Section: 13.2.4.8 Procedure
Content: The following clause illustrates the message flow between the two SEPPs with modifications from cIPX and pIPX. Figure 13.2.4.8-1 Message flow between two SEPPs 1. The cSEPP receives an HTTP request message from a network function. If the message contains a telescopic FQDN, the cSEPP removes its domain name from this FQDN to obtain the original FQDN as described in clause 13.1. 2. The cSEPP shall reformate the HTTP Request message as follows: a. The cSEPP shall generate blocks (JSON objects) for integrity protected data and encrypted data, and protecting them: The cSEPP shall encapsulate the HTTP request into a clearTextEncapsulatedMessage block containing the following child JSON objects: - Pseudo_Headers - HTTP_Headers with one element per header of the original request. - Payload that contains the message body of the original request. For each attribute that require end-to-end encryption between the two SEPPs, the attribute value is copied into a dataToIntegrityProtectAndCipher JSON object and the attribute's value in the clearTextEncapsulatedMessage is replaced by the index of attribute value in the dataToIntegrityProtectAndCipher block. The cSEPP shall create a metadata block that contains the N32-f context ID, message ID generated by the cSEPP for this request/response transaction and next hop identity. The cSEPP shall protect the dataToIntegrityProtect block and the dataToIntegrityProtectAndCipher block as per clause 13.2.4.4. This results in a single JWE object representing the protected HTTP Request message. b. The cSEPP shall generate payload for the SEPP to SEPP HTTP message: The JWE object becomes the payload of the new HTTP message generated by cSEPP. 3. The cSEPP shall use HTTP POST to send the HTTP message to the first Roaming Intermediary. 4. The first Roaming Intermediary (e.g. visited network's IPX provider) shall create a new modifiedDataToIntegrityProtect JSON object with three elements: a. The Operations JSON patch document contains modifications performed by the first Roaming Intermediary as per RFC 6902 [64]. b. The first Roaming Intermediary shall include its own identity in the Identity field of the modifiedDataToIntegrityProtect. c. The first Roaming Intermediary shall copy the "tag" element, present in the JWE object generated by the cSEPP, into the modifiedDataToIntegrityProtect object. This acts as a replay protection for updates made by the first Roaming Intermediary. The Roaming Intermediary shall execute JWS on the modifiedDataToIntegrityProtect JSON object and append the resulting JWS object to the message. 5. The first Roaming Intermediary shall send the modified HTTP message request to the second Roaming Intermediary (e.g. home network's IPX) as in step 3. 6. The second Roaming Intermediary shall perform further modifications as in step 4 if required. The second Roaming Intermediary shall further execute JWS on the modifiedDataToIntegrityProtect JSON object and shall append the resulting JWS object to the message. 7. The second Roaming Intermediary shall send the modified HTTP message to the pSEPP as in step 3. NOTE 1: The behaviour of the Roaming Intermediaries is not normative, but the pSEPP assumes that behaviour for processing the resulting request. 8. The pSEPP receives the message and shall perform the following actions: - The pSEPP extracts the serialized values from the components of the JWE object. - The pSEPP invokes the JWE AEAD algorithm to check the integrity of the message and decrypt the dataToIntegrityProtectAndCipher block. This results in entries in the encrypted block becoming visible in cleartext. - The pSEPP updates the clearTextEncapsulationMessage block in the message by replacing the references to the dataToIntegrityProtectAndCipher block with the referenced decrypted values from the dataToIntegrityProtectAndCipher block. - The pSEPP then verifies IPX provider updates of the attributes in the modificationsArray. It checks whether the modifications performed by the Roaming Intermediaries were permitted by policy. The pSEPP further verifies that the PLMN-ID contained in the message is equal to the "Remote PLMN-ID" in the related N32-f context. - The pSEPP updates the modified values of the attributes in the clearTextEncapsulationMessage in order. The pSEPP shall re-assemble the full HTTP Request from the contents of the clearTextEncapsulationMessage. 9. The pSEPP shall send the HTTP request resulting from step 8 to the home network's NF. 10.-18. These steps are analogous to steps 1.-9.