Section: 13.2.4 N32-f connection between SEPPs 13.2.4.1 General
Content: The SEPP receives HTTP/2 request/response messages from the Network Function. It shall perform the following actions on these messages before they are sent on the N32-f interface to the SEPP in the other PLMN: a) It parses the incoming message and, if present, rewrites the telescopic FQDN of the receiving NF to obtain the original FQDN as described in clause 13.1. b) It reformats the message to produce the input to JSON Web Encryption (JWE) [59] as described in clause 13.2.4.3. c) It applies JWE to the input created in b) to protect the reformatted message as described in clause 13.2.4.4. d) It encapsulates the resulting JWE object into a HTTP/2 message (as the body of the message) and sends the HTTP/2 message to the SEPP in the other PLMN over the N32-f interface. The message may be routed via the cIPX and pIPX nodes. These IPX nodes may modify messages as follows: a) The IPX node recovers the cleartext part of the HTTP message from the JWE object, modifies it according to the modification policy, and calculates an "operations" JSON Patch object. It then creates a temporary JSON object with the "operators" JSON Patch object and some other parameters for replay protection etc. as described in clause 13.2.4.5.1. b) The IPX node uses the temporary JSON object as input into JSON Web Signature (JWS) [45] to create a JWS object, as described in clause 13.2.4.5.2. c) The IPX node appends the JWS object to the received message and sends it to the next hop. The JWS objects generated by the two IPX providers form an auditable chain of modifications that to the receiving SEPP shall apply to the parsed message after verifying that the patches conform to the modification policy. Encryption of IEs shall take place end to end between cSEPP and pSEPP. A SEPP shall not include IEs in the clear that are encrypted elsewhere in the JSON object. A SEPP shall verify that an intermediate IPX has not moved or copied an encrypted IE to a location that would be reflected from the producer NF in an IE without encryption.