AUTHENTICATION & AUTHORIZATION IN

DIGITAL FINANCIAL TRANSACTIONS

Seamless Consumer Experience from Security and Privacy Standpoint

Supply chain of Transac�on Processing and FinTechWith more players joining the digital payments landscape bringing specialized capabili�es, the supply chain of transac�on processing also is increasingly becoming enriched. Technologies like RPA, AI, DLT, NLP, AR/VR & cloud compu�ng technologies are enabling innova�ons. Fintech players are thus now in a posi�on to offer niche capabili�es such as digital ID provisioning, device integra�on, open interfaces, context provisioning, account aggrega�on, document management, process op�miza�on & automa�on, customer experience management to name a few. Regulators have recognized the role of Fintech providers in ini�a�ng, enriching and processing digital transac�ons.

Study Objec�ves

· Capture the disrup�ons shaping the Digital Payment landscape

· Map transac�on flows prevalent in India

· Assess trends, innova�ons and capabili�es impac�ng payment

processing

· Examine the current authen�ca�on and authoriza�on paradigm

· Future modelling of authen�ca�on and authoriza�on

Digi�za�on of Transac�on Processing: Fintech

RPA ML/AI Big DataEnabling

Technologies

Mobility DLT Cloud Compu�ng

AR/VR Chat Bot | NLP Biometrics Presence & Geospa�al

Ini�a�on EnrichmentData Management & Aggrega�on

Processing

Digital ID Provisioning

Customer Onboarding

Transac�ons

Device Integra�on

Process Op�miza�on &

Automa�on

Account Aggrega�on

Context Provisioning

Experience Management

Sales & Service Interac�ons

Regula�on & Compliance

Management

Segmenta�on & Targe�ng

Advisory & Assistance

Document Management

Interfaces & APIs

FinTech Capabili�es

En��es involved in Transac�on Processing

Financial Ins�tu�ons Devices & Pla�ormsPayment Processors

Banks, NBFCs, Insurance, Exchanges, Mutual Funds,

etc.

Credit Card Providers, ATM Switches, Wallet, PPIs,

Gateways, etc.

Device Manufacturers, Internet & SM Pla�orms, U�lity Apps,

etc.

Across the globe and in India, efforts are

on to promote rapid digi�za�on of

payment transac�ons. The increase in

volumes and complexity of transac�ons

are bringing tectonic shi�s in the digital

payments landscape. Buoyed by the

ability to process large amount of

complex data, the whole supply chain of

financial transac�on processing has

become more intricate.

This study endeavours to capture the

innova�ons that are taking place in the

area of authen�ca�on and authoriza�on-

the two key pillars of secured digital

payments and transac�ons.

Background

Regulated En��es

Technology & Business Services

1 2 3

4

Authen�ca�on: Future Modelling

Authen�ca�on

Tradi�onal passwords, single/limited knowledge factors and centraliza�on of authen�ca�on authority have

failed to achieve security, scalability, and innova�on expecta�ons in the digi�za�on of transac�on processing.

The present authen�ca�on mechanisms rely mostly on explicit inputs from users such as one-�me passwords

(OTP)/email verifica�ons, knowledge ques�ons and public key tokens. However, these are today proving

insufficient to protect iden�ty the�s in an ever evolving and sophis�cated threat landscape.

Future authen�ca�on mechanisms will essen�ally be secure device led, biometric enabled, data driven-context

aware, risk based, mul� factor authen�ca�on with low fric�on and high flexibility. Along with explicit factors,

future authen�ca�on mechanisms will also consider other implicit func�onali�es of device, user behaviour, risk

as key factors of authen�ca�on.

Regulatory

Common Devices to Easily

Authen�cate Online Services

Client to Authen�cator Protocol (CTAP)

3-D Secure protocol for

online payment

Auth Flows for Web,

App, Mobile & Devices

Strong Customer Authen�ca�on (SCA)

Payment Service Direc�ve (PSD2 )

Digital ID Management

Paths Devices Access Paths Services

Creden�alsCurated

rd3 Party

Authen�ca�on

Knowledge

Mobile Push

Message Exchange

So�ware Applica�ons

Hardware Mobile

Contextual Data

Enrichment Data

Risk/ A�ack/ Fraud Signals

User A�ributes, Device Iden�ty, Feeds, etc.

Loca�on, Behaviour, Social, Transac�onal

Risk Levels & Signals, A�ack Signals & Fraud

Modus Operandi

Fric�onless User Experience Accountable Non-repudia�on Trusted Privacy Fast Flexible Security

Security Element in Mobile

Modern Cryptography

API-based: SSO OAuth & OpenID Connect

Machine Learning & AI

NFC & Bluetooth Interfaces

Biometrics: Mul�-Model, Fast & Accurate

Requirements Scalable

Technical Standards & Specifica�ons

Trusted Pla�orm Module [TPM]

Cloud Architecture

Email

Token Biometrics

PRESENT

Centralized

PIN/ Password

Single Factor

Out-of-Band

Knowledge-based

Public Key TokensBiometrics

Explicit OTP

Closed Network

W3C Web Auth Specifica�on Oauth 2.0

EMVCoVersion 2.0

NIST SP 63-B

Data

Tech

no

logy

FUTURE

Mul� Factor Risk Based Auth & Life CycleExternal Auth

FIDO Alliance

Device Token

Na�ve Auth (UAF)

ndUniversal 2 Factor (U2F)

SMS Voice

Privacy Preserving Trust Score Decentralized

Self-Sovereign Id

Auth-aware Apps

A�ack/Fraud Signals Mul�ple Factor

Phone-as-Auth-TokenBiometrics: Mul�-model

AI/ML

Cloud Hardware Capabili�es BYOI

Risk-based Implicit Behavioural

>>

>>

>>

Authoriza�on

The marketplace of the transac�on processing is also changing significantly with an ever increasing number of payment

methods, and rising volume of transac�ons. Instruments that facilitate, execute, exchange messages and informa�on, need

�mely authoriza�on. While user authoriza�on is key in transac�on processing, applica�on and machine authoriza�ons are

cri�cal for keeping the pace of transac�on processing. The current authoriza�on mechanisms pose some severe challenges.

Future models of authoriza�on must address challenges of complexity, role and access varia�ons, granularity, and

dynamicity. Authoriza�on processes need to be fine-grained, context driven, run�me independent of third party, and ensure

privacy and security.

Authoriza�on: Future Modelling

TAKEAWAYS

Regulatory

Authoriza�on Cer�ficate

Framework for Authen�ca�on &

Authoriza�on

SAML 2.0

Asserta�on Protocol

SSO for Enterprise

Europe [GDPR]California (CCPA)

FedRAMP AuIndia [PDPB- Dra�]

Consent & Preference Mgmt

WS-Policy

Specifica�on Adver�se Policy

& Policy Requirements

Instruments Paths Resources Services

Creden�alsPolicies Controls

Authoriza�on

Objects Profile Role

Transac�on

Iden�ty Provider

So�ware Applica�ons

Gateways Devices

Contextual Data

Enrichment Data

Risk/ A�ack/ Fraud Signals

User A�ributes, Device Iden�ty,

Feeds, etc.

Loca�on, Behaviour, Social, Transac�onal,

Payment Conversa�on

Risk Levels & Signals, A�ack Signals & Fraud

Modus Operandi

Fric�onless Op�mized Accountable Non-repudia�on Trusted Privacy Fast Flexible Security

Orchestra�on: Process & Policy

Automa�on: Workflow & RPA

API Gateway Technologies

Service Mesh Technologies

Machine Learning & AI

Webservices Federa�on

Oauth 2.0

XML Data Formats

Requirements

Secure Delegated

Access Tokens by ID provider

Scalable

Technical Standards & Specifica�ons

Service Contract, Abstrac�on, Reusability, Statelessness,

Discoverability, Composability & Interoperability

Policy Driven: CICS, RACF, WAM

Consent & Preference Management

Relying Party

Onboarding/ Registra�on

A�ributes Permissions

Simplified

Tedious Administra�on

Policy InconsistencyFine-grained Policies

Adap�ve Decisions

Process Orchestra�on

Contextual Decisions

Automa�on

Run-�me Authoriza�on

Cloud Architected & Hosted

Iden�ty Governance

Iden�ty Governance

Dynamic Switching/ Rou�ng

Privacy Preserving

Siloed

Configura�on/ Rule Driven

Inadequate Policy A�ributes

PRESENT

SOA X.509

Data

AP

IsIn

terf

aces

ServicesM

icro-services

Tech

no

logy

FUTURE

rdDATA SECURITY COUNCIL OF INDIA, NASSCOM CAMPUS, 3 Floor, Plot. No. 7-10, Sector 126, Noida, UP - 201303

P: +91-120-4990253 | E: info@dsci.in | W: www.dsci.in

The market offers opportunity for a broader set of players to par�cipate in financial transac�on processing.

Establishing accountability and ensuring non-repudia�on will be key requirements of regulated transac�on processing.

Technological evolu�on and emergence of niche capabili�es has altered the authen�ca�on paradigm.

The future modelling of authen�ca�on and authoriza�on systems shown above (diagram) is meant to help enterprises build a robust authen�ca�on and authoriza�on strategy.

Data availability is cri�cal for leveraging risk based approach for authen�ca�on and authoriza�on.

>>

>>

>>