Method and apparatus related to authorisation tokens for service requests

1 . An apparatus comprising:

at least one processor; and

at least one memory including instructions of a network function service consumer for a mobile communication system, wherein the instructions, when executed by the at least one processor, cause the apparatus to perform operations, the operations comprising:

sending, to a service communication proxy (SCP) of the mobile communication system, a first service request for a service to which the network function service consumer delegates discovery of a network function service producer of the mobile communication system that exposes the service;

receiving, from the SCP in reply to the first service request, a first service response indicting acceptance of the first service request, wherein the service response includes an authorisation token used by the SCP to successfully acquire access to the service, the authorisation token indicating a token scope; and

in an instance of requiring access to the service, based on determining that the token scope matches a scope of the service at a service name level;

including the authorisation token in a second service request for the service; and

sending, to the SCP, the second service request including the authorization token.

2 . The apparatus according to claim 1 , wherein the determining that the token scope matches the scope for the service at the service level comprises determining a service name indicated in the token scope matches a service name indicated in the scope of the service.

3 . The apparatus according to claim 1 , wherein the including comprising including a resource or service operation for the service in the second service request.

4 . An apparatus comprising:

at least one processor; and

at least one memory including instructions of a service communication proxy (SCP) of a mobile communication system, wherein the instructions when executed by the at least one processor, cause the apparatus to perform operations, the operations comprising:

receiving from a network function service consumer, a first service request for a service;

sending, to a network repository function (NRF) of the mobile communication system, a discovery request to discover a network function service producer that exposes the service;

receiving, from the NRF, a discovery response comprising profile information for a network function service producer that exposes the service and an authorisation token to be used for acquiring access to the service;

sending to the network function service consumer in reply to the first service request, the discovery response that includes the authorisation token wherein the authorisation token indicates a token scope;

receiving, from the network function service consumer, a second service request for the service, the second service request comprising the authorisation token, and a scope of the service that matches the token scope at a service level; and

determining, based on the profile information for the network function service producer and the scope of the service whether the authorisation token is usable for acquiring access to the service requested by the second service request; and

based on determining that the authorization token is usable for acquiring access to the service, sending, to the network function service producer, the second service request comprising the authorization token.

5 . The apparatus according to claim 4 , wherein the scope indicates one or more resources for the service and wherein the token scope does not indicate any resources for the service.

6 . The apparatus according to claim 4 , wherein the scope indicates one or more service operations of the service and wherein the token scope does not indicate any service operations of the service.

7 . The apparatus according to claim 6 , wherein the scope indicates one or more resources for the service, and wherein the token scope does not indicate any resources for the service.

8 . The apparatus according to claim 4 , wherein the second service request comprises an additional scope indicating a resource for the service or a service operation of the service and wherein the operations further comprise:

determining that the authorisation token is not usable for acquiring access to the resource for the service or the service operation of the service;

based on the determining that the authorization token is not usable for acquiring access to the resource for the service or the service operation of the service, sending a request for another authorisation token for acquiring access to the resource for the service or the service operation of the service indicated in the additional scope of the service included in the second service request; and

receiving, from the network repository function, the another authorization token;

replacing, in the second service request, the authorization token with the another authorisation token for acquiring access to the service; and

sending, to the network function service producer, the second service request including the another authorisation token.

9 . The apparatus according to claim 4 , wherein the profile information for the network function service producer comprises information about authorisation requirements for authorizing access to the service exposed by the network function service producer.

10 . The apparatus according to claim 9 , wherein the information about authorisation requirements for authorizing access to the service exposed by the network function producer comprises information about token scopes required by the network function service producer.

11 . The apparatus according to claim 4 , wherein the operations further comprise:

receiving another service request a for the service, the another service request comprising a list of requested scopes for the service;

sending, to the network repository function, a request for another authorisation token specifying an intersection of the list of requested scopes for the service and a set of authorisation token scopes for the network function service producer;

receiving the another authorisation token from the network repository function; and

sending, to the network function service producer, the another service request for the service, the another service request including the another authorisation token.

12 . An apparatus comprising:

at least one processor; and

at least one memory storing instructions of a service communication proxy (SCP) of a mobile communication system, wherein the instructions, when executed by the at least one processor, cause the apparatus to perform:

receiving, from a network function service consumer of the mobile communication system, a first service request for a service exposed by a network function service producer of the mobile communication system; and

obtaining, from a network repository function:

(i) an authorisation token to be used to acquire access to the service; and

(ii) profile information for the network function service producer, the profile information comprising information about authorisation requirements for the network function service producer;

sending, to the network function service consumer, a service response in reply to the first service request, wherein the service response includes:

(i) the authorisation token to be used to acquire access to the service; and

(ii) the profile information for the network function service producer.

13 . The apparatus according to claim 12 , wherein the information about authorisation requirements for the network function service producer comprises information about authorisation token scopes required by the network function service producer for the service.

14 . The apparatus according to claim 12 , wherein the operations further comprise:

receiving, from the network function service consumer, a second service request for the service, the second service request comprising a list of scopes for the service;

sending, to the network repository function, a request for another authorisation token specifying an intersection of the list of scopes for the service and a set of authorisation token scopes for the network function service producer;

receiving the another authorisation token from the network repository function;

sending, to the network function service producer, a third service request for the service, the third service request comprising the another authorisation token;

receiving, from the network function service producer, a response to the third service request, the response indicating acceptance of the third service by the network; and

sending, to the network function service consumer, a response to the second service request, the response indicating acceptance of the second service request by the network service producer.