Paper accepted at DBSec 2021

Published: Jun 4, 2021
Tags:papers
The following paper has been accepted at the 35th Annual IFIP WG 11.3 Conference on Data and Applications Security and Privacy (DBSec 2021):
  • Title: Automated Risk Assessment and What-if Analysis of OpenID Connect and OAuth 2.0 Deployments
  • Authors: Salimeh Dashti, Amir Sharif, Roberto Carbone, Silvio Ranise
  • Abstract: The introduction of the Payment Service Directive (PSD2) has accelerated financial services and open banking growth. Deploying appropriate identity management solutions is crucial. This implies the adoption of secure protocols for authentication and authorization, such as OpenID Connect and OAuth 2.0. The PSD2 also requires the application of the General Data Protection Regulation (GDPR) when transactions involve personal data. In turn, the GDPR mandates a Data Protection Impact Assessment (DPIA) for assessing risks posed to data subjects’ rights and freedom. This is a time-consuming and challenging task requiring heterogeneous skills that include the knowledge of best practices for deploying protocols, security mechanisms adopted by available identity management providers, and the capability to perform careful what-if analysis of the possible alternatives. To assist users in this task, we propose a methodology based on the formalization of the what-if analysis as an optimization problem that available tools can solve. The formalization is derived from the OAuth 2.0 and OpenID connects standards, security best practices to mitigate threats, and thorough the evaluation of 19 identity management providers to check their supported features concerning the identified set of features for OAuth/OIDC solutions. We apply the methodology to assist controllers and identify the most appropriate security setup to drive the process of making financial services compliant with the PSD2.

About the conference

  • Name: 35th Annual IFIP WG 11.3 Conference on Data and Applications Security and Privacy (DBSec 2021)
  • Date: from July 19, 2021 to July 20, 2021
  • Location: Virtual Event
  • Website: https://wpsites.ucalgary.ca/dbsec2021/

Involved People

Dashti Salimeh

Salimeh Dashti

Website

Sharif Amir

Amir Sharif

Website

Carbone Roberto

Roberto Carbone

Website

Ranise Silvio

Silvio Ranise

Website