A system comprising: an authorization mechanism that performs a discovery authorization procedure for proximity services, ProSe, the authorization mechanism comprising: a validation controller configured to receive information for a discovery request sent by an application in User Equipment (120, 121, 620), wherein the information for the discovery request includes an application identifier (811, 812, 813) for the application; and a rules engine configured to determine validation rules for the discovery authorization procedure; the validation controller is configured to send a security challenge message to the User Equipment (120, 121, 620) requesting challenge values for security parameters that are mapped to the application identifier, to receive a security answer message from the User Equipment (120, 121, 620) in response to the security challenge message, to extract the challenge values for the security parameters from the security answer message as provided by the User Equipment (120, 121, 620), and to determine whether the application is authorized for direct discovery using the application identifier (811, 812, 813) based on the challenge values for the security parameters and the validation rules; the validation controller is configured to generate a validation indicator to authorize the discovery request sent by the application, if the application is authorized for direct discovery using the application identifier (811, 812, 813), wherein the validation controller is further configured to output the validation indicator to a proximity service function (130, 612), wherein the validation indicator indicates whether the proximity service function (130, 612) is to allow the User Equipment (120, 121, 620) or application to perform direct discovery using the application identifier (811, 812, 813). a validation controller configured to receive information for a discovery request sent by an application in User Equipment (120, 121, 620), wherein the information for the discovery request includes an application identifier (811, 812, 813) for the application; and a rules engine configured to determine validation rules for the discovery authorization procedure; the validation controller is configured to send a security challenge message to the User Equipment (120, 121, 620) requesting challenge values for security parameters that are mapped to the application identifier, to receive a security answer message from the User Equipment (120, 121, 620) in response to the security challenge message, to extract the challenge values for the security parameters from the security answer message as provided by the User Equipment (120, 121, 620), and to determine whether the application is authorized for direct discovery using the application identifier (811, 812, 813) based on the challenge values for the security parameters and the validation rules; the validation controller is configured to generate a validation indicator to authorize the discovery request sent by the application, if the application is authorized for direct discovery using the application identifier (811, 812, 813), wherein the validation controller is further configured to output the validation indicator to a proximity service function (130, 612), wherein the validation indicator indicates whether the proximity service function (130, 612) is to allow the User Equipment (120, 121, 620) or application to perform direct discovery using the application identifier (811, 812, 813).