This deck will cover identity Management in an API-Driven World, identities in Open Banking, onboarding and authentication in Open Banking, identity propagation, and Aggregators

1. OPEN BANKING AND SECURITY FORUM 2019
Walking the Tightrope
Balancing Security and Convenience in Digital
Banking
Johann Dilantha Nallathamby
Associate Director / Solutions Architect @ WSO2
johann@wso2.com

2. OPEN BANKING AND SECURITY FORUM 2019
Agenda
• Identity Management in an API-Driven World
• Identities in Open Banking
• Onboarding and Authentication in Open Banking
• Identity Propagation
• Aggregators

3. OPEN BANKING AND SECURITY FORUM 2019
Identity Management in an
API-Driven World

4. OPEN BANKING AND SECURITY FORUM 2019
API Management & Integration are key components in
Open Banking

5. OPEN BANKING AND SECURITY FORUM 2019
Identity Management is an inherent part of API
Management & Integration

6. OPEN BANKING AND SECURITY FORUM 2019
Decoupling API Runtime
API Runtime +=

7. OPEN BANKING AND SECURITY FORUM 2019
Consumer Identity Management is like
walking the tightrope.
Balancing convenience along with an awareness of security and privacy
requirements has always been a dilemma for security and risk professionals.
Consumer identity management can significantly detract from consumer
experience if it is overly complicated; however, if it’s not strong, it doesn’t
provide enough security.

8. OPEN BANKING AND SECURITY FORUM 2019
Identities in Open Banking

9. OPEN BANKING AND SECURITY FORUM 2019
API Store
Application
Developer
Application Developers

10. OPEN BANKING AND SECURITY FORUM 2019
Applications (TPPs) & Customers
Mobile App
Website
API Gateway
Core Banking
Customer
Application
Integration
Gateway

11. OPEN BANKING AND SECURITY FORUM 2019
Identity Management for
Application Developers

12. OPEN BANKING AND SECURITY FORUM 2019
Onboarding

13. OPEN BANKING AND SECURITY FORUM 2019
Self-registration

14. OPEN BANKING AND SECURITY FORUM 2019
Federated Identity Management
User Story
Open Banking Implementation
Entity (OBIE) mandates
federated identity management
with its directory for all TPPs.
However the bank wishes to
manage a profile-lite for its TPP
users for offline communication
purposes.Solution
1. Federated Login (mandatory)
2. Just-In-Time (JIT) account provisioning (optional)
3. Just-In-Time password provisioning (optional)
4. Ask required attributes (optional)

15. OPEN BANKING AND SECURITY FORUM 2019
Authentication

16. OPEN BANKING AND SECURITY FORUM 2019
Multi-factor Authentication

17. OPEN BANKING AND SECURITY FORUM 2019
Federated Login
Sending back linked identifier
5

18. OPEN BANKING AND SECURITY FORUM 2019
Identity Management for
Applications

19. OPEN BANKING AND SECURITY FORUM 2019
Onboarding

20. OPEN BANKING AND SECURITY FORUM 2019
API Store

21. OPEN BANKING AND SECURITY FORUM 2019
Authentication

22. OPEN BANKING AND SECURITY FORUM 2019
Delegated Access Control
OAuth2 has become the defacto standard for API Security for
consumer-facing APIs in an Open API Economy due its simplicity,
developer friendliness and suitability across heterogenous technology
platforms

23. OPEN BANKING AND SECURITY FORUM 2019
Identity Management Banking
Customers

24. OPEN BANKING AND SECURITY FORUM 2019
Onboarding

25. OPEN BANKING AND SECURITY FORUM 2019
Directory Integration
SOAPRest

26. OPEN BANKING AND SECURITY FORUM 2019
Federated Login
User Story
The bank has an existing
in-house identity provider
where the banks customer
accounts are stored. The bank
wishes to federated logins to
the in-house identity provider
rather than duplicating the
account information and
creating “identity silos”.
5
1 2
3
4
Sending back federated ID

27. OPEN BANKING AND SECURITY FORUM 2019
Identity Proofing

28. OPEN BANKING AND SECURITY FORUM 2019
Authentication

29. OPEN BANKING AND SECURITY FORUM 2019
Brokered Authentication
All consumer-facing applications in an Open API Economy are
predominantly OpenID Connect based due to its relevance to
OAuth2.

30. OPEN BANKING AND SECURITY FORUM 2019
Strong Customer Authentication (SCA) Flows
1. Redirect
2. Decoupled
3. Embedded
4. App2App

31. OPEN BANKING AND SECURITY FORUM 2019
Adaptive Authentication
Dynamic, Context-aware, Multi-factor Authentication

32. OPEN BANKING AND SECURITY FORUM 2019
Example: Level of Assurance (LoA)
View balance Fund transfer

33. OPEN BANKING AND SECURITY FORUM 2019
Example: Region Based Step-up Authentication

34. OPEN BANKING AND SECURITY FORUM 2019
Example: Device based Step-up Authentication
Trusted / Untrusted / New

35. OPEN BANKING AND SECURITY FORUM 2019
Example: Risk based Step-up Authentication
Examples
1. Login patterns (time of the day, day of the week, etc.)
2. Last successful login time
3. Typing speed
4. Consecutive incorrect password attempts
Get Risk
Score

36. OPEN BANKING AND SECURITY FORUM 2019
Analyzing Login Events in a Time Window

37. OPEN BANKING AND SECURITY FORUM 2019
Steam Processor Editor

38. OPEN BANKING AND SECURITY FORUM 2019
Steam Processor Designer

39. OPEN BANKING AND SECURITY FORUM 2019
Identity Propagation

40. OPEN BANKING AND SECURITY FORUM 2019
Flowing Claims to Downstream Resources
Mobile App
Website
API Gateway
Core Banking
Identity Propagation
Integration
Gateway

41. OPEN BANKING AND SECURITY FORUM 2019
Motivation
1. Positive identification of the customer and application
2. Control access to fine-grained backend services based on
entitlements of the customer and application
3. Filter data in the API provider’s response according to data
entitlements of customer and application
4. Audit and keep records of data access

42. OPEN BANKING AND SECURITY FORUM 2019
Trusted Subsystem
• Most popular security pattern to propagate identities
• More information:
https://medium.com/@johann_nallathamby/identity-propagation-in-a-gateway-architecture-e898b9eec5ca

43. OPEN BANKING AND SECURITY FORUM 2019
Trusted Subsystem Security Patterns
Mobile App
Website
API Gateway
Core Banking
Integration
Gateway
Certificate
Authority
<trust>
• Trusted Subsystem Generated Identity Tokens
<JWT> <JWT>

44. OPEN BANKING AND SECURITY FORUM 2019
Trusted Subsystem Security Patterns
Mobile App
Website
API Gateway
Core Banking
Integration
Gateway
<trust>
• 3rd Party Generated Identity Tokens
<OAuth2 Token
Introspection>
<JWT> <JWT>

45. OPEN BANKING AND SECURITY FORUM 2019
Aggregators

46. OPEN BANKING AND SECURITY FORUM 2019
Dynamic routing to Bank API Providers
Mobile App
Website
API Gateway
Bank B
Integration
Gateway
Bank A
Bank A IdP
Bank B IdP
1 2
3 4
5
Self-contained access token
<OpenID
Connect>
<identity federation>
<API call> <internal
service
call>
<backend call>
{“random”:“abcd…1234”,“realm”:“Bank-A”}

47. OPEN BANKING AND SECURITY FORUM 2019
THANK YOU
wso2.com