Automated Risk Assessment and What-if Analysis of OpenID Connect and OAuth 2.0 Deployments - Data and Applications Security and Privacy XXXV Access content directly
Conference Papers Year : 2021

Automated Risk Assessment and What-if Analysis of OpenID Connect and OAuth 2.0 Deployments

Abstract

The introduction of the Payment Service Directive (PSD2) has accelerated financial services and open banking growth. Deploying appropriate identity management solutions is crucial. This implies the adoption of secure protocols for authentication and authorization, such as OpenID Connect and OAuth 2.0. The PSD2 also requires the application of the General Data Protection Regulation (GDPR) when transactions involve personal data. In turn, the GDPR mandates a Data Protection Impact Assessment (DPIA) for assessing risks posed to data subjects’ rights and freedom. This is a time-consuming and challenging task requiring heterogeneous skills that include the knowledge of best practices for deploying protocols, security mechanisms adopted by available identity management providers, and the capability to perform careful what-if analysis of the possible alternatives. To assist users in this task, we propose a methodology based on the formalization of the what-if analysis as an optimization problem that available tools can solve. The formalization is derived from the OAuth 2.0 and OpenID connects standards, security best practices to mitigate threats, and thorough the evaluation of 19 identity management providers to check their supported features concerning the identified set of features for OAuth/OIDC solutions. We apply the methodology to assist controllers and identify the most appropriate security setup to drive the process of making financial services compliant with the PSD2.
Fichier principal
Vignette du fichier
513274_1_En_19_Chapter.pdf (559.44 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-03677036 , version 1 (24-05-2022)

Licence

Attribution

Identifiers

Cite

Salimeh Dashti, Amir Sharif, Roberto Carbone, Silvio Ranise. Automated Risk Assessment and What-if Analysis of OpenID Connect and OAuth 2.0 Deployments. 35th IFIP Annual Conference on Data and Applications Security and Privacy (DBSec), Jul 2021, Calgary, AB, Canada. pp.325-337, ⟨10.1007/978-3-030-81242-3_19⟩. ⟨hal-03677036⟩
38 View
11 Download

Altmetric

Share

Gmail Facebook X LinkedIn More