Section: X.8.2.2 Policies configured as extended claims in access token
Content: Figure X.8.2.2-1: Protection of analytics exchange when policies configured as extended claims in access token Pre-requisite: - The producer NRF has the NF profile of the NF Service Producer including the list of allowed Analytics ID(s) per PLMN. According to TS 29.510[ 5G System; Network function repository services; Stage 3 ]  [68] clause 5.2.1, the NF profile can be configured in the NRF by other means such as O&M. Step 1: NWDAFc sends an access token request to the consumer NRF as specified in clause 13.4.1. The access token request may contain the Analytics ID. Step 2: vNRF forward the token request message to hNRF as specified in clause 13.4.1. Step 3: The home network hNRF shall verify the token get request as specified 13.4.1, then determine whether the requested analytics implied by the Analytics ID(s) can be obtained by the visited PLMN according to the allowed analytics ID(s) of the visited PLMN. Step 4: If the verification success, hNRF issue the token as specified in clause 13.4.1.The allowed Analytics ID(s) of the visited PLMN may be included in the token. Step 5: The vNRF forward the Token_Get Response to NWDAFc as specified in clause 13.4.1. Step 6: If the requested analytics is within the claim of token, the NWDAFc sends Nnwdaf_RoamingAnalytics_Subscribe/Request with the issued token to NWDAFp, Step 7: The roaming entry NWDAFp verifies the service request, including verifying token as specified in clause 13.4.1, and whether the requested analytics are consistent with the Analytics ID(s) in the token. Step 8: The roaming entry NWDAFp shall apply the security policies per consumer (PLMN) to the requested analytics and decide on their anonymization, restriction or desensitization based on operator’s policy. NOTE: The anonymization, restriction or desensitization mechanisms of data / analytics are left for implementation. Step 9: Roaming entry NWDAFp returns the requested and processed analytics to NWDAFc.