{"id":"https://openalex.org/W4415366366","doi":"https://doi.org/10.51519/journalisi.v7i3.1219","title":"Designing a Zero Trust Architecture for Securing API Gateways in Digital Banking Systems","display_name":"Designing a Zero Trust Architecture for Securing API Gateways in Digital Banking Systems","publication_year":2025,"publication_date":"2025-09-30","ids":{"openalex":"https://openalex.org/W4415366366","doi":"https://doi.org/10.51519/journalisi.v7i3.1219"},"language":"en","primary_location":{"id":"doi:10.51519/journalisi.v7i3.1219","doi":"https://doi.org/10.51519/journalisi.v7i3.1219","is_oa":true,"landing_page_url":"https://doi.org/10.51519/journalisi.v7i3.1219","pdf_url":"https://journal-isi.org/index.php/isi/article/download/1219/615","source":{"id":"https://openalex.org/S4210216117","display_name":"Journal of Information Systems and Informatics","issn_l":"2656-4882","issn":["2656-4882","2656-5935"],"is_oa":true,"is_in_doaj":true,"is_core":false,"listed_in":["doaj"],"host_organization":"https://openalex.org/I4210113646","host_organization_name":"Universitas Bina Darma","host_organization_lineage":["https://openalex.org/I4210113646"],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Information Systems and Informatics","raw_type":"journal-article"},"volume":null,"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://journal-isi.org/index.php/isi/article/download/1219/615","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5107016761","display_name":"Riama Santy Sitorus","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4405273730","display_name":"Universitas Asa Indonesia","ror":"https://ror.org/00bzwzw89","country_code":"ID","type":"education","lineage":["https://openalex.org/I4405273730"]}],"countries":["ID"],"is_corresponding":false,"raw_author_name":"Riama Santy Sitorus","raw_affiliation_strings":["Universitas Asa Indonesia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universitas Asa Indonesia","institution_ids":["https://openalex.org/I4405273730"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5107016760","display_name":"B. Junedi Hutagaol","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4405273730","display_name":"Universitas Asa Indonesia","ror":"https://ror.org/00bzwzw89","country_code":"ID","type":"education","lineage":["https://openalex.org/I4405273730"]}],"countries":["ID"],"is_corresponding":false,"raw_author_name":"B. Junedi Hutagaol","raw_affiliation_strings":["Universitas Asa Indonesia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universitas Asa Indonesia","institution_ids":["https://openalex.org/I4405273730"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I4405273730"],"apc_list":{"value":500000,"currency":"IDR","value_usd":32},"apc_paid":{"value":500000,"currency":"IDR","value_usd":32},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.2769164,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"7","issue":"3","first_page":"2589","last_page":"2601"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.31929999589920044,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.31929999589920044,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.3118000030517578,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.11620000004768372,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/zero-trust-architecture","display_name":"zero-trust architecture","score":0.8880000114440918},{"id":"https://openalex.org/keywords/api-gateway","display_name":"API gateway","score":0.9710000157356262},{"id":"https://openalex.org/keywords/digital-banking","display_name":"digital banking","score":0.9419999718666077},{"id":"https://openalex.org/keywords/api-security","display_name":"API security","score":0.9290000200271606},{"id":"https://openalex.org/keywords/identity-verification","display_name":"identity verification","score":0.7870000004768372},{"id":"https://openalex.org/keywords/dynamic-access-control","display_name":"dynamic access control","score":0.9539999961853027},{"id":"https://openalex.org/keywords/data-encryption","display_name":"data encryption","score":0.8019999861717224},{"id":"https://openalex.org/keywords/continuous-monitoring","display_name":"continuous monitoring","score":0.8450000286102295},{"id":"https://openalex.org/keywords/behavioral-analytics","display_name":"behavioral analytics","score":0.9610000252723694},{"id":"https://openalex.org/keywords/credential-theft","display_name":"credential theft","score":0.7570000290870667},{"id":"https://openalex.org/keywords/regulatory-compliance","display_name":"regulatory compliance","score":0.7450000047683716},{"id":"https://openalex.org/keywords/financial-data-security","display_name":"financial data security","score":0.5479999780654907}],"concepts":[{"id":"https://openalex.org/C2777810591","wikidata":"https://www.wikidata.org/wiki/Q16861606","display_name":"Credential","level":2,"score":0.7555000185966492},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.65829998254776},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6212000250816345},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.566100001335144},{"id":"https://openalex.org/C2777710495","wikidata":"https://www.wikidata.org/wiki/Q5527195","display_name":"Gateway (web page)","level":2,"score":0.4706999957561493},{"id":"https://openalex.org/C13606891","wikidata":"https://www.wikidata.org/wiki/Q2623243","display_name":"Conceptual model","level":2,"score":0.42579999566078186},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.3880999982357025},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.38589999079704285},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.3797000050544739},{"id":"https://openalex.org/C14224292","wikidata":"https://www.wikidata.org/wiki/Q13600188","display_name":"Conceptual framework","level":2,"score":0.3675999939441681},{"id":"https://openalex.org/C99613125","wikidata":"https://www.wikidata.org/wiki/Q165194","display_name":"Application programming interface","level":2,"score":0.35899999737739563},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.35040000081062317},{"id":"https://openalex.org/C2776831232","wikidata":"https://www.wikidata.org/wiki/Q966812","display_name":"Trusted Computing","level":2,"score":0.34279999136924744},{"id":"https://openalex.org/C53619493","wikidata":"https://www.wikidata.org/wiki/Q4787093","display_name":"Architecture framework","level":3,"score":0.34130001068115234},{"id":"https://openalex.org/C110406131","wikidata":"https://www.wikidata.org/wiki/Q41349","display_name":"Smart card","level":2,"score":0.335999995470047},{"id":"https://openalex.org/C149810388","wikidata":"https://www.wikidata.org/wiki/Q5374873","display_name":"Emulation","level":2,"score":0.3244999945163727},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.32010000944137573},{"id":"https://openalex.org/C162763945","wikidata":"https://www.wikidata.org/wiki/Q4825467","display_name":"Conceptual architecture","level":3,"score":0.3070000112056732},{"id":"https://openalex.org/C79158427","wikidata":"https://www.wikidata.org/wiki/Q485396","display_name":"Analytics","level":2,"score":0.2915000021457672},{"id":"https://openalex.org/C118463975","wikidata":"https://www.wikidata.org/wiki/Q220849","display_name":"Digital signature","level":3,"score":0.2849999964237213},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.2777999937534332},{"id":"https://openalex.org/C10511746","wikidata":"https://www.wikidata.org/wiki/Q899388","display_name":"Data security","level":3,"score":0.273499995470047},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.2728999853134155},{"id":"https://openalex.org/C2776397876","wikidata":"https://www.wikidata.org/wiki/Q1450531","display_name":"Cyberinfrastructure","level":2,"score":0.272599995136261},{"id":"https://openalex.org/C187713609","wikidata":"https://www.wikidata.org/wiki/Q2465461","display_name":"Default gateway","level":2,"score":0.27140000462532043},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.2653000056743622},{"id":"https://openalex.org/C139458680","wikidata":"https://www.wikidata.org/wiki/Q12184942","display_name":"Interoperation","level":3,"score":0.26440000534057617},{"id":"https://openalex.org/C33762810","wikidata":"https://www.wikidata.org/wiki/Q461671","display_name":"Data integrity","level":2,"score":0.2628999948501587},{"id":"https://openalex.org/C165609540","wikidata":"https://www.wikidata.org/wiki/Q1172486","display_name":"Data breach","level":2,"score":0.262800008058548},{"id":"https://openalex.org/C165136773","wikidata":"https://www.wikidata.org/wiki/Q1363179","display_name":"Single point of failure","level":2,"score":0.2621000111103058},{"id":"https://openalex.org/C37703655","wikidata":"https://www.wikidata.org/wiki/Q4048808","display_name":"SMS banking","level":3,"score":0.2574999928474426},{"id":"https://openalex.org/C98025372","wikidata":"https://www.wikidata.org/wiki/Q477538","display_name":"Systems architecture","level":3,"score":0.2533000111579895},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.2531999945640564},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.25290000438690186}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.51519/journalisi.v7i3.1219","doi":"https://doi.org/10.51519/journalisi.v7i3.1219","is_oa":true,"landing_page_url":"https://doi.org/10.51519/journalisi.v7i3.1219","pdf_url":"https://journal-isi.org/index.php/isi/article/download/1219/615","source":{"id":"https://openalex.org/S4210216117","display_name":"Journal of Information Systems and Informatics","issn_l":"2656-4882","issn":["2656-4882","2656-5935"],"is_oa":true,"is_in_doaj":true,"is_core":false,"listed_in":["doaj"],"host_organization":"https://openalex.org/I4210113646","host_organization_name":"Universitas Bina Darma","host_organization_lineage":["https://openalex.org/I4210113646"],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Information Systems and Informatics","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:870a55eaf21d40fc982330e0594d448a","doi":null,"is_oa":true,"landing_page_url":"https://doaj.org/article/870a55eaf21d40fc982330e0594d448a","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Journal of Information Systems and Informatics, Vol 7, Iss 3, Pp 2589-2601 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.51519/journalisi.v7i3.1219","doi":"https://doi.org/10.51519/journalisi.v7i3.1219","is_oa":true,"landing_page_url":"https://doi.org/10.51519/journalisi.v7i3.1219","pdf_url":"https://journal-isi.org/index.php/isi/article/download/1219/615","source":{"id":"https://openalex.org/S4210216117","display_name":"Journal of Information Systems and Informatics","issn_l":"2656-4882","issn":["2656-4882","2656-5935"],"is_oa":true,"is_in_doaj":true,"is_core":false,"listed_in":["doaj"],"host_organization":"https://openalex.org/I4210113646","host_organization_name":"Universitas Bina Darma","host_organization_lineage":["https://openalex.org/I4210113646"],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Information Systems and Informatics","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9","score":0.4943999946117401}],"sustainable_development_goals_aurora":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4415366366.pdf","grobid_xml":"https://content.openalex.org/works/W4415366366.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"In":[0],"the":[1,75,129,132,140,169],"era":[2],"of":[3],"digital":[4,55,163,181],"banking":[5,56,182],"transformation,":[6],"Application":[7],"Programming":[8],"Interfaces":[9],"(APIs)":[10],"are":[11],"essential":[12],"for":[13,161,176,186],"system":[14],"integration":[15],"and":[16,35,72,108,125,154,183,189],"customer-facing":[17],"innovations":[18],"but":[19],"also":[20],"increase":[21],"exposure":[22],"to":[23,50,119],"cyber":[24,144],"security":[25,145],"risks":[26],"such":[27],"as":[28],"credential":[29,90],"theft,":[30],"API":[31,52,113,141,149,178],"abuse,":[32],"data":[33],"breaches,":[34],"unauthorized":[36,96],"access.":[37],"This":[38],"research":[39],"proposes":[40],"a":[41,59,78,158,173],"conceptual":[42,60,130],"Zero":[43,83],"Trust":[44,84],"Architecture":[45],"(ZTA)":[46],"model":[47,171],"specifically":[48],"designed":[49],"secure":[51,162,177],"Gateways":[53],"in":[54,180],"systems.":[57],"Adopting":[58],"design":[61],"methodology":[62],"comprising":[63],"literature":[64],"review,":[65],"component":[66,116],"identification,":[67],"architectural":[68],"modelling,":[69],"standards-based":[70],"evaluation,":[71],"recommendation":[73],"development":[74],"study":[76,166],"introduces":[77],"framework":[79],"that":[80,168],"integrates":[81],"core":[82],"principles.":[85],"Strong":[86],"identity":[87],"verification":[88],"counters":[89],"misuse,":[91],"dynamic":[92],"access":[93],"control":[94],"mitigates":[95],"access,":[97],"encryption":[98],"protects":[99],"sensitive":[100],"financial":[101],"data,":[102],"continuous":[103],"monitoring":[104],"identifies":[105],"abnormal":[106],"traffic,":[107],"real-time":[109],"behavioral":[110],"analytics":[111],"prevents":[112],"abuse.":[114],"Each":[115],"is":[117],"mapped":[118],"relevant":[120],"industry":[121],"standards,":[122],"ensuring":[123],"resilience":[124],"regulatory":[126,152],"compliance.":[127],"Beyond":[128],"design,":[131],"findings":[133],"highlight":[134],"practical":[135],"implications:":[136],"applying":[137],"ZTA":[138],"at":[139],"Gateway":[142],"strengthens":[143],"defenses":[146],"against":[147],"modern":[148],"threats,":[150],"supports":[151],"readiness,":[153],"provides":[155],"banks":[156],"with":[157],"structured":[159],"roadmap":[160],"services.":[164],"The":[165],"concludes":[167],"proposed":[170],"delivers":[172],"comprehensive":[174],"foundation":[175],"communication":[179],"actionable":[184],"guidance":[185],"future":[187],"implementation":[188],"research.":[190]},"counts_by_year":[],"updated_date":"2026-10-07T09:51:55.459714","created_date":"2025-10-21T00:00:00"}