Security Analysis of the Open Banking Account and Transaction API Protocol
This addresses security risks in financial data sharing under PSD2 regulations, but it is incremental as it builds on prior work with extended verification.
The paper tackled the security of the UK Open Banking Standard's Account and Transaction API protocol by performing formal modeling and verification, identifying vulnerabilities in mechanisms like authorization and authentication in the NatWest sandbox.
The Second Payment Services Directive (PSD2) of the European Union aims to create a consumer-friendly financial market by mandating secure and standardised data sharing between banking operators and third parties. Consequently, EU countries and the United Kingdom have adopted Open Banking, a standardised data-sharing API. This paper presents a formal modelling and security analysis of the UK Open Banking Standard's APIs, with a specific focus on the Account and Transaction API protocol. Our methodology employs the extended Alice and Bob notation (AnBx) to create a formal model of the protocol, which is then verified using the OFMC symbolic model checker and the Proverif cryptographic protocol verifier. We extend previous work by enabling verification for unlimited sessions with a strongly typed model. Additionally, we integrate our formal analysis with practical security testing of some necessary conditions to demonstrate verified security-goals in the NatWest Open Banking sandbox, evaluating mechanisms such as authorisation and authentication procedures.