Methods and apparatus for subscription authorization enhancement

1 . An apparatus, comprising:

at least one processor; and

at least one memory storing instructions of a source network function service producer of a core network of a communication network, wherein the instructions, when executed by the at least one processor, cause the apparatus to perform operations, the operations comprising:

receiving, from a network function service consumer, a subscription request for the source network function service producer to create a subscription for the network function service consumer, the subscription causing the source network function service producer to send, to the network function service consumer, notifications upon occurrences of a specific event, the subscription request including access authorization information of the network function service consumer;

verifying that the network function service consumer is authorized to create the subscription based on the access authorization information;

based on the verifying, creating the subscription for the network function service consumer and storing a subscription context for the subscription, the subscription context including the access authorization information;

checking whether the access authorization information authorizes the subscription of the network function service consumer to be transferred to a target source network function service producer;

in an instance the access authorization information for the subscription authorizes the subscription for the network function service consumer to be transferred to the target source network function service producer, transferring, to the target source network function service producer, the subscription context for the subscription; and

in an instance the access authorization information for the subscription does not authorize the subscription for the network function service consumer to be transferred to the target source network function service producer, terminating the subscription for the network function service consumer.

2 . The apparatus according to claim 1 , wherein the the specific event relates to a user equipment, UE, event and the UE event is one of a change to a network slice that is serving the UE, or a mobility of the UE.

3 . The apparatus according to claim 1 , wherein the checking comprises at least one of:

checking whether the access authorization information authorizes the network function service consumer to subscribe to a network function service producer that belongs to one or more networks, wherein the target network function service producer is the network function service producer that belongs to one of the one or more networks;

checking whether the access authorization information authorizes the network function service consumer to subscribe to a network function service producer that belongs to one or more network function sets, wherein the target network function service producer is the network function service producer that belongs to one of the one or more network function sets; or

checking whether the access authorization information authorizes the network function service consumer to subscribe to a network function service producer that is associated with one or more service areas, wherein the target network function service producer is the network function server producer that is associated with at least one of the one or more service areas.

4 . The apparatus according to claim 1 , wherein the source network function service producer is a first Access and Mobility Management Function of a first public land mobile network and the target network function service producer is a second Access and Mobility Management Function of a second public land mobile network.

5 . The apparatus according to claim 1 , wherein the source network function producer is a source Access and Mobility Management Function (AMF), the target network function producer is a target AMF.

6 . The apparatus according to claim 1 , wherein the source network function service producer and the target network function service producer are part of at least one of a same network or different networks, a same network function set or different network function sets, or a same service area or different service areas.

7 . The apparatus according to claim 1 , wherein the access authorization information comprises at least one of; an access authorization token for the subscription; one parameter or a subset of parameters of the access authorization token for the subscription or an information indicating permission to access a service of the source network function service producer that is usable by the network function service consumer.

8 . The apparatus according to claim 7 , wherein the access authorization information includes one or more of: a network identifier of the target network function service producer; a network function set identifier of a set of at network function service producers that comprises the target network function service producer and the source network function service producer: or a service area identifier of a service area comprising the target network function service producer.

9 . An apparatus, comprising:

at least one processor; and

at least one memory including instructions of a target network function service producer, wherein the instructions, when executed with the at least one processor, cause the apparatus to perform operation, the operations comprising:

receiving, from a source network function service producer, a subscription context for a subscription for a network function service consumer, the subscription context including access authorization information of the network function service consumer;

checking whether the access authorization information authorizes transfer of the subscription for the network function service consumer to the target network function service producer; and

allowing the transfer of the subscription for the network function service consumer when the access authorization information authorizes the subscription for the network function service consumer to be transferred to the target network function service producer; and

suspending the subscription for the network function service consumer when the access authorization information does not authorize the subscription for the network function service consumer to be transferred to the target network function service producer, wherein the suspending comprises:

creating a pending subscription for the network function service consumer based on the subscription context and storing information that the pending subscription is missing access authorization information for the pending subscription;

sending, to the network function service consumer, an indication that there is a pending subscription for the network function consumer at the target network function service producer; and

receiving, from the network function service consumer, new access authorization information of the network function service consumer, the new access authorization information including an indication that the pending subscription for the network function consumer is authorized.

10 . The apparatus according to claim 9 , wherein the checking comprises at least one of:

checking whether the access authorization information authorizes the network function service consumer to subscribe to a network function service producer that belongs to one or more networks, and wherein the target network function service producer is the network function server producer that belongs to one of the one or more networks;

checking whether the access authorization information authorizes the network function service consumer to subscribe to a network function service producer that belongs to one or more network function sets, and wherein the target network function service producer is the network function server producer that belongs to one of the one or more network function sets; or

checking whether the access authorization information authorizes the network function service consumer to subscribe to a network function service producer that is located in one or more service areas, and wherein the target network function service producer is the network function server producer that is located in at least one of the one or more service areas.

11 . The apparatus according to claim 9 , wherein the suspending further comprises:

setting the pending subscription to be the subscription based on the new access authorization information including the indication that the pending subscription for the network function consumer is authorized.

12 . The apparatus according to claim 9 , wherein the operations further comprise:

after allowing the transfer of the subscription for the network function service consumer and detecting an occurrence of the specific event, sending, to the network function service consumer, a notification of the specific event.

13 . The apparatus according to claim 9 , wherein the suspending further comprises:

starting a timer;

based on determining that the new access authorization information of the network function service consumer is received after expiry of the timer, cancelling the pending subscription.

14 . The apparatus according to claim 9 , wherein the target network function service producer is a first Access and Mobility Management Function, AMF and the source network function producer is a second Access and Mobility Management Function.

15 . The apparatus according to claim 9 , wherein the source network function producer is a source Access and Mobility Management Function (AMF), the target network function producer is a target AMF.

16 . The apparatus according to claim 9 , wherein the target network function service producer and the source network function service producer are part of at least one of a same network or different networks, a same network function set or different network function sets, or a same service area or different service areas.

17 . The apparatus according to claim 9 , wherein the access authorization information comprises at least one of: an access authorization token for the subscription; one parameter or a subset of parameters of the access authorization token for the subscription; information indicating a permission to access a service of the target network function service producer that is usable by the network function service consumer; or an identifier of a public land mobile network that includes the target network function service producer.

18 . The apparatus according to claim 17 , wherein the access authorization information includes at least one of: a network identifier of the network function service producer; a network function set identifier of a set of network function service producers that comprises the target network function service producer and the source network function service producer; or a service area identifier of a service area that is associated with the target network function service producer.

19 . An apparatus comprising:

at least one processor; and

at least one memory including instructions of a target network function service producer, wherein the instructions, when executed with the at least one processor, cause the apparatus to perform operation, the operations comprising:

receiving, from a source network function service producer, a subscription context for a subscription for a network function service consumer, the subscription context including access authorization information of the network function service consumer;

checking whether the access authorization information authorizes transfer of the subscription for the network function service consumer to the target network function service producer;

when the access authorization information authorizes the subscription for the network function service consumer to be transferred to the target network function service producer, allowing the transfer of the subscription for the network function service consumer;

when the access authorization information does not authorize the subscription for the network function service consumer to be transferred to the target network function service producer:

suspending the subscription for the network function service consumer;

sending, to the network function service consumer, an indication to request creation of a new subscription for the network function service consumer;

receiving, from the network function service consumer, a subscription request for the new subscription for the network function service consumer, the subscription request including new access authorization information of the network function service consumer;

checking whether the new access authorization information authorizes the new subscription for the network function service consumer; and

allowing the creation of the new subscription for the network function service in an instance the new access authorization information authorizes the new subscription for the network function service consumer, or

rejecting the new subscription in an instance the new access authorization information does not authorize the new subscription for the network function service consumer.