Service authorization for indirect communication in a communication system

1. A method comprising:

receiving a service request at a first service communication proxy element, wherein the service request is received from a service consumer and is a request to access at least one service of a service producer;

determining, by the first service communication proxy element, at least one target service producer based on the service request;

sending, from the first service communication proxy element, an access token request to an authorization entity, wherein the access token request is generated based on the determining step;

receiving, at the first service communication proxy element, an access token response from the authorization entity, wherein the access token response comprises an access token; and

sending, from the first service communication proxy element, a service request with the access token to a second service communication proxy element, wherein the second service communication proxy element is associated with the target service producer.

2. The method of claim 1 , wherein the first service communication proxy element is part of the same or a different communication network as the second service communication proxy element.

3. The method of claim 1 , wherein the access token response further comprises an expiration time for the access token.

4. The method of claim 1 , further comprising, prior to sending the access token request, the first service communication proxy element registering with the authorization entity as a confidential client of the authorization entity.

5. The method of claim 1 , wherein a mutually authenticated secure connection is previously established between the service consumer and the first service communication proxy element.

6. The method of claim 1 , wherein a mutually authenticated secure connection is previously established between the first service communication proxy element and the authorization entity.

7. The method of claim 1 , wherein the received service request further comprises identifying information associated with the service consumer.

8. The method of claim 1 , wherein the received service request further comprises identifying information associated with a given target service producer.

9. The method of claim 1 , wherein when the received service request does not comprise identifying information associated with a given target service producer, the first service communication proxy element performs target service producer discovery and selection.

10. The method of claim 1 , wherein the sent access token request further comprises a service consumer identifier, a target service producer name and/or type, and an authorization client identifier of the first service communication proxy element.

11. The method of claim 1 , wherein the service consumer and the service producer are each different network functions (NFs) in a 5G communication system.

12. The method of claim 1 , wherein the service request is an application programming interface (API) request.

13. An apparatus comprising:

at least one processor;

at least one memory including computer program code; the at least one memory and the computer program code being configured to, with the at least one processor, cause the apparatus at least to:

receive a service request, wherein the service request is received from a service consumer and is a request to access at least one service of a service producer;

determine at least one target service producer based on the service request;

send an access token request to an authorization entity, wherein the access token request is generated based on the target service producer determination;

receive an access token response from the authorization entity, wherein the access token response comprises an access token; and

send a service request with the access token to a service communication proxy element, wherein the service communication proxy element is associated with the target service producer, and wherein the apparatus is part of the same or a different communication network as the service communication proxy element associated with the service producer.

14. The apparatus of claim 13 , wherein the received service request further comprises identifying information associated with the service consumer.

15. The apparatus of claim 13 , wherein the received service request further comprises identifying information associated with a given target service producer.

16. An apparatus comprising:

at least one processor;

at least one memory including computer program code;

the at least one memory and the computer program code being configured to, with the at least one processor, cause the apparatus at least to:

receive a service request with an access token from a service communication proxy element associated with a service consumer, wherein the service request is a request by the service consumer to access at least one service of a service producer associated with the apparatus, and wherein the access token is previously obtained from an authorization entity;

verifying an integrity of the access token;

validating one or more claims extracted from the access token, when the access token is verified; and

sending the service request with the access token to a service communication proxy element associated with the service producer, when the one or more claims from the access token are validated, wherein the apparatus is part of the same or a different communication network as the service communication proxy element associated with the service producer.