Fully qualified domain name handling for service interactions in 5G

1. A method by a first security edge protection proxy, SEPP, for security edge protection of messages being communicated between first and second communications networks of a communications system, the method comprising:

receiving, from a first network function of the first communications network, a first message containing an address identifying a second network function which is located in the second communications network;

receiving, from a second SEPP operating to protect communications with the second communications network, a second message containing a fully qualified domain name, FQDN, reference for a combination of the second SEPP and the second network function;

storing the FQDN reference for the combination of the second SEPP and second network function in a label-to-FQDN mapping data structure with a logical association to a substitute locally-unique label; and

sending a third message containing the substitute locally-unique label to the first network function.

2. The method of claim 1 , further comprising:

selecting the substitute locally-unique label to be stored with a logical association to the FQDN reference for the combination of the second SEPP and the second network function, based on a certificate rule.

3. The method of claim 1 , further comprising:

generating the substitute locally-unique label to be stored with a logical association to the FQDN reference for the combination of the second SEPP and the second network function, based on a randomly generated locally unique string.

4. The method of claim 1 , further comprising:

generating the substitute locally-unique label to be stored with a logical association to the FQDN reference for the combination of the second SEPP and the second network function, based on a combination of a foreign public land mobile network, PLMN, mobile network code, MNC, and mobile country code, MCC, combined with a counter.

5. The method of claim 1 , further comprising:

generating the substitute locally-unique label to be stored with a logical association to the FQDN reference for the combination of the second SEPP and the second network function, based on a hash of the FQDN reference for the combination of the second SEPP and second network function.

6. The method of claim 1 , wherein the step of sending the third message containing the substitute locally-unique label to the first network function, comprises:

appending the substitute locally-unique label to a FQDN of the first SEPP.

7. The method of claim 6 , wherein:

the substitute locally-unique label is appended as a first element of the FQDN of the first SEPP.

8. The method of claim 1 ,

wherein the first message comprises a service discovery message;

wherein the second message comprises a service reply message; and

further comprising:

receiving, from the first network function, a service request message containing the substitute locally-unique label;

identifying the FQDN reference for the combination of the second SEPP and the second network function using the substitute locally-unique label from the service request message as a look-up pointer within the label-to-FQDN mapping data structure;

replacing the substitute locally-unique label in the service request message with the FQDN reference for the combination of the second SEPP and the second network function to generate a modified service request message; and

sending the modified service request message to second SEPP to request service by the second network function.

9. The method of claim 1 , wherein:

the first message is a service discovery request message; and

the second message is a service discovery reply message.

10. The method of claim 9 ,

wherein the first message is received from a first network repository function, NRF, of the first communications system as a service discovery request for the first network function;

further comprising sending the service discovery request through the second SEPP to a second NRF of the second communications system; and

wherein the second message is received from the second SEPP as the reply message for the NRF for the second network function.

11. The method of claim 1 , wherein:

the first communications network is a visited public land mobile network; and

the second communications network is a home public land mobile network.

12. The method of claim 1 , wherein:

the first network function is a network access control and mobility management function, AMF.

13. The method of claim 1 , wherein:

the second network function is a unified data management, UDM, function.

14. The method of claim 1 , further comprising:

setting up a transport layer security, TLS, connection between the first SEPP and the first network function.

15. The method of claim 14 , further comprising:

authenticating the TLS connection toward the first network function using a wildcard certificate for the substitute locally-unique label.

16. A first security edge protection proxy, SEPP, network node ( 600 ) for security edge protection of messages being communicated between first and second communications networks of a communications system, the network node comprising:

a processor; and

a memory coupled to the processor, wherein the memory stores instructions that when executed by the processor causes the processor to perform operations according to claim 1 .

17. A computer program product, comprising:

a non-transitory computer readable storage medium comprising computer readable program code embodied in the medium that when executed by a processor of a network node causes the processor to perform operations according to claim 1 .