Study on security of application enablement aspects for subscriber-aware northbound API access
The scope of present document is based on the requirements for SNA (TS 22.261 clause 6.10.2) [2] and on the Study on application enablement aspects for subscriber-aware northbound API access (TR 23.700-95) [3].
The objective of this study is to:
1. Identify potential new security requirements related to API invocation (such as user authorization) and define potential solutions to fulfil these requirements. This encompasses:
- Whether and how CAPIF functions can determine the resource owner upon CAPIF invocation.
- Whether and how CAPIF can support obtaining authorization from the resource owner.
- Whether and how CAPIF can support revocation of authorization by the resource owner.
- Whether and how CAPIF can support security procedures with the aim to reduce authorization inquiries for a nested API invocation.
The study is not exclusively tailored to CAPIF, but should align with widely deployed authorization frameworks.
2. Identify potential security requirements for APIs used in SNAAPP and define potential solutions to fulfil these requirements.
This objective includes UE-originated API invocation.