PSD2 – Universal login using OpenId / SSO for web interfaces: Digitalization ensures market share

Strong User authentication

Banks have long used user authentication (login) and legitimacy check (transaction-related authorization with TANs) to identify customers. Especially with legitimization, new methods of two-factor authentication are being developed, which should increase security. These include photo-TAN, TAN generator devices, SMS-based TAN and now also apps that provide TANs. The idea of making these already implemented procedures usable, also in the course of PSD2 seems to be obvious from the banks’ point of view.

 

As a matter of fact, this assumption is valid only at first sight, because:

There is a general consensus that two-factor authentication is to be applied when it comes to user identification if there are uncertainties about the identity of the user.

The secure and unambiguous customer identification thus becomes the key to success in the competition. In any case, it is high time than ever for a bank to think about whether or not to in fact take up on themselves the development of a strong customer authentication and management of customer identities and moreover if they can afford it. Ultimately, such a solution must meet numerous requirements to be competitive.

Fraud detection

In order to reliably prevent fraud, a multi-level security architecture is required:
1. The user identity is securely determined.
2. In the event of uncertainty in the user identity, the identity of the person is controlled by another factor, for example by biometric procedures.
3. Lastly, in the case of a bank, the persons and accounts should be subjected to profiling in order to detect inconsistencies in the customer’s transaction behavior. (Figure 1)

Requirements

With digitalization, processes and systems are changing, which is why new requirements are emerging for user authentication and authorization. This includes technical and IT requirements:

Icing on the cake: to become an OpenId-Provider

 

If you want to secure long-term market share, you should not only care for your existing customers, but also deal intensively with prospective customers. The possibility to identify potential customers through their login opens up this circle of interested parties: Credit institutions, which enable users to log in to other companies, not only simplify new customer acquisition, but also opens up a wide range of services and offers, the management of which you hold in your own hands.

Many ID providers are still insignificant today. A company that actively uses Customer Identity Management and wants to become a successful OpenId provider must choose the most important OpenId providers for its business. Only so is it possible to reach a large number of people in the target group. At the same time, the presentation of more than four OpenId providers proves to be rather confusing for the users. Social-login providers are currently most successful, especially Facebook and Google. The reasons for this are understandable: Social login providers offer the identity of the user, which usually includes strong authentication, addresses, his interests, professional experience, employer, hobbies and even access to the user’s contacts. In addition, they can also share activities on the social media platform, such as ratings, comments, and recommendations. The questionnaire at the end of the text summarizes the key points a bank should work out when it wants to become an OpenId provider.

Technical implementation possibilities

 

A user authentication can be implemented by a bank in at least three ways. For example, it is possible to use a stand-alone development using some OpenSource frameworks. Alternatively, the development and adaptation can be used on the basis of an existing authentication and authorization service (for example, Keycloak). Finally, a professional customer identity management system can also be used (eg cidaas, janrain, gigya, auth0).

Development and adaptation based on existing services

If a bank implements a virtualization platform in the wake of PSD2, as part of the Platform as a service implementations for the management of user accounts and authentication are required. Examples for this are CloudFoundry (UserAccount and Authentication (UAA) servers) and also OpenShift (SSO Server (Keycloak)). These services offer a functional scope that is quite consistent in itself. The main focus is on the security and OAuth2 flows, whereby two-factor authentication is also party possible. As with any packaging of a platform, these services technically complete these virtualization platforms.

For an adequate customer identity management, further steps and functions are necessary, which must be added further during the development:

1. Reliable end-device detection
2. Location-based recording during registration, login
3. Performing Address Checks at the time of Customer Registration
4. Management of login / registration UIs
5. Continuous profiling of user actions to propose two-factor authentication and get to Know your customer
6. Option to add events depending on the user behavior: Business software then applies Know Your Customer, e.g. to respond individually to particularly active users or users who have not used a channel for a long time
7. Two-factor authentication must be newly added as per needs, such as bio-metric procedures
8. Additional customizations, e.g. Custom Login Provider or Communication Templates for User Self Services

The development and adaptation effort for the use at a bank is therefore considerable. Virtualization platforms are equipped with SSO services, which are required to secure platform administration. However, only the security and OAuth2 management part of a Customer Identity Management is covered. However, if you want to become a serious competitor, you have to measure up with solutions such as those offered by Google, Facebook, Linkedin or Amazon on their portals and apps.

Use of professional customer identity management systems

A professional customer identity management provides nearly all the functions necessary for secure and reliable user identification. In addition, dashboards and reports provide very good overview into user behavior. The advantages from the point of view of a credit institution are obvious:

1. In real-time, the business software is made aware of different events and can thus address users (customers) correspondingly.
2. Various two-factor methods are selectable, in tune with the personal needs and the environment of the user
3. Standards such as OAuth2 and OpenId Connect enable the bank to act as an OpenId provider, should it be useful from a business policy perspective
4. User profiles, user self-services included
5. Multiple identities can be linked, such as Google with LinkedIn and the bank’s user account
6. Numerous SDKs and convenient admin dashboard allow for an easy integration of customer identity solutions into the bank IT
7. The application extends to/ranges in various professional customer identity management products from the virtual online world to the real world (offline) in the branch or to the intelligent device, which is used in the self-service environment.

There are many reasons that stand for a professional Customer Identity Management, and very few against. One challenge is, for example, to process customer data according to EU law. This requirement is not met by all solutions. There are, however, providers who are abide by the EU law per se, or which follow the ordinances and thereby fulfill this requirement.

Data security is honored by the customer!

Banks, which can uniquely identify customers and prospective customers on all portals and apps through a one-time login, are able to securely track their activities and create an outstanding user experience. With PSD2, additional access channels are created to the bank where users are constantly connected to the bank. With strong, reliable authentication, TAN-based legitimation audits will soon be a thing of the past because, in conjunction with downstream fraud detection systems, customer behavior is well validated and fraud has no chance. Recognizing customers also means leveraging collected insights into sales and service in order to delight customers through a hyper-personalized, and thus unique, user experience.

Is the OpenID provider model suitable for your bank at all? The questionnaire: