7.1.4 Network Function Service Authorization

NF service authorization shall ensure the NF Service Consumer is authorized to access the NF service provided by the NF Service Provider, according to e.g. the policy of NF, the policy from the serving operator, the inter-operator agreement.

Service authorization information shall be configured as one of the components in NF profile of the NF Service Producer. It shall include the NF type (s) and NF realms/origins allowed to consume NF Service(s) of NF Service Producer.

Due to roaming agreements and operator policies, a NF Service Consumer shall be authorised based on UE/subscriber/roaming information and NF type, the Service authorization may entail two steps:

• Check whether the NF Service Consumer is permitted to discover the requested NF Service Producer instance during the NF service discovery procedure. This is performed on a per NF granularity by NRF.

NOTE 1: When NF discovery is performed based on local configuration, it is assumed that locally configured NFs are authorized.

• Check whether the NF Service Consumer is permitted to access the requested NF Service Producer for consuming the NF service, with a request type granularity. This is performed on a per UE, subscription or roaming agreements granularity. This type of NF Service authorization shall be embedded in the related NF service logic.

NOTE 2: The security of the connection between NF Service Consumer and NF Service Producer is specified in TS 33.501 [29].

NOTE 3: It is expected that an NF authorization framework exists in order to perform consumer NF authorization considering UE, subscription or roaming agreements granularity. This authorization is assumed to be performed without configuration of the NRF regarding UE, subscription or roaming information.