ePrints

Security analysis of the open banking account and transaction API protocol

Lookup NU author(s): Dr Paolo Modesti, Dr Leo Freitas

Downloads

• Published version [.pdf]

Licence

This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License (CC BY-NC-ND).

Abstract

© 2025. The Second Payment Services Directive (PSD2) of the European Union aims to create a consumer-friendly financial market by mandating secure and standardised data sharing between banking operators and third parties. Consequently, EU countries and the United Kingdom have adopted Open Banking, a standardised data-sharing API. This paper presents a formal modelling and security analysis of the UK Open Banking Standard's APIs, with a specific focus on the Account and Transaction API protocol. Our methodology employs the extended Alice and Bob notation (AnBx) to create a formal model of the protocol, which is then verified using the OFMC symbolic model checker and the ProVerif cryptographic protocol verifier. We extend previous work by enabling verification for unlimited sessions with a strongly typed model. Additionally, we integrate our formal analysis with practical security testing of some necessary conditions to demonstrate verified security-goals in the NatWest Open Banking sandbox, evaluating mechanisms such as authorisation and authentication procedures.

Publication metadata

Author(s): Modesti P, Freitas L, Shotomiwa Q, Almehrej A

Publication type: Article

Publication status: Published

Journal: Cyber Security and Applications

Year: 2025

Volume: 3

Print publication date: 01/12/2025

Online publication date: 22/04/2025

Acceptance date: 19/04/2025

Date deposited: 24/06/2025

ISSN (electronic): 2772-9184

Publisher: KeAi Communications Co.

URL: https://doi.org/10.1016/j.csa.2025.100097

DOI: 10.1016/j.csa.2025.100097

Altmetrics

Funding

Share