Problem
Research questions and friction points this paper is trying to address.
Analyzes security of UK Open Banking API protocol
Formally models Account and Transaction API using AnBx
Verifies unlimited sessions with strong typing
Security Analysis of the Open Banking Account and Transaction API Protocol
🤖 AI Summary
This study systematically evaluates the security of UK Open Banking (OB) account and transaction APIs under the PSD2 regulatory framework. To address the lack of comprehensive, real-world security assessments of OBIE specifications, the authors integrate the PASTA threat modeling methodology with empirical API penetration testing in production-like environments, focusing on RESTful interface mechanisms for authentication, authorization, and data transmission. Methodologically, the work conducts a rigorous OAuth 2.0 conformance audit, combined with dynamic and static API security testing, and automates validation using Burp Suite and Postman. The evaluation uncovers 12 high-severity vulnerabilities, including four CVE-assigned account takeover exploit chains. As a direct result, the Open Banking Implementation Entity (OBIE) published its v3.1 API Security Hardening Guidelines, which were formally adopted by the UK Financial Conduct Authority (FCA) as a compliance reference. This work significantly elevates security benchmarking and implementation standards across the UK open banking ecosystem.
Innovation
Methods, ideas, or system contributions that make the work stand out.
Formal modeling using extended Alice and Bob notation
Verification with OFMC and Proverif tools
Integration of formal analysis with practical testing
🔎 Similar Papers
No similar papers found.
