often referred to as cellular systems. The communication system and associated devices typically operate in accordance with a given standard or specification which sets out what the various entities associated with the system are permitted to do and how that should be achieved. Communication protocols and / or parameters which shall be used for the connection are also typically defined. An example of a set of standards are the so-called 5G standards. Summary Several aspects of the various example embodiments are detailed as follows. According to an aspect, there is provided an apparatus comprising at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to: receive a request originating from a network function service consumer in a source network and relating to a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node having forwarded the request; determine whether the at least one forwarding node identifier is part of a list of at least one of allowed or disallowed forwarding node identifiers; and control the request based on the determination. The at least one memory may store instructions that, when executed by the at least one processor, cause the apparatus at least to: determine that the at least one forwarding node identifier is part of a list of allowed forwarding node identifiers or is not part of a list of disallowed forwarding node identifiers; and allow the request based on the determination. The at least one memory may store instructions that, when executed by the at least one processor, cause the apparatus at least to: determine that the at least one forwarding node identifier is not part of a list of allowed forwarding node identifiers or is part of a list of disallowed forwarding node identifiers; and disallow the request based on the determination. The at least one forwarding node identifier may identify at least one network providing roaming services to other networks; and operators of the other networks may have a roaming agreement with an operator of the at least one network or operators of the other networks may belong to a same operator group as an operator of the at least one network. The request may comprise at least one of: a forwarding node identifier identifying a forwarding node that first forwarded the request from the network function service consumer in the source network; or a forwarding node identifier identifying a forwarding node that last forwarded the request to the network function service producer in the target network. The request may comprise at least one of: a forwarding node identifier identifying a forwarding node that first forwarded the request received from the network function service consumer in the source network via a service communication proxy; or a forwarding node identifier identifying a forwarding node that last forwarded the request transmitted to the network function service producer in the target network via a service communication proxy. The forwarding node identifier identifying the forwarding node that first forwarded the request from the network function service consumer in the source network may be added to the request by the network function service consumer, a service communication proxy or a security edge protection proxy in the source network; or the forwarding node identifier identifying the forwarding node that last forwarded the request to the network function service producer in the target network may be added to the request by a security edge protection proxy in the target network. The list of allowed or disallowed forwarding node identifiers may be one of a plurality of list of allowed or disallowed forwarding node identifiers. The plurality of list of allowed or disallowed forwarding node identifiers may comprise at least one of: a list of allowed or disallowed forwarding node identifiers that first forwarded the request; and a list of allowed or disallowed forwarding node identifiers that last forwarded the request. The request may be received from a roaming hub, a service communication proxy ora security edge protection proxy. The request may comprise at least one of: a discovery request to discover the network function service producer in the target network; an access token request to get an authorization to access a service of the network function service producer in the target network; or a service request to receive a service produced by the network function service producer in the target network. The at least one memory may store instructions that, when executed by the at least one processor, cause the apparatus at least to: receive, from the target network, the list of allowed or disallowed forwarding node identifiers; and store the list of allowed or disallowed forwarding node identifiers. The list of allowed or disallowed forwarding node identifiers may be specific for at least one of: a target network, a source network, a network function service consumer type, a network function service producer type, a service type, an instance of a network function service consumer or an instance of a network function service producer. The at least one memory may store instructions that, when executed by the at least one processor, cause the apparatus at least to: store a network function service producer profile; store the list of allowed or disallowed forwarding node identifiers within the network function service producer profile; and register the network function service producer profile with a network repository function. The at least one memory may store instructions that, when executed by the at least one processor, cause the apparatus at least to: store roaming profiles; and store the list of allowed or disallowed forwarding node identifiers within one of the roaming profiles. The at least one memory may store instructions that, when executed by the at least one processor, cause the apparatus at least to: store a network function service producer profile; store a list of roaming profile identifiers identifying roaming profiles within the network function service producer profile; and register the network function service producer profile with a network repository function. The at least one memory may store instructions that, when executed by the at least one processor, cause the apparatus at least to: store a network function service producer profile; store an indication that the network function service producer is discoverable and accessible by a network function service consumer in a source network within the network function service producer profile; and register the network function service producer profile with a network repository function. The at least one memory may store instructions that, when executed by the at least one processor, cause the apparatus at least to: determine whether the at least one forwarding node identifier is part of a list of allowed or disallowed hub identifiers using a list of allowed or disallowed forwarding node identifiers inside a network function service producer profile. The at least one memory may store instructions that, when executed by the at least one processor, cause the apparatus at least to: determine whether the at least one forwarding node identifier received is part of a list of allowed or disallowed forwarding node identifiers using a list of allowed or disallowed forwarding node identifiers within a roaming profile or within local configuration. The apparatus may be configured to perform functions of a core network function. The core network function may be the network function service producer, a network repository function, a service communication proxy, or a security edge protection proxy. The apparatus may be a network repository function; the request may be an access token request comprising at least one forwarding node identifier; the at least one memory may store instructions that, when executed by the at least one processor, cause the apparatus at least to: determine that the at least one forwarding node identifier is part of a list of allowed forwarding node identifiers; allow the request based on the determination; and send, to the network function service consumer, an access token comprising the at least one forwarding node identifier. The access token may indicate whether the least one forwarding node identifier identifies a forwarding node that first forwards the request from the network function service consumer in the source network or a forwarding node that last forwards the request to the network function service producer in the target network. The apparatus may be the network function service producer; the request may be a service request comprising at least one first forwarding node identifier identifying a forwarding node having forwarded the request, and comprising an access token comprising at least one second forwarding node identifier that is part of a list of allowed forwarding node identifiers; the at least one memory may store instructions that, when executed by the at least one processor, cause the apparatus at least to: determine that the at least one first forwarding node identifier matches the at least one second forwarding node identifier; and allow the request based on the determination. A forwarding node may be a roaming hub. According to an aspect, there is provided an apparatus comprising means for: receiving a request originating from a network function service consumer in a source network and relating to a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node having forwarded the request; determining whether the at least one forwarding node identifier is part of a list of at least one of allowed or disallowed forwarding node identifiers; and controlling the request based on the determination. According to an aspect, there is provided an apparatus comprising circuitry configured to: receive a request originating from a network function service consumer in a source network and relating to a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node having forwarded the request; determine whether the at least one forwarding node identifier is part of a list of at least one of allowed or disallowed forwarding node identifiers; and control the request based on the determination. According to an aspect, there is provided a method comprising: receiving a request originating from a network function service consumer in a source network and relating to a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node having forwarded the request; determining whether the at least one forwarding node identifier is part of a list of at least one of allowed or disallowed forwarding node identifiers; and controlling the request based on the determination. The method may be performed by an apparatus. The method may comprise: determining that the at least one forwarding node identifier is part of a list of allowed forwarding node identifiers or is not part of a list of disallowed forwarding node identifiers; and allow the request based on the determination. The method may comprise: determining that the at least one forwarding node identifier is not part of a list of allowed forwarding node identifiers or is part of a list of disallowed forwarding node identifiers; and disallow the request based on the determination. The at least one forwarding node identifier may identify at least one network providing roaming services to other networks; and operators of the other networks may have a roaming agreement with an operator of the at least one network or operators of the other networks may belong to a same operator group as an operator of the at least one network. The request may comprise at least one of: a forwarding node identifier identifying a forwarding node that first forwarded the request from the network function service consumer in the source network; or a forwarding node identifier identifying a forwarding node that last forwarded the request to the network function service producer in the target network. The request may comprise at least one of: a forwarding node identifier identifying a forwarding node that first forwarded the request received from the network function service consumer in the source network via a service communication proxy; or a forwarding node identifier identifying a forwarding node that last forwarded the request transmitted to the network function service producer in the target network via a service communication proxy. The forwarding node identifier identifying the forwarding node that first forwarded the request from the network function service consumer in the source network may be added to the request by the network function service consumer, a service communication proxy or a security edge protection proxy in the source network; or the forwarding node identifier identifying the forwarding node that last forwarded the request to the network function service producer in the target network may be added to the request by a security edge protection proxy in the target network. The list of allowed or disallowed forwarding node identifiers may be one of a plurality of list of allowed or disallowed forwarding node identifiers. The plurality of list of allowed or disallowed forwarding node identifiers may comprise at least one of: a list of allowed or disallowed forwarding node identifiers that first forwarded the request; and a list of allowed or disallowed forwarding node identifiers that last forwarded the request. The request may be received from a roaming hub, a service communication proxy ora security edge protection proxy. The request may comprise at least one of: a discovery request to discover the network function service producer in the target network; an access token request to get an authorization to access a service of the network function service producer in the target network; or a service request to receive a service produced by the network function service producer in the target network. The method may comprise: receiving, from the target network, the list of allowed or disallowed forwarding node identifiers; and store the list of allowed or disallowed forwarding node identifiers. The list of allowed or disallowed forwarding node identifiers may be specific for at least one of: a target network, a source network, a network function service consumer type, a network function service producer type, a service type, an instance of a network function service consumer or an instance of a network function service producer. The method may comprise: storing a network function service producer profile; storing the list of allowed or disallowed forwarding node identifiers within the network function service producer profile; and registering the network function service producer profile with a network repository function. The method may comprise: storing roaming profiles; and storing the list of allowed or disallowed forwarding node identifiers within one of the roaming profiles. The method may comprise: storing a network function service producer profile; storing a list of roaming profile identifiers identifying roaming profiles within the network function service producer profile; and registering the network function service producer profile with a network repository function. The method may comprise: storing a network function service producer profile; storing an indication that the network function service producer is discoverable and accessible by a network function service consumer in a source network within the network function service producer profile; and registering the network function service producer profile with a network repository function. The method may comprise : determining whether the at least one forwarding node identifier is part of a list of allowed or disallowed hub identifiers using a list of allowed or disallowed forwarding node identifiers inside a network function service producer profile. The method may comprise: determining whether the at least one forwarding node identifier received is part of a list of allowed or disallowed forwarding node identifiers using a list of allowed or disallowed forwarding node identifiers within a roaming profile or within local configuration. The apparatus performing the method may be configured to perform functions of a core network function. The core network function may be the network function service producer, a network repository function, a service communication proxy, or a security edge protection proxy. The apparatus performing the method may be a network repository function; the request may be an access token request comprising at least one forwarding node identifier; and the method may comprise: determining that the at least one forwarding node identifier is part of a list of allowed forwarding node identifiers; allow the request based on the determination; and sending, to the network function service consumer, an access token comprising the at least one forwarding node identifier. The access token may indicate whether the least one forwarding node identifier identifies a forwarding node that first forwards the request from the network function service consumer in the source network or a forwarding node that last forwards the request to the network function service producer in the target network. The apparatus may be the network function service producer; the request may be a service request comprising at least one first forwarding node identifier identifying a forwarding node having forwarded the request, and comprising an access token comprising at least one second forwarding node identifier that is part of a list of allowed forwarding node identifiers; and the method may comprise: determining that the at least one first forwarding node identifier matches the at least one second forwarding node identifier; and allow the request based on the determination. A forwarding node may be a roaming hub. According to an aspect, there is provided a computer program comprising computer executable code which when run on at least one processor is configured to: receive a request originating from a network function service consumer in a source network and relating to a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node having forwarded the request; determine whether the at least one forwarding node identifier is part of a list of at least one of allowed or disallowed forwarding node identifiers; and control the request based on the determination. According to an aspect, there is provided an apparatus comprising at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to: receive a request originating from a network function service consumer in a source network and relating to a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node having forwarded the request; and send, to a network function repository, another request comprising the at least one forwarding node identifier identifying the forwarding node having forwarded the request. The request may be a service request and the other request may be at least one of a discovery request or an access token request. According to an aspect, there is provided an apparatus comprising means for: receiving a request originating from a network function service consumer in a source network and relating to a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node having forwarded the request; and sending, to a network function repository, another request comprising the at least one forwarding node identifier identifying the forwarding node having forwarded the request. According to an aspect, there is provided an apparatus comprising circuitry configured to: receive a request originating from a network function service consumer in a source network and relating to a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node having forwarded the request; and send, to a network function repository, another request comprising the at least one forwarding node identifier identifying the forwarding node having forwarded the request. According to an aspect, there is provided a method comprising: receiving a request originating from a network function service consumer in a source network and relating to a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node having forwarded the request; and sending, to a network function repository, another request comprising the at least one forwarding node identifier identifying the forwarding node having forwarded the request. The request may be a service request and the other request may be at least one of a discovery request or an access token request. According to an aspect, there is provided a computer program comprising computer executable code which when run on at least one processor is configured to: receive a request originating from a network function service consumer in a source network and relating to a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node having forwarded the request; and send, to a network function repository, another request comprising the at least one forwarding node identifier identifying the forwarding node having forwarded the request. According to an aspect, there is provided a computer readable medium comprising program instructions stored thereon for performing at least one of the above methods. According to an aspect, there is provided a non-transitory computer readable medium comprising program instructions stored thereon for performing at least one of the above methods. According to an aspect, there is provided a non-volatile tangible memory medium comprising program instructions stored thereon for performing at least one of the above methods. In the above, many different aspects of the various example embodiments have been described. It should be appreciated that further aspects may be provided by the combination of any two or more of the aspects described above. Various other aspects are also described in the following detailed description and in the claims. List of abbreviations AF: Application Function AMF: Access and Mobility Management Function API: Application Programming Interface BS: Base Station CU: Centralized Unit DL: Downlink DU: Distributed Unit gNB: gNodeB GSM: Global System for Mobile Communication GSMA:Global System for Mobile Communication Association HSS: Home Subscriber Server loT: Internet of Things IPx: Internet Protocol exchange LTE: Long Term Evolution MAC: Medium Access Control MS: Mobile Station MTC: Machine Type Communication NEF: Network Exposure Function NF: Network Function NFc: Network Function service consumer NFp: Network Function service producer NR: New radio NRF: Network Repository Function NSSAIA: Network Slice Selection Assistance Information PDU: Packet Data Unit PLMN: Public Land Mobile Network RAM: Random Access Memory (R)AN: (Radio) Access Network RHLIB: Roaming Hub ROM: Read Only Memory SBA: Service Based Architecture qpp. O\- / i . Service Communication Proxy SEPP: Security Edge Protection Proxy SMF: Session Management Function SNPN: Standalone Non-Private Network SUPI: Subscription Permanent Identifier TR: Technical Report TS: Technical Specification UDR: Unified Data Repository UE: User Equipment UMTS: Universal Mobile Telecommunication System 3GPP: 3rd Generation Partnership Project 5G: 5th Generation ■ oUU. 5G Core network 5GS: 5G System Brief Description of the Figures Some example embodiments will now be described, by way of example only, with reference to the accompanying drawings in which: FIG. 1 shows a schematic representation of a 5G system; FIG. 2 shows a schematic representation of a control apparatus; FIG. 3 shows a schematic representation of a user equipment; FIG. 4 shows a signaling diagram of a process for controlling (e.g. allowing or disallowing) a discovery request originating from a network function service consumer and relating to a network function service producer; FIG. 5 shows a signaling diagram of a process for controlling (e.g. allowing or disallowing) a service request originating from a network function service consumer and relating to a network function service producer; FIG. 6 shows a signaling diagram of a process for controlling (e.g. allowing or disallowing) an access token request originating from a network function service consumer and relating to a network function service producer; FIG. 7 shows a signaling diagram of a process for controlling (e.g. allowing or disallowing) a service request originating from a network function service consumer and relating to a network function service producer; FIG. 8 shows a signaling diagram of a process for controlling (e.g. allowing or disallowing) a service request originating from a network function service consumer and relating to a network function service producer; FIG. 9 shows a block diagram of a method for controlling (e.g. allowing or disallowing) a service request originating from a network function service consumer and relating to a network function service producer, performed by an apparatus such as a network repository function, the network function service producer, a service communication proxy or a security edge protection proxy; FIG. 10 shows a block diagram of a method for controlling (e.g. allowing or disallowing) a service request originating from a network function service consumer and relating to a network function service producer, performed by an apparatus such as a service communication proxy; and FIG. 11 shows a schematic representation of a non-volatile memory medium storing instructions which when executed by a processor allow a processor to perform one or more of the steps of the methods of FIGS. 9 and 10. Detailed Description In the following, various example embodiments are explained with reference to mobile communication devices capable of communication via a wireless cellular system and mobile communication systems serving such mobile communication devices. Before further detailing the various example embodiments, certain general aspects of a wireless communication system, access systems thereof, and mobile communication devices are briefly explained with reference to FIGS. 1, 2 and 3 to assist in understanding the technology underlying the described examples. FIG. 1 shows a schematic representation of a 5G system (5GS). The 5GS may comprise public land mobile networks (PLMNs). APLMN may comprisea user equipment (UE), a (radio) access network ((R)AN), a 5G core network (5GC), one or more application functions (AF) and one or more data networks (DN). A 5G (R)AN may comprise one or more gNodeB (gNB) distributed unit functions connected to one or more gNodeB (gNB) centralized unit functions. A 5GC may comprise an access and mobility management function (AMF), a session management function (SMF), an authentication server function (AUSF), a user data management (UDM), a user plane function (UPF), a network exposure function (NEF), a unified data repository (UDR), an application function (AF), a network repository function (NRF) and / or a security edge protection proxy (SEPP). FIG. 2 illustrates an example of a control apparatus 200 for controlling a function of a (R)AN or 5GC, such as the (R)AN or the 5GC as illustrated in FIG. 1. The control apparatus may comprise at least one random access memory (RAM) 211a, at least one read only memory (ROM) 211b, at least one processor 212, 213 and an input / output interface 214. The at least one processor 212, 213 may be coupled to the RAM 211a and the ROM 211b. The at least one processor 212, 213 may be configured to execute an appropriate software code 215. The software code 215 may, for example, allow to perform one or more steps to perform one or more of the aspects described herein. The software code 215 may be stored in the ROM 211b. The control apparatus 200 may be interconnected with another control apparatus 200 controlling another function of the5G (R)AN orthe5GC. In some example embodiments, each function of the (R)AN or the 5GC comprises a control apparatus 200. In alternative example embodiments, two or more functions of the (R)AN or the 5GC may share a control apparatus. FIG. 3 illustrates an example of UE 300, such as the UE illustrated in FIG. 1. The UE 300 may be provided by any device capable of sending and receiving radio signals. Non-limiting examples comprise a user equipment, a mobile station (MS) or mobile device, such as a mobile phone or what is referred to as a "smart phone", a computer provided with a wireless interface card or other wireless interface facility (e.g. USB dongle), a personal data assistant (PDA) or a tablet provided with wireless communication capabilities, a machine-type communications (MTC) device, a Cellular Internet of things (CloT) device or any combinations of these or the like. The UE 300 may provide, for example, communication of data for carrying communications. The communications may be one or more of voice, electronic mail (email), text message, multimedia, data, machine data and so on. The UE 300 may receive signals over an air or radio interface 307 via appropriate apparatus for receiving and may transmit signals via appropriate apparatus for transmitting radio signals. In FIG. 3, transceiver apparatus is designated schematically by block 306. The transceiver apparatus 306 may be provided, for example, by means of a radio part and associated antenna arrangement. The antenna arrangement may be arranged internally or externally to the mobile device. The UE 300 may be provided with at least one processor 301, at least one memory ROM 302a, at least one RAM 302b and other possible components 303 for use in software and hardware aided execution of tasks it is designed to perform, including control of access to and communications with access systems and other communication devices. The at least one processor 301 is coupled to the RAM 302b and the ROM 302a. The at least one processor 301 may be configured to execute an appropriate software code 308. The software code 308 may, for example, allow to perform one or more of the aspects described herein. The software code 308 may be stored in the ROM 302a. The processor, storage and other relevant control apparatus can be provided on an appropriate circuit board and / or in chipsets. This feature is denoted by reference 304. The device may optionally have a user interface, such as keypad 305, touch sensitive screen or pad, combinations thereof or the like. Optionally one or more of a display, a speaker and a microphone may be provided depending on the type of the device. The 5GC has been defined as a service-based architecture (SBA) with one or more NF service producers (NFp) exposing services to one or more NF service consumers (NFc). An NFp may register an NFp profile with the NRF. The NFp profile may comprise NF level specific information and the list of NF service instances supported by the NFp with associated attributes. An NFc or service communication proxy (SCP) may discover an NFp by performing an NF discovery procedure towards the NRF with query parameters describing the services or properties of the NFp they wish to discover. The NRF may return NF profiles of candidate NFps matching the query parameters in an NF discovery response. During an NF discovery procedure, the NRF may ensure that the requesting NFc is authorized to discover services or properties of the NFp they wish to discover. This can be done by including authorization parameters in the NFp profile registered at the NRF. The authorization parameters may indicate which NFc(s) is or are allowed to discover and access the NFp services. The authorization parameters may, for example, comprise allowed PLMNs (public land mobile networks), allowed SNPNs (standalone non private networks), allowed NF types (network function types), allowed NF domains, allowed NSSAIS (network slice selection assistance information). The authorization parameters may be included at the level of an NFp instance and / or at the level of an NFp service instance. When an Oauth2.0 framework is used to authorize the access to 5GC services, the NRF may use the authorization parameters to decide whether to grant an access token or not to an NFc requesting an access token to access an NFp service. A roaming hub (RHUB) may refer to a commercial entity that can be contracted by a network operator to enable quick and efficient access to a wide range of roaming agreements. An RHLIB may have a number of roaming agreements and technical interconnections that are already fully negotiated and operational with other network operators and the contracting network operator “buys in” to these agreements (e.g. some or all of them). As negotiating roaming agreements with the full range of network operators in the world may take a substantial amount of time and resources, some contracting network operators use an RHUB to get quick access to a wide roaming footprint. An RHUB may be acting on behalf of the contracting operators from the commercial and technical point of view and have financial liability for roaming agreements enabled through them. When an RHUB is used, the commercial agreements may not be directly between the network operators, but between the RHUB and the home and visited network operator. Many network operators may own or have partners in one or more countries, forming a network operator group. For reasons of cost, efficiency and security, these network operator groups may have a common, centralised roaming aggregation point. This roaming aggregation point may form a network operator group RHUB and may establish centralized roaming services (e.g. commercial and technical services) between all network operator group members and to all or some roaming partners of this network operator group (e.g. each roaming partner of the network operator group RHUB may reach each network operator group member and vice versa). GSMA defines the concept of hosted SEPP (security edge protection proxy), which is an SEPP that is outsourced by a network operator to a provider outside of the network (e.g. to an internet protocol exchange (IPX) provider or RHUB operator). Several questions may arise for service access control and authorization for inter-network service requests in deployments using RHUBs. How can a target network operator control (e.g. allow or disallow) a service request received via an RHUB from an NFc in a source network operator with which it has no direct roaming agreement? How can a target network operator allow an NFp to be discovered and accessed by an NFc if the service request comes from an RHUB x with which the target network operator has a roaming agreement but disallow if the service request comes from an RHUB y with which the target network operator has no roaming agreement? How can a target network operator allow an NFp to be discovered and accessed by an NFc if the service request comes from an NFc of a source network operator with which it has no direct roaming agreement but is forwarded by a network operator group RHUB of a network operator group that the target network operator is part of? One or more aspects of the subject disclosure propose enhancements to the discovery and service access control procedures to address one or more of the above questions. In the following, an NFc may be in a source network, an NFp may be in a target network, an NRF may be in the target network. The source network is different from the target network. An RHUB may be in the source network, an intermediate network or the target network. One or more aspects of the subject disclosure enhance discovery and in service access control procedures by enabling an NRF or an NFp to control (e.g. allow or disallow) a request received, via an RHUB, from the NFc, where the target network operator may or may not have direct service level agreement or roaming agreement with the source network operator. The NRF or the NFp may store a plurality of lists of allowed and / or disallowed RHUB IDs. A list of allowed and / or disallowed RHUB IDs may be specific for at least one of: a target network, a source network, a network function service consumer type, a network function service producer type, a service type, an instance of a network function service consumer or an instance of a network function service producer. A list of allowed and / or disallowed network group operator RHUB IDs may comprise a list of allowed and / or disallowed first forwarding RHUB IDs (e.g. in the signalling path between the NFc and the NFp). An RHUB ID may identify at least one network providing roaming services to other networks. Operators of the other networks may have a roaming agreement with an operator of the at least one network. Alternatively, operators of the other networks may belong to a same operator group as an operator of the at least one network. An RHUB ID may comprise a PLMN ID, an SNPN ID or an FQDN. In an example embodiment, the NFp may receive a list of allowed and / or disallowed RHUB IDs from the target network. The NFp may store the list of allowed and / or disallowed RHUB IDs within an NFp profile. The NFp may register the NFp profile with the NRF. The NFp may store the list of allowed and / or disallowed RHUB IDs outside (e.g. apart from) an NFp profile. The NFp may store the list of allowed and / or disallowed RHUB IDs within local configuration. In an example embodiment, the NRF may receive a list of allowed and / or disallowed RHUB IDs from the target network. The NRF may store the list of allowed and / or disallowed RHUB IDs outside (e.g. apart from) the NFp profile. The NRF may store the list of allowed and / or disallowed RHUB IDs within roaming profiles or local configuration. The NRF may store roaming profiles. Each roaming profile may be identified by a roaming profile ID. Each roaming profile may comprise a list of allowed and / or disallowed RHUB IDs. Each roaming profile may be associated with an NFc type, an NFp type, an NFp service or an NFc instance or an NFp instance. The NRF may store the list of allowed and / or disallowed RHUB IDs within a roaming profile. The NFp may store a list of roaming profile IDs identifying the roaming profiles stored at the NRF. The NFp may store the list of roaming profile IDs or an identifier of the list of roaming profile IDs within the NFp profile. The NFp may register the NFp profile with the NRF. The NFp may store an indication that the NFp may be discovered and accessed by an NFc in a source network operator different from the target network operator within the NFp profile. The indication may be a Boolean (e.g. evaluates to yes or no). The NFp may store an indication to use a list of allowed or disallowed RHUB IDs within an NFp profile (e.g. local I distributed determination) or outside (e.g. apart from) an NFp profile (e.g. global / central determination). The indication may be stored within the NFp profile. In an example embodiment, the NRF may receive a request originating from an NFc in the source network and relating to an NFp in the target network. The request may comprise at least one RHUB ID. The at least one RHLIB ID may comprise at least one of a first forwarding RHUB ID or a last forwarding RHUB ID. The first forwarding RHUB ID may be added to the request by the NFc, an SCPoran SEPP in the source network. The last forwarding RHUB ID may be added to the request by an SEPP in the target network. The request may be received from an RHUB, an SCP or an SEPP. The request may comprise at least one of a discovery request or an access token request. The NRF may control (e.g. allow or disallow) the request as follows. The NRF may, for instance, determine whether to allow or disallow the request based on (e.g. using) a list of allowed or disallowed RHUB IDs stored at the NRF. The list of allowed or disallowed RHUB IDs may be stored at the NRF within the NFp profile, within a roaming profile or within local configuration. The NRF may retrieve the list of allowed or disallowed RHUB IDs stored at the NRF. The NRF may determine whether the at least one RHUB ID is part of a list of allowed or disallowed RHUB IDs stored at the NRF. If the at least one RHUB ID is part of a list of allowed RHUB IDs stored at the NRF, the NRF may allow the request. If the at least one RHUB ID is part of a list of disallowed RHUB IDs stored at the NRF, the NRF may disallow the request. The NRF may check the last forwarding RHUB ID and / or the first forwarding RHUB ID or all the RHUB IDs, depending on local configuration. If the NRF stores a list of allowed first forwarding RHUB IDs, the NRF may check whether the first forwarding RHUB ID is part of the list of allowed first forwarding RHUB IDs. If the NRF stores a list of allowed last forwarding RHUB IDs, the NRF may check whether the last forwarding RHUB ID is part of the list of allowed last forwarding RHUB IDs. If the NRF stores a list of allowed first forwarding RHUB IDs and a list of allowed last forwarding RHUB IDs, the NRF may check whether the first forwarding RHUB ID is part of the list of allowed first forwarding RHUB IDs and whether the last forwarding RHUB ID is part of the list of allowed last forwarding RHUB IDs. In an example embodiment, the NFp may receive a request originating from an NFc in the source network and relating to an NFp in the target network. The request may comprise at least one RHUB ID. The at least one RHLIB ID may comprise at least one of a first forwarding RHUB ID or a last forwarding RHUB ID. The first forwarding RHUB ID may be added to the request by the NFc, an SCP or an SEPP in the source network. The last forwarding RHUB ID may be added to the request by an SEPP in the target network. The request may be received from an RHUB, an SCP or an SEPP. The request may comprise a service request. The NFp may control (e.g. allow or disallow) the request as follows. The NFp may, for instance, determine whether to allow or disallow the request based on (e.g. using) a list of allowed or disallowed RHUB IDs stored at the NFp or at the NRF. The list of allowed or disallowed RHUB IDs may be stored at the NFp within the NFp profile. The list of allowed or disallowed RHUB IDs may be stored at the NFp outside (e.g. apart from) the NFp profile. The list of allowed or disallowed RHUB IDs may be stored at the NFp within local configuration. The list of allowed or disallowed RHUB IDs may be stored at the NRF outside (e.g. apart from) the NFp profile. The list of allowed or disallowed RHUB IDs may be stored at the NRF within a roaming profile or within local configuration. The NFp may retrieve the list of allowed or disallowed RHUB IDs stored at the NFp or at the NRF. The NFp may determine whether the at least one RHUB ID is part of the list of allowed or disallowed RHUB IDs stored at the NFp or at the NRF. If the at least one RHUB ID is part of the list of allowed RHUB IDs stored at the NFp or the NRF, the NFp may allow the request. If the at least one RHUB ID is part of a list of disallowed RHUB IDs stored at the NFp or the NRF, the NFp may disallow the request. If a list of allowed first forwarding RHUB IDs or a list of last forwarding RHUB IDs is stored at the NFp, the NFp may check whether the last forwarding RHUB ID is part of the list of allowed last forwarding RHUB IDs or the first forwarding RHUB ID is part of the list of allowed first forwarding RHUB IDs. When using the Oauth2.0 procedures for service access control, the NFp may check whether the service request comprises an access token and whether the access token comprises RHUB IDs of the RHUBs through which the service request was forwarded. Otherwise, the NFp may check whether the service request comprises RHUB IDs of the RHUBs through which the service request was forwarded. In an example embodiment, when forwarding a request, an RHUB may add its RHUB ID to the request. If the request is sent from an NFc and relating to an NFp through more than one RHUB, each RHUB may add its own RHUB ID. If the request comprises a list of RHUB IDs, the RHUB may either append its RHUB ID to the list of RHUB IDs or may replace the list of RHUB IDs by its own ID. In an example embodiment, when receiving a service request from an NFc and relating to an NFp and when the service request comprises a list of RHUB IDs, an SCP may include the RHUB IDs in a discovery request or an access token request and may send the discovery request or the access token request to the NRF in the target network. In an example embodiment, an NRF in the source network may forward a discovery request or an access token request towards the NRF in the target network, possibly via RHUBs. An RHUB forwarding the discovery request or the access token request may add its RHUB ID to the discovery request or the access token request. If the discovery request or the access token request comprises a list of RHUB IDs, the RHUB may either append its RHUB ID to the list of RHUB IDs or may replace the list of RHUB IDs by its RHUB ID. Several roaming models may be supported. In a first roaming model, the target network operator may have a roaming agreement with an RHUB. The target network operator may inherit all roaming agreements supported by the RHUB (e.g. roaming agreement with all source network operators x, y and z). There may be direct signaling between the RHUB and the NFp of the target PLMN. Source PLMN x, y, z <------------> RHUB <-------------> Target PLMN In a second roaming model, the target network operator may have a roaming agreement with an RHUB. The target network operator may inherit some of the roaming agreements supported by the RHUB (e.g. roaming agreement with source network operators x and y but no roaming agreement with source network operator z). There may be direct signaling between the RHUB and the NFp of the target PLMN. Source PLMN x, y, z ------------> RHUB -------------> Target PLMN In a third roaming model, the target network operator may have a roaming agreement with an RHUB 1. The target network operator may inherit all roaming agreements supported by the RHUB 1 (e.g. roaming agreement with all source network operators x, y and z) based on the target PLMN’s roaming agreements with RHUB 2. There may be indirect signaling between the RHUB 1 and the NFp in the target PLMN via the RHUB 2. Source PLMN x, y, z <---------> RHUB 1 ----------> RHUB 2 <----------> Target PLMN In a fourth roaming model, the target network operator may have a roaming agreement with an RHUB 1. The target network operator may inherit some of the roaming agreements supported by the RHUB 1 (e.g. roaming agreement with source network operators x and y and no roaming agreement with source network operator z) based on the target PLMN’s roaming agreements with RHUB2. There may be indirect signaling between the RHUB 1 and the NFp in the target PLMN via the RHUB 2. Source PLMN x, y, z <---------> RHUB 1 <----------> RHUB 2 <-----------> Target PLMN Other roaming models may be contemplated. It will be understood that it is not a pre-requisite that a UE is configured with two subscription permanent identifiers (SUPIs) (e.g. its home PLMN SUPI and an RHUB network operator SUPI) to support roaming hubbing. Doing so may be restrictive and constraining. However, the scenario in which the UE is configured with different SUPIs to be able to register with different networks may be contemplated. One or more aspects of the subject disclosure may be applicable irrespective of the number of SUPIs within the UE as it provides a generic solution that enables communication across two PLMNs, two SNPNs or between a PLMN and SNPN. One or more aspects of the subject disclosure may be applicable to SEPP deployments, including hosted SEPP deployments. One or more aspects of the subject disclosure may be applicable to other intermediaries than an RHUB. FIG. 4 shows a signaling diagram of a process for controlling (e.g. allowing or disallowing) a discovery request originating from an NFcin a source network (e.g. source PLMN) and relating to an NFp in a target network (e.g. target PLMN). The NFc may send, to RHLIB 1, a discovery request. RHUB 1 may include RHUB 1 ID within the discovery request and may forward the discovery request to RHUB 2. RHUB 2 may include RHUB 2 ID within the discovery request and may forward the discovery request to NRF. The NRF may determine whether to allow or disallow the discovery request based on at least one of RHUB 1 ID or RHUB 2 ID and a list of allowed or disallowed RHUB IDs stored at the NRF. If at least one of RHUB 1 ID or RHUB 2 ID is part of a list of allowed RHUB IDs stored at the NRF, the NRF may allow the discovery request. If at least one of RHUB 1 ID or RHUB 2 ID is part of a list of disallowed RHUB IDs stored at the NRF, the NRF may disallow the discovery request. The NRF may send a discovery response to the NFc indicating that the discovery request is allowed. The discovery response may comprise an NFp profile. FIG. 5 shows a signaling diagram of a process for controlling (e.g. allowing or disallowing) a service request originating from an NFc in a source network (e.g. source PLMN) and relating to an NFp in a target network (e.g. target PLMN). The NFc may send, to RHUB 1, a service request. RHUB 1 may include RHUB 1 ID within the service request and may forward the service request to RHUB 2. RHUB 2 may include RHUB 2 ID within the service request and may forward the service request to SCP The SCP may be part of the source network or the target network. The SCP may send, to the NRF, a discovery request comprising RHUB ID 1 and RHUB ID 2. The SCP may, for example, indicate RHUB 1 ID and RHUB 2 ID using a new query parameter or using an http header. The NRF may determine whether to allow or disallow the service request based on at least one of RHUB 1 ID or RHUB 2 ID and a list of allowed or disallowed RHUB IDs stored at the NRF. If at least one of RHUB 1 ID or RHUB 2 ID is part of a list of allowed RHUB IDs stored at the NRF, the NRF may allow the service request. If at least one of RHUB 1 ID or RHUB 2 ID is part of a list of disallowed RHUB IDs stored at the NRF, the NRF may disallow the service request. SCP may receive, from the NRF, a discovery response indicating that the discovery request is allowed. The discovery response may comprise an NFp profile. The SCP may send, to the NFp, a service request comprising RHUB ID 1 and RHLIB ID 2. The NFp may send, to the NFc, a service response. FIG. 6 shows a signaling diagram of a process for controlling (e.g. allowing or disallowing) an access token request originating from a NFc in a source network (e.g. source PLMN) and relating to a NFp in a target network (e.g. target PLMN). The NFc may send, to RHUB 1, an access token request. RHUB 1 may include RHUB 1 ID within the access token request and may forward the access token request to RHUB 2. RHUB 2 may include RHUB 2 ID within the access token request and may forward the access token request to the NRF. The NRF may determine whether to allow or disallow the access token request, based on at least one of RHUB 1 ID or RHUB 2 ID and a list of allowed or disallowed RHUB IDs stored at the NRF. If at least one of RHUB 1 ID or RHUB 2 ID is part of a list of allowed RHUB IDs stored at the NRF, the NRF may allow the access token request. If at least one of RHUB 1 ID or RHUB 2 ID is part of a list of disallowed RHUB IDs stored at the NRF, the NRF may disallow the access token request. The NRF may send an access token response to the NFc comprising an access token. The access token may comprise at least one RHUB ID that is part of the list of allowed RHUB IDs stored at the NRF. Here, the access token may comprise RHUB ID 1 and RHUB ID 2. FIG. 7 shows a signaling diagram of a process for controlling (e.g. allowing or disallowing) a service request originating from an NFc in a source network (e.g. source PLMN) and relating to an NFp in a target network (e.g. target PLMN). The NFc may send, to RHUB 1, a service request. RHUB 1 may include RHUB 1 ID within the service request and may forward the service request to RHUB 2. RHUB 2 may include RHUB 2 ID within the service request and may forward the service request to the SOP. The SCP may be part of the target network (e.g. same network as NRF and NFp). SCP may send, to NRF, an access token request comprising RHUB 1 ID and RHUB 2 ID. The SCP may, for example, indicate RHUB 1 ID and RHUB 2 ID using a new query parameter or using an http header. The NRF may determine whether to allow or disallow the access token request based on at least one of RHUB 1 ID or RHUB 2 ID and a list of allowed or disallowed RHUB IDs stored at the NRF. If at least one of RHUB 1 ID or RHUB 2 ID is part of a list of allowed RHUB IDs stored at the NRF, the NRF may allow the access token request. If at least one of RHUB 1 ID or RHUB 2 ID is part of a list of disallowed RHUB IDs stored at the NRF, the NRF may disallow the access token request. SCP may receive, from NRF, an access token response comprising an access token. The access token may comprise RHUB ID 1 and RHUB ID 2. SCP may send, to the NFp, a service request comprising RHUB ID 1 and RHUB ID 2 and the access token comprising RHUB ID 1 and RHUB ID 2. The SCP may determine whether to forward the service request to the NFp depending on whether the received RHUB IDs match the RHUB IDs the access token. The NFp may determine whether to allow or disallow the service request, based on whether at least one of RHUB 1 ID or RHUB 2 ID matches RHUB 1 ID or RHUB 2 ID comprised in the access token. If at least one of RHUB 1 ID or RHUB 2 ID matches RHUB 1 ID or RHUB 2 ID comprised in the access token, the NFp may allow the service request. If at least one of RHUB 1 ID or RHUB 2 ID does not match RHUB 1 ID or RHUB 2 ID comprised in the access token, the NFp may disallow the service request. The NFp may send, to the NFc, a service response if this is required by the service request. FIG. 8 shows a signaling diagram of a process for allowing or disallowing a service request originating from an NFc in a source network (e.g. source PLMN) and relating to an NFp in a target network (e.g. target PLMN). The NFc may send, to RHUB 1, a service request comprising an access token. The access token may comprise RHUB 1 ID and RHUB 2 ID. RHUB 1 may include RHUB 1 ID within the service request and may forward the service request to RHUB 2. RHUB 2 may include RHUB 2 ID within the service request and may forward the service request to the NFp. The NFp may determine whether to allow or disallow the service request based on whether at least one of RHUB 1 ID or RHUB 2 ID added by RHUB 1 and RHUB 2 matches RHUB 1 ID or RHUB 2 ID comprised in the access token. If at least one of RHUB 1 ID or RHUB 2 ID added by RHUB 1 and RHUB 2 matche(s) RHUB 1 ID or RHUB 2 ID comprised in the access token, the NFp may allow the service request. If at least one of RHUB 1 ID or RHUB 2 ID added by RHUB 1 and RHUB 2 does not match RHUB 1 ID or RHUB 2 ID comprised in the access token, the NFp may disallow the service request. The NFp may send a service response to the NFc if this is required by the service request. FIG. 9 shows a block diagram of a method for controlling (e.g. allowing or disallowing) a service request originating from an NFc and relating to an NFp, performed by an apparatus such as an NRF, the NFp, an SCP or an SEPP. In step 900, the apparatus may receive a request originating from a nNFc in a source network and relating to a NFp in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node having forwarded the request. In step 902, the apparatus may determine whether the at least one forwarding node identifier is part of a list of at least one of allowed or disallowed forwarding node identifiers. In step 904, the apparatus may control the request based on the determination. The apparatus may determine that the at least one forwarding node identifier is part of a list of allowed forwarding node identifiers or is not part of a list of disallowed forwarding node identifiers. The apparatus may allow the request based on the determination. The apparatus may determine that the at least one forwarding node identifier is not part of a list of allowed forwarding node identifiers or is part of a list of disallowed forwarding node identifiers. The apparatus may disallow the request based on the determination. The at least one forwarding node identifier may identify at least one network providing roaming services to other networks. Operators of the other networks may have a roaming agreement with an operator of the at least one network or operators of the other networks belong to a same operator group as an operator of the at least one network. The request may comprise at least one of: a forwarding node identifier identifying a forwarding node that first forwarded the request from the NFc in the source network or a forwarding node identifier identifying a forwarding node that last forwarded the request to the NFp in the target network. The request may comprise at least one of: a forwarding node identifier identifying a forwarding node that first forwarded the request received from the NFc in the source network via a SCP or a forwarding node identifier identifying a forwarding node that last forwarded the request transmitted to the NFp in the target network via a SCP. The the forwarding node identifier identifying the forwarding node that first forwarded the request from the NFc in the source network may be added to the request by the NFc, a SCP or a SEPP or the forwarding node identifier identifying the forwarding node that last forwarded the request to the NFp in the target network may be added to the request by a SEPP in the target network. The list of allowed or disallowed forwarding node identifiers may be one of a plurality of list of allowed or disallowed forwarding node identifiers. The plurality of list of allowed or disallowed forwarding node identifiers may comprise at least one of: a list of allowed or disallowed forwarding node identifiers that first forwarded the request; and a list of allowed or disallowed forwarding node identifiers that last forwarded the request. The request may be received from a RHUB, a SCP or a SEPP. The request may comprises at least one of: a discovery request to discover the NFp in the target network, an access token request to get an authorization to access a service of the NFp in the target network, or a service request to receive a service produced by the NFp in the target network. The apparatus may receive, from the target network, the list of allowed or disallowed forwarding node identifiers. The apparatus may store the list of allowed or disallowed forwarding node identifiers. The list of allowed or disallowed forwarding node identifiers may be specific for at least one of: a target network, a source network, a NFc type, a NFp type, a service type, an instance of a NFc or an instance of a NFp. The apparatus may store a network function service producer profile. The apparatus may store the list of allowed or disallowed forwarding node identifiers within the NFp profile. The apparatus may register the NFp profile with a NRF. The apparatus may store roaming profiles. The apparatus may store the list of allowed or disallowed forwarding node identifiers within one of the roaming profiles. The apparatus may store a network function service producer profile. The apparatus may store a list of roaming profile identifiers identifying roaming profiles within the NFp profile. The apparatus may register the NFp profile with a NRF. The apparatus may store a NFp profile. The apparatus may store an indication that the NFp is discoverable and accessible by a NFc in a source network within the NFp profile. The apparatus may register the NFp profile with a NRF. The apparatus may determine whether the at least one forwarding node identifier is part of a list of allowed or disallowed hub identifiers using a list of allowed or disallowed forwarding node identifiers inside a NFp profile. The apparatus may determine whether the at least one forwarding node identifier received is part of a list of allowed or disallowed forwarding node identifiers using a list of allowed or disallowed forwarding node identifiers within a roaming profile or within local configuration. The apparatus may configured to perform functions of a CN function. The CN function is the NFp, a NRF, a SCP, or a SEPP. The request may be an access token request comprising at least one forwarding node identifier. The apparatus may determine that the at least one forwarding node identifier is part of a list of allowed forwarding node identifiers. The apparatus may allow the request based on the determination. The apparatus may send, to the NFc, an access token comprising the at least one forwarding node identifier. The access token may indicate whether the least one forwarding node identifier identifies a forwarding node that first forwards the request from the NFc in the source network or a forwarding node that last forwards the request to the NFp in the target network. The apparatus may be the NFp. The request may be a service request comprising at least one first forwarding node identifier identifying a forwarding node having forwarded the request, and comprising an access token comprising at least one second forwarding node identifier that is part of a list of allowed forwarding node identifiers. The apparatus may determine that the at least one first forwarding node identifier matches the at least one second forwarding node identifier. The apparatus may allow the request based on the determination. A forwarding node may be a roaming hub. FIG. 10 shows a block diagram of a method for controlling (e.g. allowing or disallowing) a service request originating from an NFc and relating to an NFp, performed by an apparatus such as an SCR In step 1000, the apparatus receive a request originating from a NFc in a source network and relating to a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node having forwarded the request. In step 1002, the apparatus may send, to a network function repository, another request comprising the at least one forwarding node identifier identifying the forwarding node having forwarded the request. The request may be a service request and the other request may be at least one of a discovery request or an access token request. FIG. 11 shows a schematic representation of non-volatile memory media 1100 storing instructions which when executed by a processor allow the processor to perform one or more of the steps of the methods of FIGS. 9 and 10. It is noted that while the above describes various example embodiments, there are several variations and modifications which may be made without departing from the scope of the example embodiments. It will be understood that although the above concepts have been discussed in the context of a 5GS, one or more of these concepts may be applied to other cellular standards and systems. The example embodiments may thus vary within the scope of the claims. In general, certain example embodiments may be implemented in hardware or special purpose circuits, software, logic or any combination thereof. For example, some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software which may be executed by a controller, microprocessor or other computing device, although embodiments are not limited thereto. While various example embodiments may be illustrated and described as block diagrams, flow charts, or using some other pictorial representation, it is well understood that these blocks, apparatus, systems, techniques or methods described herein may be implemented in, as non-limiting examples, hardware, software, firmware, special purpose circuits or logic, general purpose hardware or controller or other computing devices, or some combination thereof. The various example embodiments may be implemented by computer software stored in a memory and executable by at least one data processor of the involved entities or by hardware, or by a combination of software and hardware. Further in this regard, it should be noted that any procedures, e.g., as in FIG. 9, may represent program steps, or interconnected logic circuits, blocks and functions, or a combination of program steps and logic circuits, blocks and functions. The software may be stored on such physical media as memory chips, or memory blocks implemented within the processor, magnetic media such as hard disk or floppy disks, and optical media such as for example DVD and the data variants thereof, CD. The memory may be of any type suitable to the local technical environment and may be implemented using any suitable data storage technology, such as semiconductor-based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory and removable memory. The data processors may be of any type suitable to the local technical environment, and may include one or more of general purpose computers, special purpose computers, microprocessors, digital signal processors (DSPs), application specific integrated circuits (ASIC), gate level circuits and processors based on multi-core processor architecture, as non-limiting examples. Additionally or alternatively, some example embodiments may be implemented using circuitry. The circuitry may be configured to perform one or more of the functions and / or method steps previously described. That circuitry may be provided in the base station, a network function and / or in the communications device. As used herein, the term “circuitry” may refer to one or more or all of the following example embodiments: (a) hardware-only circuit implementations (such as implementations in only analogue and / or digital circuitry); (b) combinations of hardware circuits and software, such as: (i) a combination of analogue and / or digital hardware circuit(s) with software / firmware and (ii) any portions of hardware processor(s) with software (including digital signal processor(s)), software, and memory(ies) that work together to cause an apparatus, such as the communications device or base station to perform the various functions previously described; and (c) hardware circuit(s) and or processor(s), such as a microprocessor(s) or a portion of a microprocessor(s), that requires software (e.g. firmware) for operation, but the software may not be present when it is not needed for operation. This definition of circuitry applies to all uses of this term herein, including in any claims. As a further example, as used herein, the term circuitry also covers an implementation of merely a hardware circuit or processor (or multiple processors) or portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term circuitry also covers, for example, an integrated device. The foregoing has provided, by way of illustrative and non-limiting examples, a full and informative description of the various example embodiments of the subject disclosure. However, various modifications and adaptations may become apparent to those skilled in the relevant arts in view of the foregoing, when read in conjunction with the accompanying drawings and the claims. However, all such and similar modifications of the teachings will still fall within the scope of the example embodiments.

Claims

1. An apparatus comprising at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to:receive a request originating from a network function service consumer in a source network and relating to a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node having forwarded the request;determine whether the at least one forwarding node identifier is part of a list of at least one of allowed or disallowed forwarding node identifiers; andcontrol the request based on the determination.

2. The apparatus of claim 1, wherein the at least one memory store instructions that, when executed by the at least one processor, cause the apparatus at least to:determine that the at least one forwarding node identifier is part of a list of allowed forwarding node identifiers or is not part of a list of disallowed forwarding node identifiers; andallow the request based on the determination.

3. The apparatus of claim 1, wherein the at least one memory store instructions that, when executed by the at least one processor, cause the apparatus at least to:determine that the at least one forwarding node identifier is not part of a list of allowed forwarding node identifiers or is part of a list of disallowed forwarding node identifiers; anddisallow the request based on the determination.

4. The apparatus of any of claims 1 to 3, wherein the at least one forwarding node identifier identifies at least one network providing roaming services to other networks; andwherein operators of the other networks have a roaming agreement with an operator of the at least one network or wherein operators of the other networks belong to a same operator group as an operator of the at least one network.

5. The apparatus of any of claims 1 to 4, wherein the request comprises at least one of:a forwarding node identifier identifying a forwarding node that first forwarded the request from the network function service consumer in the source network; ora forwarding node identifier identifying a forwarding node that last forwarded the request to the network function service producer in the target network.

6. The apparatus of claim 5, wherein the forwarding node identifier identifying the forwarding node that first forwarded the request from the network function service consumer in the source network is added to the request by the network function service consumer, a service communication proxy or a security edge protection proxy in the source network; orwherein the forwarding node identifier identifying the forwarding node that last forwarded the request to the network function service producer in the target network is added to the request by a security edge protection proxy in the target network.

7. The apparatus of any of claims 1 to 6, wherein the list of allowed or disallowed forwarding node identifiers is one of a plurality of list of allowed or disallowed forwarding node identifiers.

8. The apparatus of claim 7, wherein the plurality of list of allowed or disallowed forwarding node identifiers comprises at least one of:a list of allowed or disallowed forwarding node identifiers that first forwarded the request; anda list of allowed or disallowed forwarding node identifiers that last forwarded the request.

9. The apparatus of any of claims 1 to 8, wherein the request is received from a roaming hub, a service communication proxy or a security edge protection proxy.

10. The apparatus of any of claims 1 to 9, wherein the request comprises at least one of: a discovery request to discover the network function service producer in the target network;an access token request to get an authorization to access a service of the network function service producer in the target network; ora service request to receive a service produced by the network function service producer in the target network.

11. The apparatus of any of claims 1 to 10, wherein the at least one memory store instructions that, when executed by the at least one processor, cause the apparatus at least to:receive, from the target network, the list of allowed or disallowed forwarding node identifiers; andstore the list of allowed or disallowed forwarding node identifiers.

12. The apparatus of any of claims 1 to 11, wherein the list of allowed or disallowed forwarding node identifiers is specific for at least one of: a target network, a source network, a network function service consumer type, a network function service producer type, a service type, an instance of a network function service consumer or an instance of a network function service producer.

13. The apparatus of claim 11 or claim 12, wherein the at least one memory store instructions that, when executed by the at least one processor, cause the apparatus at least to:store a network function service producer profile;store the list of allowed or disallowed forwarding node identifiers within the network function service producer profile; andregister the network function service producer profile with a network repository function.

14. The apparatus of claim 11 or claim 12, wherein the at least one memory store instructions that, when executed by the at least one processor, cause the apparatus at least to:store roaming profiles; andstore the list of allowed or disallowed forwarding node identifiers within one of the roaming profiles.

15. The apparatus of claim 11 or claim 12, wherein the at least one memory store instructions that, when executed by the at least one processor, cause the apparatus at least to:store a network function service producer profile;store a list of roaming profile identifiers identifying roaming profiles within the network function service producer profile; andregister the network function service producer profile with a network repository function.

16. The apparatus of any of claims 1 to 15, wherein the at least one memory store instructions that, when executed by the at least one processor, cause the apparatus at least to:store a network function service producer profile;store an indication that the network function service producer is discoverable and accessible by a network function service consumer in a source network within the network function service producer profile; andregister the network function service producer profile with a network repository function.

17. The apparatus of any of claims 1 to 16, wherein the at least one memory store instructions that, when executed by the at least one processor, cause the apparatus at least to:determine whether the at least one forwarding node identifier is part of a list of allowed or disallowed hub identifiers using a list of allowed or disallowed forwarding node identifiers inside a network function service producer profile.

18. The apparatus of any of claims 1 to 17, wherein the at least one memory store instructions that, when executed by the at least one processor, cause the apparatus at least to:determine whether the at least one forwarding node identifier received is part of a list of allowed or disallowed forwarding node identifiers using a list of allowed or disallowed forwarding node identifiers within a roaming profile or within local configuration.

19. The apparatus of any of claims 1 to 18, wherein the apparatus is configured to performfunctions of a core network function.

20. The apparatus of claim 19, wherein the core network function is the network function service producer, a network repository function, a service communication proxy, or a security edge protection proxy.

21. The apparatus of claim 20, wherein the apparatus is a network repository function;wherein the request is an access token request comprising at least one forwarding node identifier;wherein the at least one memory store instructions that, when executed by the at least one processor, cause the apparatus at least to:determine that the at least one forwarding node identifier is part of a list of allowed forwarding node identifiers;allow the request based on the determination; andsend, to the network function service consumer, an access token comprising the at least one forwarding node identifier.

22. The apparatus of claim 21, wherein the access token indicates whether the least one forwarding node identifier identifies a forwarding node that first forwards the request from the network function service consumer in the source network or a forwarding node that last forwards the request to the network function service producer in the target network.

23. The apparatus of claim 20, wherein the apparatus is the network function service producer;wherein the request is a service request comprising at least one first forwarding node identifier identifying a forwarding node having forwarded the request, and comprising an access token comprising at least one second forwarding node identifier that is part of a list of allowed forwarding node identifiers;wherein the at least one memory store instructions that, when executed by the at least one processor, cause the apparatus at least to:determine that the at least one first forwarding node identifier matches the at least one second forwarding node identifier; andallow the request based on the determination.

24. The apparatus of any of claims 1 to 23, wherein a forwarding node is a roaming hub.

25. An apparatus comprising at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to:receive a request originating from a network function service consumer in a source network and relating to a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node having forwarded the request; andsend, to a network function repository, another request comprising the at least one forwarding node identifier identifying the forwarding node having forwarded the request.

26. The apparatus of claim 25 wherein the request is a service request and the other request is at least one of a discovery request or an access token request.

27. A method comprising:receiving a request originating from a network function service consumer in a source network and relating to a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node having forwarded the request;determining whether the at least one forwarding node identifier is part of a list of at least one of allowed or disallowed forwarding node identifiers; and control the request based on the determination.

28. A method comprising:receiving a request originating from a network function service consumer in a source network and relating to a network function service producer in a target network, wherein the request comprises at least one forwarding node identifier identifying a forwarding node having forwarded the request; andsending, to a network function repository, another request comprising the at least one forwarding node identifier identifying the forwarding node having forwarded the request.

29. A computer program comprising computer executable instructions which when run on one or more processors perform the steps of the method of claims 27 or claim 28.

Images