Tech-invite  3GPPspecs  RELs  Glossaries  SIP
Info  21  22  23  24  25  26  27  28  29  31  32  33  34  35  36  37  38  4‑5x

full Contents for  TS 23.222  Word version:   17.0.0

Top   Up   Prev   Next
0…   4…   5   6…   6.3…   7…   8…   8.5…   8.9…   8.13…   8.17…   8.21…   8.25…   9…   10…   11…   A   B…   B.2   B.3   C…   D… 
8.13 Topology hiding  8.14 Authentication between the API invoker and the AEF prior to service API invocation  8.15 Authentication between the API invoker and the AEF upon the service API invocation  8.16 API invoker authorization to access service APIs 
...

 

8.13  Topology hiding  Word-p. 56
8.13.1  General
The procedure in this subclause corresponds to the architectural requirements for hiding the topology of the PLMN trust domain from the API invokers accessing the service APIs from outside the PLMN trust domain.
8.13.2  Information flows
8.13.2.1  Service API invocation request (API invoker - AEF-1)
The information flow service API invocation request from the API invoker to AEF‑1 (AEF acting as service communication entry point) is service API specific and the complete detail of the service API invocation request is out of scope of the present document. Table 8.17.2.1-1 describes the CAPIF related information elements which are included in the service API invocation request.
8.13.2.2  Service API invocation request (AEF-1 - AEF-2)
The information flow service API invocation request from AEF‑1 (AEF acting as service communication entry point) to AEF‑2 (destination AEF for handling service API) is service API specific and the complete detail of the service API invocation request is out of scope of the present document. Table 8.17.2.1-1 describes the CAPIF related information elements which are included in the service API invocation request.
8.13.2.3  Service API invocation response (AEF-2 - AEF-1)
The information flow service API invocation response from AEF‑2 (destination AEF for handling service API) to AEF‑1 (AEF acting as service communication entry point) is service API specific and the complete detail of the service API invocation response is out of scope of the present document. Table 8.17.2.2-1 describes the CAPIF related information elements which are included in the service API invocation response.
8.13.2.4  Service API invocation response (AEF-1 - API invoker)
The information flow service API invocation response from AEF‑1 (AEF acting as service communication entry point) to the API invoker is service API specific and the complete detail of the service API invocation response is out of scope of the present document. Table 8.17.2.2-1 describes the CAPIF related information elements which are included in the service API invocation response.
8.13.3  Procedure
Figure 8.13.3-1 illustrates the procedure for CAPIF topology hiding.
Pre-conditions:
  1. The API invoker has performed the service discovery and received the details of the service API which includes the information about the service communication entry point of the AEF‑1 in the CAPIF.
  2. The API invoker is authenticated and authorized to use the service API.
  3. The AEF‑1 in the CAPIF is configured with a policy for topology hiding including the entry point address of the service API (provided via AEF‑2).
Reproduction of 3GPP TS 23.222, Figure 8.13.3-1: Procedure for CAPIF topology hiding
Figure 8.13.3-1: Procedure for CAPIF topology hiding
Up
  1. The API invoker performs service API invocation according to the interface of the service API by sending a service API invocation request towards the AEF‑1 which exposes the service API towards the API invoker, and acts as topology hiding entity.
    2. NOTE:
    Steps 2 and 3 are not necessary when the AEF‑1 is capable to serve the service API invocation request.
  2. The AEF‑1 further resolves the actual destination service API address information according to the topology hiding policy and forwards the incoming service API invocation request to the service API of the related AEF‑2.
  3. The AEF‑1 receives a response request for service API invocation from service API provided by AEF‑2.
  4. The AEF‑1 resolves the destination API invoker address and also modifies the source address information of the AEF‑2 within the response request as per topology hiding policy and forwards the response request to the API invoker.
Up
8.14  Authentication between the API invoker and the AEF prior to service API invocation  Word-p. 57
8.14.1  General
The procedure in this subclause corresponds to the architectural requirements for authentication of the API invoker by the AEF.
To reduce latency during API invocation, the API invoker associated authentication information can be made available at the AEF after authentication between the API invoker and the CAPIF core function.
8.14.2  Information flows
NOTE:
The security aspects of this procedure are specified in subclause 6.4 and subclause 6.5.2 of TS 33.122.
8.14.3  Procedure
Figure 8.14.3-1 illustrates the procedure for authentication between the API invoker and the AEF.
Pre-conditions:
  1. Optionally, the CAPIF core function has shared the information required for authentication of the API invoker with the AEF.
Reproduction of 3GPP TS 23.222, Figure 8.14.3-1: Procedure for authentication between the API invoker and the AEF prior to service API invocation
Figure 8.14.3-1: Procedure for authentication between the API invoker and the AEF prior to service API invocation
Up
  1. The API invoker triggers authentication initiation to the AEF, including the API invoker identity.
  2. The AEF obtains the API invoker information required for authentication by the AEF, if not available.
  3. The AEF returns the result of authentication initiation in the authentication initiation response.
  4. The AEF verifies the identity of the API invoker and authenticates the API invoker.
NOTE 1:
The authentication process is specified in subclause 6.4 and subclause 6.5.2 of TS 33.122.
NOTE 2:
The authentication is terminated at the AEF acting as the service communication entry point when topology hiding is enabled for the service API.
Up
8.15  Authentication between the API invoker and the AEF upon the service API invocation  Word-p. 58
8.15.1  General
The procedure in this subclause corresponds to the architectural requirements for authentication of the API invoker by the AEF upon the service API invocation.
To reduce latency during API invocation, the API invoker associated authentication information can be made available at the AEF after authentication between the API invoker and the CAPIF core function.
8.15.2  Information flows
NOTE:
The security aspects of this procedure are specified in subclause 6.5.2.3 of TS 33.122.
8.15.2.1  Service API invocation request with authentication information
The information flow service API invocation request with authentication information from the API invoker to the AEF is service API specific and the complete detail of the service API invocation request is out of scope of the present document. Table 8.15.2.1-1 describes only the CAPIF related information elements which are included in the service API invocation request.
Information element
Status
Description
API invoker identity information
M
The information that determines the identity of the API invoker
Authentication information
M (see NOTE)
The authentication information obtained before initiating the service API invocation request
Service API identification
M
The identification information of the service API for which invocation is requested. The service API identification is part of the specific service API invocation request.
NOTE:
The specific aspect of this information element is specified in subclause 6.5.2.3 of TS 33.122.
Up
8.15.2.2  Service API invocation response  Word-p. 59
The information flow service API invocation response from the AEF to the API invoker is service API specific and the complete detail of the service API invocation response is out of scope of the present document. Table 8.15.2.2-1 describes only the CAPIF related information elements which are included in the service API invocation response.
Information element
Status
Description
Result
M
Indicates the success or failure of service API invocation.
8.15.3  Procedure
Figure 8.15.3-1 illustrates the procedure for authentication of the API invoker by the AEF, where the authentication information is carried in the API invocation request.
Pre-conditions:
  1. Optionally, the CAPIF core function has shared the information required for authentication of the API invoker with the AEF.
Reproduction of 3GPP TS 23.222, Figure 8.15.3-1: Procedure for authentication between the API invoker and the AEF upon the service API invocation
Figure 8.15.3-1: Procedure for authentication between the API invoker and the AEF upon the service API invocation
Up
  1. The API invoker invokes a service API invocation request with authentication information to the AEF, and includes in this request authentication information, including the API invoker identity.
  2. The AEF obtains the API invoker information required for authentication by the AEF, if not available.
  3. The AEF verifies the identity of the API invoker and authenticates the API invoker.
    4. NOTE 1:
    The authentication process is specified in subclause 6.5.2.3 of TS 33.122.
  4. If the verification was successful, the AEF returns the result of the service API invocation in the Service API invocation response.
    5. NOTE 2:
    The authentication is terminated at the AEF acting as the service communication entry point when topology hiding is enabled for the service API.
Up
8.16  API invoker authorization to access service APIs  Word-p. 60
8.16.1  General
The procedure in this subclause corresponds to the architectural requirements for API invoker authorization to access service APIs.
A secure communication channel is mandatory in CAPIF.
To reduce latency during API invocation, the API invoker associated authorization information can be made available at the AEF after authentication between the API invoker and the CAPIF core function.
NOTE:
The security related aspects related to this procedure are out of scope of the present document.
8.16.2  Information flows
8.16.2.1  Service API invocation request
The information flow service API invocation request from the API invoker to the AEF is service API specific and the complete detail of the service API invocation request is out of scope of the present document. Table 8.16.2.1-1 describes only the CAPIF related information elements which are included in the service API invocation request.
Information element
Status
Description
API invoker identity information
M
The information that determines the identity of the API invoker
Authorization information
O (see NOTE)
The authorization information obtained before initiating the service API invocation request
Service API identification
M
The identification information of the service API for which invocation is requested. The service API identification is part of the specific service API invocation request.
NOTE:
The inclusion of this information element depends on the chosen solution for authorization.
Up
8.16.2.2  Service API invocation response
The information flow service API invocation response from the AEF to the API invoker is service API specific and the complete detail of the service API invocation response is out of scope of the present document. Table 8.16.2.2-1 describes only the CAPIF related information elements which are included in the service API invocation response.
Information element
Status
Description
Result
M
Indicates the success or failure of service API invocation.
8.16.3  Procedure  Word-p. 61
Figure 8.16.3-1 illustrates the procedure for API invoker authorization to access service APIs.
Pre-conditions:
  1. The API invoker has been authenticated.
  2. The API invoker associated authorization information is available at AEF.
Reproduction of 3GPP TS 23.222, Figure 8.16.3-1: Procedure for API invoker authorization to access service APIs
Figure 8.16.3-1: Procedure for API invoker authorization to access service APIs
Up
  1. The API invoker triggers service API invocation request to the AEF, including the service API to be invoked.
    2. NOTE 1:
    Authentication can also be performed if not authenticated previously.
    NOTE 2:
    The API invoker can trigger several service API invocations asynchronously.
  2. Upon receiving the service API invocation request, the AEF checks whether the API invoker is authorized to invoke that service API, based on the authorization information.
  3. If the AEF does not have information required to authorize service API invocation, the AEF obtains the authorization information from the CAPIF core function.
  4. The AEF executes the service logic for the invoked service API.
  5. The API invoker receives the service API invocation response as a result of the service API invocation.
Up

Up   Top   ToC