Secure inter-mobile network communication

1. An apparatus comprising:

at least one processor;

at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to:

receive, in a service-producing first network entity in a first mobile network, a first message from a service-consuming second network entity in a second mobile network, the first message comprising a first callback resource identifier,

generate, in the service-producing first network entity, a second callback resource identifier on the basis of the first callback resource identifier, wherein the second callback resource identifier includes a domain name of a security edge node in the first network, and

send a callback message from the service-producing first network entity to the security edge node, the callback message comprising the second callback resource identifier.

2. The apparatus of claim 1 , wherein the first callback resource identifier comprises a Fully Qualified Domain Name (FQDN) of the service-producing first network entity, and the second callback resource identifier is a transformed version of the FQDN, with the domain name of the security edge node appended to the FQDN.

3. The apparatus of claim 1 , wherein the first message is a subscription creation message for a notification service and the callback message is a notification message destined to the second network entity.

4. The apparatus of claim 1 , configured to generate the second callback resource identifier in response to detecting a triggering condition for enabling routing of callback messages.

5. The apparatus of claim 1 , configured to establish a transport layer security session between the first network entity and the security edge node on the basis of the second callback resource identifier.

6. The apparatus of claim 5 , configured to cause application of a wildcard certificate associated with the domain name of the security edge node for transport layer security session authentication.

7. A method comprising:

receiving, in a service-producing first network entity in a first mobile network, a first message from a service-consuming second network entity in a second mobile network, the first message comprising a first callback resource identifier,

generating, in the service-producing first network entity, a second callback resource identifier on the basis of the first callback resource identifier, wherein the second callback resource identifier comprises a domain name of a security edge node in the first network, and

sending a callback message from the service-producing first network entity to the security edge node, the callback message comprising the second callback resource identifier.

8. The method of claim 7 , wherein the first callback resource identifier comprises a Fully Qualified Domain Name (FQDN) of the service-producing first network entity, and the second callback resource identifier is a transformed version of the FQDN, with the domain name of the security edge node appended to the FQDN.

9. The method of claim 7 , wherein first message is a subscription message for a notification service and the callback message is a notification message destined to the second network entity.

10. The method of claim 7 , wherein the second callback resource identifier is generated in response to detecting a triggering condition for enabling routing of callback messages.

11. The method of claim 7 , wherein a transport layer security session is established between the first network entity and the security edge node on the basis of the second callback resource identifier.

12. The method of claim 11 , wherein a wildcard certificate associated with the domain name of the security edge node is applied for transport layer security session authentication.