NF Service Consumer shall send a request to the NRF to receive an access token to request services of DCCF, to be used for data collection request. NRF after verifying shall generate access token and sends it to the NF Service Consumer.

The NF Service Consumer initiates a NF service request to the DCCF which includes the access_token_nwdaf. The NF Service Consumer shall also generate a Client Credentials Assertion (CCA) token (CCA_NWDAF) as described in the clause 13.3.8 and includes it in the request message in order to authenticate itself towards the NF Service Producers.

The DCCF shall verify if the access_token_nwdaf is valid and executes the service. If the NRF does not support authorization of the source NF (e.g. NWDAF) for data access via the DCCF (e.g. if the NRF is Rel-16), the DCCF authorizes the data access of the NF Service Consumer.

The DCCF determines the NF Service Producer(s) from where the data is to be collected (as specified in clause 6.2.6.3.2 in TS 23.288).

The DCCF sends a Nnrf_AccessToken_Get request to NRF including the information to identify the target NF (NF Service Producer), the source NF (NF Service Consumer e.g. NWDAF), the NF Instance ID of DCCF and the CCA_NWDAF provided by the NF Service Consumer. The nfInstanceId IE attribute in the access token request (Nnrf_AccessToken_Get) indicates the NF instance ID of the DCCF as intermediate NF Service Consumer, whereas the sourceNfInstanceId IE attribute indicates the source NF instance ID (NF Service Consumer e.g., NWDAF).

The NRF shall check whether the DCCF and the NF Service Consumer (e.g. NWDAF) are allowed to access the service provided by the identified NF Service Producers, and the DCCF as the proxy is allowed to request the service from the identified NF Service Producers on behalf the NF Service Consumer. NRF authenticates both DCCF and NWDAF based on one of the SBA methods described in clause 13.3.1.2.

The NRF after successful verification then generates and provides an access token to the DCCF as described in the clause 13.4.1.1.2, with NF Instance ID of the DCCF (subject), and an additional access token claim containing the identity ofthe source NF Service Consumer, in order to authorize both DCCF and NF Service Consumer (e.g.. NWDAF) to consume the services of NF Service Producer.

In the case the NRF is from Rel-16 or earlier, the NRF generates an OAuth2.0 access token with "subject" claim mapped to the intermediate NF Service Consumer, i.e., in this case DCCF, and no additional claim for the source NF Service Consumer (e.g., NWDAF) identity is added.

The NF Service Producer(s) authenticates the NF Service Consumer and ensures that the source NF Service Consumer identity is included as an access token additional claim. The NF Service Producer authenticates and authorizes the DCCF following clauses 13.3.2 and 13.4.1. After authentication and authorization is successful, the NF Service Producer(s) executes the service.

The NF Service Producer(s) shall provide requested data to the DCCF.

The DCCF forwards the received data to the NF Service Consumer(s).

The DCCF sends an access token request to the NRF to request service from MFAF. NRF after verifying sends access_token_dccf to DCCF to consume the services of MFAF.

DCCF shall then send the Nmfaf_3daDataManagement_Configure request to MFAF (as specified in the Clause 6.2.6.3.2 in TS 23.288) along with the access_token_dccf.

The NF Service Producer(s) shall provide requested data to the MFAF.

The MFAF forwards the received data to the data consumer(s).

The NWDAF containing MTLF acting as FL client registers to the NRF with its FL related information, including Vendor ID, supported FL capability (FL client), Analytics ID(s) and Interoperability Indicator per Analytics ID as described in clause 5.2 of TS 23.288.

The NWDAF containing MTLF acting as FL server registers to the NRF with its Vendor ID, FL capability (FL Server).

The NWDAF containing MTLF acting as FL server (NF Service Consumer) sends a discovery request to NRF and receives the available NWDAFs containing MTLF acting as FL client(s) (NF Service Producer) as a response, as specified in clause 6.2C.2.1 of TS 23.288.

The NWDAF containing MTLF acting as FL server (NF Service Consumer) sends an access token request to the NRF as specified in clause 13.4.1. The access token request may contain the Analytics ID for the requested Federated Learning process.

The NRF authorizes the NWDAF containing MTLF acting as FL server (NF Consumer) based upon the information received in Step 1b, and after verifying that the Server NWDAF's Vendor ID is included in the Interoperability Indicator for the requested Analytics ID provided in Step 1a. If the authorization succeeds, NRF generates the access token(s) as specified in clause 13.4.1. The access token claims may include the Analytics ID for the request Federated Learning process.

The NRF sends the access token to the NWDAF containing MTLF acting as FL Server, or rejects the request in case of failed authorization, as described in clause 13.4.1.

The NWDAF containing MTLF acting as FL server sends the service request to the NWDAF(s) containing MTLF acting as FL client with the access token received in Step 5a. along with the Analytics ID information for which the FL process is to be performed, as described in TS 23.288.

The NWDAF containing MTLF acting as FL client (NF Service Producer) verifies the received access token as specified in clause 13.4.1. In case of successful access token verification, the NWDAF containing MTLF acting as FL client sends a success response to the NWDAF containing MTLF acting as FL server, as described in TS 23.288.

After a successful response from the NWDAF(s) containing MTLF acting as FL client, the NWDAF containing MTLF acting as FL server initiates the Federated Learning process as described in TS 23.288.

NF Service producer i.e. NWDAF containing MTLF registers its NF profile in the NRF with ML Model Interoperability indicator per Analytics ID as described in clause 5.2 of TS 23.288. The ML Model Interoperability indicator is a list of NWDAF providers (vendors) that are allowed to retrieve ML models from this NWDAF containing MTLF.

NF Service consumer e.g., NWDAF registers at the NRF including its Vendor ID, if the NF Service consumer is MTLF, the NWDAF containing MTLF also registers its Interoperability indicator per Analytics ID.

The model is stored in encrypted format unless both the AI/ML model producer (NWDAF MTLF) and storage platform (ADRF) are part of the same system and belong to the same vendor and operator security domain. Storage of the model in encrypted format can be required by the trust model established to store and share AI/ML models. The trust model between AI/ML NF producer (NWDAF MTLF), storage platform (ADRF) and NF consumer (e.g., AnLF) is to be determined during the implementation phase among operator and the providers of the different platforms (MTLF, AnLF, ADRF). How the model is encrypted is vendor specific. Key distribution is not specified in this document.

If NWDAF containing MTLF determines to store ML model in ADRF, NWDAF containing MTLF triggers the Nadrf_MLModelManagement_StorageRequest as described in TS 23.288, optionally including an allowed NFc list. The absence of allowed NFc list indicates that only the MTLF which stored the model is allowed to retrieve the model.

ADRF sends the response to NWDAF containing MTLF as described in TS 23.288.

NF Service consumer e.g., NWDAF performs Nnrf_NFDiscovery_Request operation with the requested Analytics ID to select a suitable NF Service Producer e.g., NWDAF containing MTLF. In case of the NF service consumer (e.g. NWDAF containing MTLF) request ML models on behalf of another ML model consumer (e.g., NWDAF containing AnLF), before step 3 the ML model consumer (e.g., NWDAF containing AnLF) obtains a token for the analytics ID from NRF same as step 4 which authorizes the ML model consumer to use model retrieval service provided by the NF service consumer and sends the model retrieval service request to the NF service consumer with the Analytics ID, the obtained token, the Vendor ID and the CCA of the ML model consumer.

NF Service consumer e.g., NWDAF requests an access token from the NRF using the Nnrf_AccessToken_Get request operation. The token request message contains, besides the parameters described in clause 13.4.1.1.2, the Vendor ID of the NF Service consumer and the Analytics ID. If the NF Service consumer is NWDAF containing MTLF, it also includes its Interoperability indicator per Analytics ID in the request. In case of NF service consumer request ML models on behalf of another ML model consumer (e.g., NWDAF containing AnLF), the token request message shall also contain the NF instance ID and Vendor ID of the ML model consumer. The NF Service Consumer also includes the CCA of the ML model consumer that it has received in the service request from the ML model consumer.

NRF checks whether the NF Service consumer is authorized to access the requested service in NWDAF containing MTLF. The NRF verifies that the NF Consumer's Vendor ID is included in the NF Service Producer's interoperability indicator for the Analytics ID. If NF Service consumer is a NWDAF containing MTLF, the NRF also verifies that NF Service consumer's Interoperability indicator is subset of the NF Service Producer's interoperability indicator for the Analytics ID. If the authorization is successful, the NRF grants the token (token1) including the Analytics ID as specified in the clause 13.4.1. In case of NF Service Consumer request ML models on behalf of another ML model consumer, the NRF also verifies that the Vendor ID of ML model consumer is included in the NF Service Producer's interoperability indicator for the Analytics ID and grants the token(token1) also including the NF Instance ID of ML model consumer in the sourceNfinstanceId IE attribute. The NRF also authenticates the ML model consumer based on one of the SBA methods described in clause 13.3.1.2.

NF Service Consumer performs Nnwdaf_MLModelProvision (Analytics ID, Vendor ID and token1) service operation at the NWDAF containing MTLF to retrieve ML models for the Analytics ID. In case of NF Service Consumer request ML models on behalf of another ML model Consumer, the Nnwdaf_MLModelProvision service operation shall also contain the NF instance ID and Vendor ID of the ML model consumer and the CCA of the ML model consumer.

The NF Service Producer authenticates the NF Service Consumer and verifies the access token as specified in the clause 13.4.1.1.2 and ensures that the Analytics ID is included in the access token. If verification is successful, NWDAF containing MTLF determines the ML model to be shared for the requested Analytics ID and stored the NF instance ID of NF Service Consumer as part of allowed NF instance list for the ML model. If the NF Service Consumer request ML models on behalf of the ML model Consumer, the NF Service Producer also authenticates the ML model consumer following clauses 13.3.2 and 13.4.1, and ensures that the ML model consumer is authorized according to the sourceNfinstanceId IE attribute of the access token provided by the NF Service Consumer. The NF Service Producer stores also the NF instance ID of Model Consumer as part of allowed NF instance list for the ML model.

If the determined ML model is stored in ADRF, and if the NF Service Consumer is not yet in the allowed NFc list stored at the ADRF, the NWDAF containing MTLF triggers the update of Nadrf_MLModelManagement_StorageRequest at the ADRF, with NF ID of NWDAF containing MTLF and Model ID, adding the NF Service Consumer to the allowed NFc list. The ADRF verifies that the requesting NWDAF containing MTLF is same as the one that stored the model. Then, ADRF stores the allowed NF instance list for the ML model referenced by the Model ID.

ADRF sends the response to NWDAF containing MTLF which contains Model ID.

NWDAF containing MTLF sends Nnwdaf_MLModelProvision Notify to the NF Service Consumer with Model ID, the address of the determined ML model, which can be either the one stored in NWDAF containing MTLF or in ADRF,or ADRF(set) ID. If the address of the determined ML model is provided, steps 8a to 10 are skipped. If the ADRF(set) ID is provided, the following steps are applied:

NF Service Consumer requests an access token from the NRF to be authorized to retrieve the model stored in ADRF as specified in clause 13.4.1.

NRF verifies that the NF Service consumer e.g., NWDAF is authorized to access the service provided by the ADRF. If verification is successful, NRF grants the token (token2), based on the information provided in ADRF's NF profile.

NF Service consumer e.g., NWDAF requests to retrieve the target model by sending Nadrf_MLModelManagement_Retrieval Request as described in clause 10.3.4 of TS 23.288, including token2.

ADRF authenticates the NF Service Consumer and verifies the access token (token2) as specified in the clause 13.4.1.1.2. ADRF verifies also the NF Service Consumer's NF ID is included in the allowed NF instance list for the ML model and/or is same as the NF ID of the MTLF that stored the model. If verification is successful, ADRF sends Nadrf_MLModelManagement_Retrieval Response to the NF Service Consumer, which contains the address of the stored model in ADRF.

NF Service Consumer retrieves the ML model from NWDAF containing MTLF or ADRF based on the ML model file address and decrypts the model per the vendor's implementation.