Content for TS 23.222 Word version: 17.5.0
8.13 Topology hiding
8.14 Authentication between the API invoker and the AEF prior to service API invocation
8.15 Authentication between the API invoker and the AEF upon the service API invocation
8.16 API invoker authorization to access service APIs
...
...
8.13 Topology hiding Word‑p. 56
8.13.1 General Word‑p. 56
The procedure in this subclause corresponds to the architectural requirements for hiding the topology of the PLMN trust domain from the API invokers accessing the service APIs from outside the PLMN trust domain.
8.13.2 Information flows Word‑p. 56
8.13.2.1 Service API invocation request (API invoker - AEF-1) Word‑p. 56
The information flow service API invocation request from the API invoker to AEF‑1 (AEF acting as service communication entry point) is service API specific and the complete detail of the service API invocation request is out of scope of the present document. Table 8.17.2.1-1 describes the CAPIF related information elements which are included in the service API invocation request.
8.13.2.2 Service API invocation request (AEF-1 - AEF-2) Word‑p. 56
The information flow service API invocation request from AEF‑1 (AEF acting as service communication entry point) to AEF‑2 (destination AEF for handling service API) is service API specific and the complete detail of the service API invocation request is out of scope of the present document. Table 8.17.2.1-1 describes the CAPIF related information elements which are included in the service API invocation request.
8.13.2.3 Service API invocation response (AEF-2 - AEF-1) Word‑p. 56
The information flow service API invocation response from AEF‑2 (destination AEF for handling service API) to AEF‑1 (AEF acting as service communication entry point) is service API specific and the complete detail of the service API invocation response is out of scope of the present document. Table 8.17.2.2-1 describes the CAPIF related information elements which are included in the service API invocation response.
8.13.2.4 Service API invocation response (AEF-1 - API invoker) Word‑p. 56
The information flow service API invocation response from AEF‑1 (AEF acting as service communication entry point) to the API invoker is service API specific and the complete detail of the service API invocation response is out of scope of the present document. Table 8.17.2.2-1 describes the CAPIF related information elements which are included in the service API invocation response.
8.13.3 Procedure Word‑p. 56
Figure 8.13.3-1 illustrates the procedure for CAPIF topology hiding.
Pre-conditions:
- The API invoker has performed the service discovery and received the details of the service API which includes the information about the service communication entry point of the AEF‑1 in the CAPIF.
- The API invoker is authenticated and authorized to use the service API.
- The AEF‑1 in the CAPIF is configured with a policy for topology hiding including the entry point address of the service API (provided via AEF‑2).
Step 1.
The API invoker performs service API invocation according to the interface of the service API by sending a service API invocation request towards the AEF‑1 which exposes the service API towards the API invoker, and acts as topology hiding entity.
Step 2.
The AEF‑1 further resolves the actual destination service API address information according to the topology hiding policy and forwards the incoming service API invocation request to the service API of the related AEF‑2.
Step 3.
The AEF‑1 receives a response request for service API invocation from service API provided by AEF‑2.
Step 4.
The AEF‑1 resolves the destination API invoker address and also modifies the source address information of the AEF‑2 within the response request as per topology hiding policy and forwards the response request to the API invoker.
8.14 Authentication between the API invoker and the AEF prior to service API invocation Word‑p. 57
8.14.1 General Word‑p. 57
The procedure in this subclause corresponds to the architectural requirements for authentication of the API invoker by the AEF.
To reduce latency during API invocation, the API invoker associated authentication information can be made available at the AEF after authentication between the API invoker and the CAPIF core function.
8.14.2 Information flows Word‑p. 57
8.14.3 Procedure Word‑p. 57
Figure 8.14.3-1 illustrates the procedure for authentication between the API invoker and the AEF.
Pre-condition:
- Optionally, the CAPIF core function has shared the information required for authentication of the API invoker with the AEF.
Step 1.
The API invoker triggers authentication initiation to the AEF, including the API invoker identity.
Step 2.
The AEF obtains the API invoker information required for authentication by the AEF, if not available.
Step 3.
The AEF returns the result of authentication initiation in the authentication initiation response.
Step 4.
The AEF verifies the identity of the API invoker and authenticates the API invoker.
8.15 Authentication between the API invoker and the AEF upon the service API invocation Word‑p. 58
8.15.1 General Word‑p. 58
The procedure in this subclause corresponds to the architectural requirements for authentication of the API invoker by the AEF upon the service API invocation.
To reduce latency during API invocation, the API invoker associated authentication information can be made available at the AEF after authentication between the API invoker and the CAPIF core function.
8.15.2 Information flows Word‑p. 58
8.15.2.1 Service API invocation request with authentication information Word‑p. 58
The information flow service API invocation request with authentication information from the API invoker to the AEF is service API specific and the complete detail of the service API invocation request is out of scope of the present document. Table 8.15.2.1-1 describes only the CAPIF related information elements which are included in the service API invocation request.
| Information Element | Status | Description |
|---|---|---|
| API invoker identity information | M | The information that determines the identity of the API invoker |
| Authentication information | M (1) | The authentication information obtained before initiating the service API invocation request |
| Service API identification | M | The identification information of the service API for which invocation is requested. The service API identification is part of the specific service API invocation request. |
|
NOTE 1:
The specific aspect of this information element is specified in subclause 6.5.2.3 of TS 33.122.
|
||
8.15.2.2 Service API invocation response Word‑p. 59
The information flow service API invocation response from the AEF to the API invoker is service API specific and the complete detail of the service API invocation response is out of scope of the present document. Table 8.15.2.2-1 describes only the CAPIF related information elements which are included in the service API invocation response.
| Information Element | Status | Description |
|---|---|---|
| Result | M | Indicates the success or failure of service API invocation. |
8.15.3 Procedure Word‑p. 59
Figure 8.15.3-1 illustrates the procedure for authentication of the API invoker by the AEF, where the authentication information is carried in the API invocation request.
Pre-condition:
- Optionally, the CAPIF core function has shared the information required for authentication of the API invoker with the AEF.
Step 1.
The API invoker invokes a service API invocation request with authentication information to the AEF, and includes in this request authentication information, including the API invoker identity.
Step 2.
The AEF obtains the API invoker information required for authentication by the AEF, if not available.
Step 3.
The AEF verifies the identity of the API invoker and authenticates the API invoker.
Step 4.
If the verification was successful, the AEF returns the result of the service API invocation in the Service API invocation response.
8.16 API invoker authorization to access service APIs Word‑p. 60
8.16.1 General Word‑p. 60
The procedure in this subclause corresponds to the architectural requirements for API invoker authorization to access service APIs.
A secure communication channel is mandatory in CAPIF.
To reduce latency during API invocation, the API invoker associated authorization information can be made available at the AEF after authentication between the API invoker and the CAPIF core function.
8.16.2 Information flows Word‑p. 60
8.16.2.1 Service API invocation request Word‑p. 60
The information flow service API invocation request from the API invoker to the AEF is service API specific and the complete detail of the service API invocation request is out of scope of the present document. Table 8.16.2.1-1 describes only the CAPIF related information elements which are included in the service API invocation request.
| Information Element | Status | Description |
|---|---|---|
| API invoker identity information | M | The information that determines the identity of the API invoker |
| Authorization information | O (1) | The authorization information obtained before initiating the service API invocation request |
| Service API identification | M | The identification information of the service API for which invocation is requested. The service API identification is part of the specific service API invocation request. |
|
NOTE 1:
The inclusion of this information element depends on the chosen solution for authorization.
|
||
8.16.2.2 Service API invocation response Word‑p. 60
The information flow service API invocation response from the AEF to the API invoker is service API specific and the complete detail of the service API invocation response is out of scope of the present document. Table 8.16.2.2-1 describes only the CAPIF related information elements which are included in the service API invocation response.
| Information Element | Status | Description |
|---|---|---|
| Result | M | Indicates the success or failure of service API invocation. |
8.16.3 Procedure Word‑p. 61
Figure 8.16.3-1 illustrates the procedure for API invoker authorization to access service APIs.
Pre-conditions:
- The API invoker has been authenticated.
- The API invoker associated authorization information is available at AEF.
Step 1.
The API invoker triggers service API invocation request to the AEF, including the service API to be invoked.
Step 2.
Upon receiving the service API invocation request, the AEF checks whether the API invoker is authorized to invoke that service API, based on the authorization information.
Step 2a.
If the AEF does not have information required to authorize service API invocation, the AEF obtains the authorization information from the CAPIF core function.
Step 3.
The AEF executes the service logic for the invoked service API.
Step 4.
The API invoker receives the service API invocation response as a result of the service API invocation.
