Section: 13.3.1.2 Indirect communication
Content: In indirect communication, NF and NRF shall use one of the following methods for authentication: - Mutual authentication between NF and NRF provided by the transport layer protection solution. - Client credentials assertion (CCA) based authentication as specified in clause 13.3.8. NOTE 1: Client credentials assertion authentication is based on a CCA token sent by the NF Service Consumer to the NRF via an intermediate such as the SCP. CCA based authentication does not provide authentication of the NRF towards the NF Service Consumer or protection of the service request sent by the NF Service Consumer to the NRF. - Implicit, i.e. by relying on authentication between NF Service Consumer and SCP, and between SCP and NRF, provided by the hop-by-hop security protection at the transport layer, NDS/IP, or physical security. NOTE 2: Mutual authentication between NF Service Consumer and NRF is not achieved with hop-by-hop security. NOTE 3: If only hop-by-hop security is used in a PLMN, the NRF is not able to verify that an access token request sent by SCP on behalf of a certain NF Service Consumer, is actually authorized by this consumer.