PSD2 Gateway Solution Overview

Transcription

1 1 PSD2 Gateway PSD2 Gateway Solution Overview 4 th September 2017 PURPOSE OF THE DOCUMENT PSD2 Gateway is a small team of Fintech experts, developing a standard API solution to fulfil the PSD2 regulation requirements. Our aim is to provide an efficient tool for European Commercial Banks to get prepared for the brand new challenges of PSD2. This document contains a high level scope and technical overview of our solution for a PSD2 standard API set. OVERVIEW According to the European Union regulation the finance sector has to implement a new standard service, which can improve the customer activity and opens the gate for various brand new financial solutions. Most parts of the standard have not been clarified yet, but there are some very clear expectations. In order to simplify the main topics the following can be determined: 1. Already authenticated customer has to be accepted by other partners. The customers are authenticated by the bank (or other way eid), all required documents are clarified and collected. 2. Customer s data has to be shared (account number, transaction history, etc.) 3. The bank s payment systems has to be opened for 3rd party systems. GOALS Authentication and Authorization Customer administration PSD2 Gateway provides a solution, which can authenticate and authorize the customers by the following services: 1. Manage which customer can use PSD2 services, 2. Manage which services can be used by the customer, 3. Manage authorizations what the user can act with.

2 The solution is integrated to the CBS (Core Banking System), so the customers can be easily onborded and all relevant changes are automatically reflected on the PSD2 Gateway system. Clients administration Due to security reasons the bank must be aware which 3rd party applications will access the customer s data or other resources managed by the bank. In order to fulfil this requirement PSD2 Gateway provides an opportunity to manage the 3rd party access, the available resources and those customers who have access to that 3rd party application. Customer Customers are able to manage their accepted 3rd party applications and the related permissions (e.g. revoke an approval) and overview their application permissions. PSD2 Gateway also supports customers to enquire their historical logs (including information about the 3 rd party applications used by the customer) Resource management The default PSD2 Gateway configuration covers the following resources: 1. Accounts 2. Cards 3. Term Deposits 4. Loans 5. Standing orders. Payment gateway 1. Foreign payment a. SWIFT b. SEPA 2. Internal payment 3. Domestic payment 4. Mobile top up For security reasons all objects (account, card, etc.) has a uuid which is only valid as long as the customer session is alive. PSD2 Gateway generates those unique id s every time when the customers log in the system. Resources are identified by the temporary uuid, which makes sure sensitive data will not be used in the communication when PSD2 Gateway receives a payment request or any information request.

3 Customer information service The business requirements are not fully clarified yet. Some proposals are already exist, but neither of them are accepted yet. Audit logging All PSD2 Gateway business processes are logged and the administrators can track the system events. In PSD2 Gateway all sensitive information (credit card number, account number) are masked in audit log. SPECIFICATIONS PSD2 Gateway architecture is planned to be vertically and horizontally scalable. All modules are a microservices which are able to run independently with multiple instances. The base architecture is API gateway (ZUUL) and service discovery with load balancer (EUREKA/RIBBON). The authorization and authentication are based on OAUTH2 protocol. Within the project scope PSD2 Gateway team developed 2FA authentication extension for OAUTH2. This solution makes PSD2 Gateway very flexible and customizable. The PSD2 Gateway implementation is based on java spring. The solution supports most of the CBS integrations. By default the JMS, SOAP and REST are the supported currently. Given that these implementation solutions are based on spring-integration, any custom integration can be implemented. In order to reach the maximum performance and independency of RDBS all database queries are implemented with MyBatis. The solution supports the following database servers currently: Oracle DB2 MySQL Redis and spring security for the 2FA. MILESTONES UAA server Customer management is done. Client management is done. Administration client for bank back office: end of 11/2017 Based on large number of communication, the OAUTH2 implementation uses JWT.

4 API gateway Implementation is done. Service registry Implementation is done. Hystrix tolerance test Planned for 2018 Q2 CBS emulator In order to provide a sandbox and testing functionality for 3rd party developers, the PSD2 Gateway has CBS emulation. The emulator is dynamical, e.g. payment can be refused/accepted by the tester, new account or customer can be created and so forth. The CBS emulation is a very important part of development and testing, therefore all important CBS emulation features are developed. Customer service emulation is done Account service emulation is done Card emulation is done Development of further emulation features are in progress Payment gateways All services use Spring Security to query the UAA server granted scopes and roles. Foreign payment SWIFT middle of 01/2018 SEPA end of 02/2018 Internal payment end of 02/2018 Domestic payment end of 03/2018 Mobile top up is not scheduled yet. Multi signature management Q2 of 2018 Customer information service Given that this feature is not fully defined, it is not on the roadmap. JS framework for 3rd party development

5 Guiding and supporting of 3rd party development is cardinal point of PSD2, hence providing some demonstrative sample applications and framework are very important. PSD2 Gateway placed roadmap items to implement and publish these sample applications. Starting of development is planned for Q2 of Items which are not scheduled, but on the roadmap Limit service Messaging service Notification service PFM Partner service