Our customer (a bank) needs to publish a web-service API for use by 3rd party applications. The security is going to involve OAuth2 and JWT (JSON Web Token). The problem is that the customer is afraid of misuse of the published APIs by the 3rd parties to whom they don't trust completely (please, don't comment on this). A basic scenario is like this:
The public API contains an operation IsOurCustomer() that returns true/false if the person has a product in the bank. The subsequent operation is CreateNewCustomer(), and is called when IsOurCustomer() returns false.
The bank is afraid that a 3rd party could scan their customer-base by checking who is/isn't their customer via calling IsOurCustomer() sequentially for all people taken from another source (say from a public state registry). (I can't tell whether the presumed damage is real, or whether it's a paranoia only.)
Is there a way how to prevent the possibility of data-scanning?
There are some partial solutions we came with, but none of them mitigates the problem completely:
- Throttling - It's hard to set the right limit which wouldn't restrict the legal work of the 3rd party company, but would prevent them to misuse the API at the same time. Especially, when the 3rd party has many employees and enough time. The 3rd party could issue thousands of (justified) customer-checks per day, which could allow them to scan 1 million of people per year.
- Legal threats - when API misuse is detected (which needs logging, monitoring).
- Payments per API call - above an agreed limit
- Heuristics - e.g. signal an alert when the ratio of calls to IsOurCustomer() and CreateNewCustomer() is too high.
- "Data Leak Prevention system" - I don't know of any usable DLP for our purpose.