6/24 Securing your API beyond basic OAuth by Sender Constrained Tokens... | Identiverse 2018

Full title: Securing your API beyond basic OAuth by Sender Constrained Tokens and JWT Authorization Request

Presenter: Nat Sakimura, Research Fellow at Nomura Research Institute, Ltd.

In the mobile-first world that we live, OAuth 2.0 as in RFC6749 and RFC6750 is the de-facto method for protecting your APIs. It is very simple to use while it is a vast improvement compared to API Key or shared password approach as far as security properties are concerned. However, it has given up some security properties as well. This session explains where the weakness of the basic OAuth exists by considering the source, destination, and message authentication as well as considering the recommendation based on the formal security analysis of ISO/IEC 9798 Standard for Entity Authentication by Basin, Cremers, and Meler. Then, explains how it can be solved using JWT Authorization Request and Sender Constrained Tokens based on the Financial API Security profile developed by OpenID Foundation’s FAPI WG and deployed in UK banks and other financial institutions elsewhere in the world. Such profile should be very useful not only for financial transactions but for other higher risk APIs.

Save the date: Join us June 25-28 in Washington D.C, 2019!