 |
- How Does E-commerce Work?
- Presented by Verisign
Online Payment Services
Once businesses have built a Web site and implemented SSL certificates to authenticate themselves to customers and encrypt communications and transactions, they must address another crucial component of an e-commerce infrastructure: enabling customers to easily pay for products and services online, and processing and managing those payments in conjunction with a complex network of financial institutions.
Today's fragmented Internet payment systems often connect online merchants to banks via privately operated, point-to-point payment networks. In 1998, for example, over 5 billion electronic payment transactions — originating from approximately 2 million merchant locations and representing over $250 billion in merchant dollar volume — were passed over leased lines and non-Internet interfaces to a single transaction processor (First Data Corporation).
This situation is rapidly changing. Internet commerce is entering an accelerated growth phase. IDC estimates worldwide e-commerce revenues will increase to $218 billion in 2000. Behind each of these Internet purchases is a payment transaction. However, traditional payment systems have proven to be ill equipped to manage the costs and complexity of transitioning and enabling transactions over the Internet. As a result, only a fraction of today's potentially automated e-commerce transactions are currently enabled for Internet payment. The situation is particularly acute in the B2B payments arena — today, most B2B systems stop short of enabling actual payment execution on the Web.
Demand is therefore high for a simpler, "Internet payment gateway" approach that provides easier Internet connectivity between buyers, sellers, and the financial networks that move money between them. A truly flexible Internet payment gateway must support multiple payment instruments, connect to all relevant back-office payment processors, and be packaged for easy integration into front-office Web applications. Ideally, the gateway should also offer uniform interfaces to payment functionality, permitting e-businesses to deploy payment applications that can be easily switched between alternative financial instruments, institutions, and payment processors. And to form part of a complete e-commerce trust infrastructure, the gateway must assure fail-safe security for payment data as it passes from customer to Web site and through the back-end processing system.
Some merchants may build an Internet payment gateway themselves, or purchase a software-based solution. However, according to the Gartner Group, most e-merchants have transaction volumes that do not justify the expense of bringing the process in-house, and are opting to outsourced, ASP solutions.
A. The Internet Payment Processing System
Understanding how best to address the need for Internet payment gateway services requires first briefly examining the participants in an Internet payment processing system.
Participants in a typical online payment transaction include:
- The customer: typically, a holder of a payment card — such as a credit card or debit card — from an issuer.
- The issuer: a financial institution, such as a bank, that provides the customer with a payment card. The issuer is responsible for the cardholder's debt payment.
- The merchant: the person or organization that sells goods or services to the cardholder via a Web site. The merchant that accepts payment cards must have an Internet Merchant Account with an acquirer.
- The acquirer: a financial institution that establishes an account with a merchant and processes payment card authorizations and payments. The acquirer provides authorization to the merchant that a given card account is active and that the proposed purchase does not exceed the customer's credit limit. The acquirer also provides electronic transfer of payments to the merchant's account, and is then reimbursed by the issuer via the transfer of electronic funds over a payment network.
- The payment gateway: This function, operated by a third-party provider, processes merchant payments by providing an interface between the merchant and the acquirer's financial processing system.
- The processor: a large data center that processes credit card transactions and settles funds to merchants, connected to the merchant on behalf of an acquirer via a payment gateway.
- The customer places an order online by selecting items from the merchant's Web site and sending the merchant a list. The merchant often replies with an order summary of the items, their price, a total, and an order number.
- The customer sends the order to the merchant, including payment data. The payment information is usually encrypted by an SSL pipeline set up between the customer's Web browser and the merchant's Web server SSL certificate.
- The merchant requests payment authorization from the payment gateway, which routes the request to banks and payment processors. Authorization is a request to charge a cardholder, and must be settled for the cardholder's account to be charged. This ensures that the payment is approved by the issuer, and guarantees that the merchant will be paid.
- The merchant confirms the order and supplies the goods or services to the customer.
- The merchant requests payment, sending the request to the payment gateway, which handles the payment processing with the processor.
- Transactions are settled, or routed by the acquiring bank to the merchant's acquiring bank for deposit.
B. VeriSign Payflow Payment Services
VeriSign Payflow Payment Services offers the most effective way to streamline
the flow of all kinds of payments through this complex system — quickly,
efficiently, and above all, securely. Payflow simplifies e-commerce by providing
payment connectivity over the Internet between buyers, sellers, and financial
networks. VeriSign uses a client server architecture to process transactions:
the client is installed on the merchant's site and integrated with the
merchant's e-commerce application. The client software establishes a secure link
with the VeriSign processing server using an SSL connection to transmit
encrypted transaction requests. The VeriSign server transmits the request over a
private network to the appropriate financial processing network. When the
authorization response is received via the financial processing network, the
server returns the response to the merchant's client, which then completes the
transaction by sending an acknowledgment to the server. Typical transactions
occur within 3 seconds.
By partnering with VeriSign, merchants gain the ability to free themselves from
point-to-point and difficult-to-integrate payment solutions, reaping the
benefits of an integrated payment platform designed specifically for the
Internet. Payflow supports all major consumer credit card, debit card,
electronic check, purchase card, and Automated ClearingHouse (ACH) transactions.
(ACH is a nationwide, wholesale electronic payment and collection system that
serves as a method of transferring funds between banks via the Federal Reserve
System.)
Its robust and open architecture has been designed to support both
business-to-consumer (B2C) and business-to-business (B2B) payment applications.
It provides the industry's highest performance and reliability and is a highly
scalable outsourced solution that can easily grow to hundreds of millions of
transactions per month. VeriSign Payflow has proven to be considerably faster,
more reliable and scalable than any other competing solution. Using VeriSign
Payflow, a merchant can connect to most banks, transaction services, or forms of
payment without worrying about the underlying technology. Customers can pay with
a variety of financial instruments, including checking accounts, savings
accounts, and credit cards, quickly and simply.
VeriSign Payflow hides the
complexity of payment
Competitive design advantages of the VeriSign Payflow service include:
- Open connectivity with almost all bank processors and payment types through unified interfaces
- Pre-integration with the most popular e-commerce applications and forthcoming payment-enabled Internet appliances such as Personal Digital Assistants (PDAs)
- Continuous maintenance of a TCP/IP network connection throughout each transaction until it either successfully completes or times out. Unlike most competing solutions, VeriSign Payflow's payment connection both enables a faster response times (averaging 2.2 seconds) and — through confirmation of transaction completion — elimination of uncertainty of transaction status.
- High availability that exceeds 99.99 percent with dynamic load balancing and failover between all servers
- An XML integration layer both on the server side for ease of integration with additional services (such as fraud screening), and on the merchant side for ease of integration into back office applications
- A Software Development Kit (SDK) allowing for more advanced custom integration into e-commerce applications
To the Internet merchant, VeriSign offers:
- Lower connectivity cost: Connecting to the payment networks over
the Internet through VeriSign costs less to set up and maintain than leased
lines or modem connections.
- Better connection quality: VeriSign manages high-bandwidth,
fault-tolerant network connections to the processing networks.
- More payment options: Merchants can add new payment types without
having to install new software.
- Increased flexibility: Merchants can switch banking relationships and continue to use the same installed software to process payments with the new bank.
1. How Payment Processing Services Work
At the application level, VeriSign's payment processing services can be accessed in three ways:
- Payflow-enabled e-commerce applications: Many off-the-shelf e-commerce applications are pre-enabled to use VeriSign's Payflow payment processing, giving merchants a complete solution that can be used out-of-the-box. VeriSign's broad third-party support and superior payment connectivity enables merchants to independently choose the best e-commerce application and the best payment processor for their business needs.
- Payflow Link: A hosted order form service that makes payment processing as simple as adding Web links to a merchant's Web site. See "VI. VeriSign E-Commerce Trust Infrastructure Solutions" below for more on Payflow Link.
- Payflow Pro SDK: A software development kit that gives merchants direct access to VeriSign's Payflow payment processing API via a "thin client" network service. See "VI. VeriSign E-Commerce Trust Infrastructure Solutions" below for more on Payflow Pro and the Payflow Pro SDK.
Through VeriSign's acquiring bank partners, merchants are also able to apply for
merchant bank accounts during the registration process. In all cases, online
registration and account management enables merchants to be up and running in
minutes.
A look inside the VeriSign Payflow
payment processing operations center
C. Payment Processing Backbone
The VeriSign payment client is a Secure Sockets Layer (SSL)-enabled
communications agent that uses routing parameter inputs to locate and establish
communications with a VeriSign transaction server. After a secure communication
channel has been established, transaction data is passed to the VeriSign payment
infrastructure for processing. VeriSign transaction communications have been
designed to minimize message-handling errors by ensuring an uninterrupted,
TCP-level communication stream between the client and the server. The VeriSign
architecture has the highest performance in the industry. The average
transaction response time is 2.2 seconds.
The following sequence of messages illustrates the communication stream during a
typical transaction from a VeriSign-enabled client to the VeriSign Payment
Services operations center.
- The client opens an SSL connection to a server and sends all transaction data.
- The server processes the transaction, sends a response back to the client.
- The client sends an acknowledgment to the server indicating that the response was successfully received.
- The connection is closed.
1. Connectivity
VeriSign provides connectivity to more payment processors and supports more payment types than any other online payment solution provider.
| PROCESSOR | PAYMENT TYPES | AVAILABLE |
| First Data Corporation 'Nashville' | Credit Cards Level II Purchase Cards |
Now |
| Paymentech | Credit Cards Level II Purchase Cards |
Now |
| TeleCheck | Electronic Check Verification and Guarantee | Now |
| Wells Fargo Norwest | ACH | Now |
| NOVA | Credit Cards Level II Purchase Cards |
Now |
| VITAL | Credit Cards Level II Purchase Cards |
Now |
| EDS Aurora | Credit Cards Level II Purchase Cards |
Now |
| First Data Corporation 'South' | Credit Cards Level II & III Purchase Cards |
Now |
2. Scalability
VeriSign's transaction processing power can grow quickly, providing throughput and reliability as the transaction load grows from millions to hundreds of millions of transactions per month and beyond. VeriSign combines custom-developed, high-throughput server software with a load-balancing network architecture to deliver a solid payment Internet service explicitly intended for today's quickly growing e-commerce community.
3. Maximum Throughput
While many payment solutions have been implemented as "add-ons" to existing Web server platforms, VeriSign has built server software specifically designed for payment transactions. This provides significant advantages in three areas:
- Internal Resources: VeriSign server software incorporates a sophisticated threading model designed specifically to deliver maximum throughput for payment transactions. Signal and timer logic for handling payment transaction exceptions and errors is built into the server's kernel. File system access and logging are optimized for payment transactions.
- Database Resources: VeriSign uses state-of-the-art DBMS technology to store and log the transaction activity. It has kernel-level control of database logins and resources, which provides a level of performance tuning and error recovery that is not available to payment systems that are based on Web servers.
- Network Resources: Because the VeriSign server is "payment-aware" at its core, it can manage the complex dynamics of communicating with card processing networks. Effective load balancing is achieved both in the local processes and in coordination with peer servers to implement an array-wide throughput optimization strategy — in other words, VeriSign servers perform load balancing both internally and in relation to other transaction servers in their cluster. As transaction loads grow for a cluster, this advantage becomes increasingly important.
Highly available payment processing requires that individual transaction servers be both extremely reliable and efficient. To provide true scalability, it must be practical to add new server capacity on demand. VeriSign services are delivered through clusters:
- Payment Server Cluster: These machines run the VeriSign Payment Server and manage the processing of inbound transaction requests to the processing networks.
- Web Server Cluster: These servers provide Web application functionality associated with the payment services. VeriSign's merchant reporting and virtual terminal systems are provided here.
- Replicated Database Cluster: These machines host the database servers. This cluster is broken up into write-biased, read-biased, and replicator machines. Write-biased servers are configured for maximum throughput for new transactions and are used by default by the transaction servers. Read-biased servers are configured for maximum speed on queries and reports and are used by default by the Web servers. Replication machines manage the synchronization of the data between all of the local database machines in the cluster as well as other cluster and backup/archive services.
VeriSign's current production cluster supports a nominal load of two million transactions per day. In practice, capacity is added well before it is needed. As a general rule, when a cluster reaches a nominal load of 30% of capacity or when there are frequent spikes above 50% of capacity, either new capacity is added to the cluster or a new cluster is added to the service.
5. Reliability
In addition to load balancing, VeriSign's server clusters also provide failure protection. When a cluster suffers a server failure, the transaction load is seamlessly redistributed to the remaining servers in the cluster. Hardware redundancy is also provided within each server for every important subsystem.
6. Security
One of VeriSign's fundamental design considerations is, of course, security. The hardware, software, and physical plant developed and used by VeriSign services are carefully coordinated with an aggressive set of best practices to provide maximum protection and integrity at the transport, system, and physical levels.
Transport Security
Transport security provides protects transaction messages between the VeriSign client and server. Most transactions sent from the VeriSign client to VeriSign's payment servers are sent over the Internet — a public network. To ensure that the contents of transactions are private and that they cannot be altered or embellished in any way, VeriSign uses the Secure Sockets Layer (SSL) protocol for all communications between clients and servers. Similarly, Web access to every VeriSign Web site that provides sensitive data is available only under the HTTPS protocol, which is the same SSL protocol used by the client, running on top of HTTP.
VeriSign has licensed RSA Security, Inc.'s cryptographic tools. These tools are the de facto standard for highly secure communications over the Internet and are widely regarded as the best available platform on which to build a secure client/server system. This means that transaction data sent by the merchant to the VeriSign server can be read and used only by the VeriSign server.
Additionally, VeriSign offers merchants the opportunity to identify a set of IP addresses or subnets that constitute valid transaction sources for a given merchant. This means that in addition to the protection afforded by SSL message encryption, the merchant can specify a range of IP addresses using a string (for example, 192.32.4.18-20 or 192.4.22.*) This specifies the valid IP addresses for the VeriSign payment server. Transactions that originate from unregistered IP addresses are logged as suspicious behavior for VeriSign's network monitoring tools to investigate. This allows the merchant to further validate and protect the transaction stream to the VeriSign service.
System Security
VeriSign payment services are protected by firewall systems based on an extremely conservative access strategy: VeriSign's payment services are isolated from all other services. VeriSign permits communication with the VeriSign payment server or secured Web servers only through SSL (port 443.) This means there is no backdoor access for email, FTP, DNS, ICMP, and so on, which are all security risks. The only data that can enter is SSL traffic. All access requires user name and password, IP address validation, or X.509 client authentication.
The VeriSign service is also protected on the "back side" — its array of network connections to the processing networks — by firewall systems that ensure that only authorized traffic from authorized sources gets through to VeriSign's payment servers.
Inside the server array, a layering strategy further isolates repositories that contain sensitive information. Best-of-breed intruder detection systems and network monitoring tools are manned on a 24x7 basis, providing instant notification of suspicious or unauthorized access, as well as automatic countermeasures and remedies.
Physical Security
VeriSign's measures for physically protecting its Payment Services include 24x7 card key customer access to data centers, 24x7 video surveillance and recording of the premises by security personnel, and 24x7 on-site security personnel
7. XML
In cooperation with selected e-commerce partners and industry standards bodies, VeriSign has built an XML integration and automation layer into its payment infrastructure. This layer provides uniform XML access to all payment-related services including payment execution, registration, and reporting.
XMLPay
XMLPay is a VeriSign Payment Services specification that defines a set of XML document types for payment transactions and XML digital receipts. Although XMLPay loosely follows level 3 purchase card data formats, it supports a variety of payment instruments beyond just purchase cards. XMLPay is compliant with the joint IETF/W3C working group specification for digitally signed XML.
XMLRegister
Turning on a business for VeriSign PayFlow is a moderately complex process that involves the manual intervention of several parties, including not only the merchant and VeriSign Payment Services itself but also the merchant's acquiring bank and a payment processor to move money between buyer and seller banks. Both resellers and emerging B2B marketplaces are increasingly demanding more automated access to the process of enabling online merchant payment accounts. In response, VeriSign is developing XMLRegister, a specification defining data formats and processing infrastructure supporting the automation of VeriSign Payment Services merchant registrations.
Without XMLRegister, merchants typically must register one at a time for VeriSign Payment Services. With XMLRegister, formatted XML documents may be submitted programmatically over a secure transport to a registration server. The registration server supports methods for a single or group merchant registration. Each registration element may be for a new registration or update of an existing account. Because business rules and the information needed to complete a registration vary among processors and acquirers, an XMLRegister document does not attempt to enforce business rules related to a registration. It merely transports data across the wire for processing by the registration server whose job is to enforce such rules and report non-compliance.
XMLReport
XMLReport specifies data used in payment transaction reports. Resellers or merchants submit XMLReport document when they need reports on their transactions. In summary, today's widespread adoption of XML is leading to three significant developments in the payments industry:
- Extensibility: XML enables easy update and extension of existing services to quickly add altogether new services to existing applications.
- Automation: Currently, merchants can download a set of preset reports from the VeriSign Payflow Manager Web site, but have limited flexibility in what can be queried, or how the results are returned. XMLReport provides an automation language for merchant reporting. Complex queries and result formatting instructions can be communicated to the VeriSign service in a straightforward manner.
- Interoperability: XML is quickly gaining momentum as the lingua franca of system interchange. Via its three XML specifications, VeriSign Payment Services will publish an XML-based vocabulary for its services. By collaborating with partners, this vocabulary will be consistent with emerging industry-standard vocabularies, as well as those of the partners.
|
Building an E-Commerce Network | Criteria - Selecting A Web Designer |
Ask us about our...
