The document is a presentation by Junichi Okamura from PayPal on data security through delegation. Okamura defines delegation as letting experts who have core values provide services instead of general providers. He gives examples of how delegation in account handling and payments can improve security by focusing on core expertise rather than spreading responsibilities. Okamura discusses successful cases of delegation like OAuth and payment tokenization, and areas that have not been successfully delegated like physical identity details. He encourages engineers to provide ideas to privacy experts on improving security design through delegation principles.

1. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
1
Yet Another Security Talk
JUNICHI OKAMURA @ Rakuten Technology Conference 2015
Nov. 21 2015

2. Who am I?
Junichi Okamura
PayPal Integration Manager/
Evangelist
Scala/Ruby/Node.js/Python/../Mobile/../ppt
ROCK/BEER/WINE/JOJO/
API (& meetup) lover
@benzookapi
jokamura@paypal.com
2

3. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
What I want to talk about today
3
Data Security
with the keyword, “Delegation”

4. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
What is “Delegation”?
4
By Wikipedia

5. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
Today’s definition by me
5
Let an expert who has core value
provide it instead of me
By Wikipedia

6. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
In case of service
6
Printer (delegator) = Service provider
RealPrinter (delegated) = Feature expert
Provider Expert
Printer

7. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
Drill down in real service
7
Provider Expert
Chat
Provider Expert
Account
Provider Expert
Payment

8. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
Actual situation
8
Provider + Expert
Chat
Provider Expert
Account
Provider Expert
Payment

9. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
Ideal “Delegation”
9
Focus on your core value as expert,
with other ones delegated

10. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
Take a look at security features
10
Provider + Expert
Chat
Provider Expert
Account
Provider Expert
Payment

11. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
Case 1: Account handling in delegation
11
Provider
Expert
Account
Provider
Account
Provider
Account
ID
Password
Token
Token
Token
Authorize
Authorize
Authorize
Security Core
OAuth API

12. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
If not in delegation…
12
Provider + Expert
Account
Provider + Expert
Account
Provider + Expert
Account
Security Core
ID
Password
ID
Password
ID
Password

13. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
Case 2: Payment handling in delegation
13
Provider
Expert
Payment
Provider
Payment
Provider
Payment
Credit Card
ID
ID
ID
Charge
Carge
Charge
Security Core
Vault API

14. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
If not in delegation…
14
Provider + Expert
Payment
Provider + Expert
Payment
Provider + Expert
Payment
Security Core
Credit Card
Credit Card
Credit Card

15. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
Under delegation
15
Users:
You only have to give your key data to
reliable expert
Providers:
You can focus on your core data as
reliable expert

16. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
That is…
16
By Wikipedia

17. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
Out of delegation
17
Users:
You have to give your key data to each
unreliable expert
Providers:
You need care about not core data as
unreliable expert

18. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
That is…
18
By Wikipedia

19. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
What is successful delegation cases?
19
Account:
OAuth and Open ID,
Payment:
Vault andTokenization,
Encrypt:
SSL and certification,
…

20. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
What is not successful?
20
Identification:
Physical address and health,
Banking:
Account number and pass phrase,
Storage:
No vender locked and user chosen,
…

21. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
Why not successful?
21
These are difficult to be standardized and
strongly related to business and
have no open/general frameworks
BUT NOT
IMPOSSBILE!
WE CAN TRY!

22. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
22
So it is 2015 in JP,

23. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
23
Government starts
“MY NUMBER”
(Social Security and Tax Number System)

24. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
24
They are going to be a privacy
expert

25. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
25
Do you have a good idea about
security design
as a software engineer?

26. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
26
How do you think of
your data security?

27. © 2015 PayPal Inc. All rights reserved. Confidential and proprietary.
27
Thank you
JUNICHI OKAMURA @ Rakuten Technology Conference 2015
Nov. 21 2015