university of washington b2c credit card infrastructure university of washington copyright...
TRANSCRIPT
![Page 1: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/1.jpg)
University of Washington B2C Credit Card Infrastructure
University of WashingtonB2C Credit Card Infrastructure
University of Washington
Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia Tufarolo) 2002. This work is the intellectual property of the Authors. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the authors.
![Page 2: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/2.jpg)
University of Washington B2C Credit Card Infrastructure
University of Washington
B2C Credit Card Infrastructure
![Page 3: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/3.jpg)
University of Washington B2C Credit Card Infrastructure
UW Web Credit Card Application
![Page 4: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/4.jpg)
University of Washington B2C Credit Card Infrastructure
Client Services Project Consulting
• Project Review Marcy Tufarolo
• Architecture & Security Scott Stephenson
• Application Demo Joe Frost
• Q&A
![Page 5: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/5.jpg)
University of Washington B2C Credit Card Infrastructure
Project Goal
• Central infrastructure: Web-based credit card purchases
• Available to all UW areas
![Page 6: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/6.jpg)
University of Washington B2C Credit Card Infrastructure
UW Web Credit Card Application
• Standard Methods• Secure Installation• Economies of Scale• Mainstream the Expertise
![Page 7: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/7.jpg)
University of Washington B2C Credit Card Infrastructure
Project Approach
• Advisory Committee• Project Team
![Page 8: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/8.jpg)
University of Washington B2C Credit Card Infrastructure
Project Approach
• Research– Internal– External
![Page 9: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/9.jpg)
University of Washington B2C Credit Card Infrastructure
Project Approach
• Build vs Buy– Security
– Credit Card # not stored
– Co-branding
– Flexibility to change vendor– Integrate with UW banking
![Page 10: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/10.jpg)
University of Washington B2C Credit Card Infrastructure
Project Approach
• Implementation– Design– Development
![Page 11: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/11.jpg)
University of Washington B2C Credit Card Infrastructure
Application Overview
Purchaser
DepartmentApplication
OutsideServices
UW WebCredit Card
UW FinancialSystem
UW BankReconciliation
![Page 12: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/12.jpg)
University of Washington B2C Credit Card Infrastructure
Major Processes
• Transaction Authorization• Transaction Processing• Settlement• Standard Reporting• Administrative Functions
![Page 13: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/13.jpg)
University of Washington B2C Credit Card Infrastructure
Interfaces
• Departmental Application
• Generic Application– UW Web Conference
– UW Web Donation
– UW Web Store
![Page 14: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/14.jpg)
University of Washington B2C Credit Card Infrastructure
Example Installations
• UW Tuition
• UW Computer Training
• Health Policy Conference
• KEXP Pledge Drive
![Page 15: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/15.jpg)
University of Washington B2C Credit Card Infrastructure
Example Expansions
• Housing & Food Services
• Husky Store
• UWMC Gift Shop
![Page 16: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/16.jpg)
University of Washington B2C Credit Card Infrastructure
Cost Recovery
• Self-Sustaining Operation
• Multiple Cost Models– Fixed fee per transaction
– Percent of transaction
![Page 17: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/17.jpg)
University of Washington B2C Credit Card Infrastructure
Cost Recovery
• Recharge Module in Web CC
• Annual Review of Rates
![Page 18: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/18.jpg)
University of Washington B2C Credit Card Infrastructure
Client Services Project Consulting
• Project Review Marcy Tufarolo
• Architecture & Security Scott Stephenson
• Application Demo Joe Frost
![Page 19: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/19.jpg)
University of Washington B2C Credit Card Infrastructure
Design Challenges
• Open Architecture
• Security
• Performance, Stability & Scale
![Page 20: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/20.jpg)
University of Washington B2C Credit Card Infrastructure
Open Architecture
• Provide a central, UW-wide service
• Integrate with departmental Web Apps
• Support all UW platforms and databases
![Page 21: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/21.jpg)
University of Washington B2C Credit Card Infrastructure
Open Architecture
• Work with UW financial systems
• Work with UW banking structure
• Be secure, secure, secure!
![Page 22: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/22.jpg)
University of Washington B2C Credit Card Infrastructure
Open Architecture
Solution: Well-defined protocollayered on top of SSL (https)
![Page 23: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/23.jpg)
University of Washington B2C Credit Card Infrastructure
Payment Process
UW WebCredit Card Server
DepartmentServer Processing
Vendor
1. CheckoutPage
![Page 24: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/24.jpg)
University of Washington B2C Credit Card Infrastructure
Payment Process
UW WebCredit Card Server
DepartmentServer Processing
Vendor
2. CheckoutRequest
![Page 25: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/25.jpg)
University of Washington B2C Credit Card Infrastructure
Payment Process
UW WebCredit Card Server
DepartmentServer Processing
Vendor
3. Purchase DataRequest
![Page 26: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/26.jpg)
University of Washington B2C Credit Card Infrastructure
Payment Process
UW WebCredit Card Server
DepartmentServer Processing
Vendor
4. Purchase Data
![Page 27: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/27.jpg)
University of Washington B2C Credit Card Infrastructure
Payment Process
UW WebCredit Card Server
DepartmentServer Processing
Vendor
5. PurchaseRequest Page
![Page 28: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/28.jpg)
University of Washington B2C Credit Card Infrastructure
Payment Process
UW WebCredit Card Server
DepartmentServer Processing
Vendor
6. PurchaseRequest
![Page 29: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/29.jpg)
University of Washington B2C Credit Card Infrastructure
Payment Process
UW WebCredit Card Server
DepartmentServer Processing
Vendor
7. PurchaseConfirmation
Page
![Page 30: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/30.jpg)
University of Washington B2C Credit Card Infrastructure
Payment Process
UW WebCredit Card Server
DepartmentServer Processing
Vendor
8. PurchaseConfirmation
![Page 31: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/31.jpg)
University of Washington B2C Credit Card Infrastructure
Payment Process
UW WebCredit Card Server
DepartmentServer Processing
Vendor
9. AuthorizationRequest
![Page 32: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/32.jpg)
University of Washington B2C Credit Card Infrastructure
Payment Process
UW WebCredit Card Server
DepartmentServer Processing
Vendor
10. Authorized
![Page 33: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/33.jpg)
University of Washington B2C Credit Card Infrastructure
Payment Process
UW WebCredit Card Server
DepartmentServer Processing
Vendor
11. ConfirmPayment
![Page 34: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/34.jpg)
University of Washington B2C Credit Card Infrastructure
Payment Process
UW WebCredit Card Server
DepartmentServer Processing
Vendor
12. PurchaseSuccessful
![Page 35: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/35.jpg)
University of Washington B2C Credit Card Infrastructure
Payment Process
UW WebCredit Card Server
DepartmentServer Processing
Vendor
13. PurchaseReceipt
![Page 36: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/36.jpg)
University of Washington B2C Credit Card Infrastructure
Security Highlights
• Java and ASP, Win2K and IIS
• Credit card data never stored
• SSL for all network communications
![Page 37: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/37.jpg)
University of Washington B2C Credit Card Infrastructure
Security Highlights• Admin functions have 6 levels of access control
• Admin actions have an audit trail
• Financial transactions use RSA SecurID• Data is encrypted and encoded
![Page 38: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/38.jpg)
University of Washington B2C Credit Card Infrastructure
Security Details
• Triple-DES encryption using Cryptix class libraries
• Base64-ASCII encoding at 6-bit boundaries and padded
• Objects compressed with GZIP
![Page 39: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/39.jpg)
University of Washington B2C Credit Card Infrastructure
Security Details
• MD5 digest ensures objects not tampered with during transmission
• Cookies are secure, scoped to the server, volatile and W3C P3P compliant
• Purchase session expires after 15 minutes
![Page 40: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/40.jpg)
University of Washington B2C Credit Card Infrastructure
Security Details
• Objects tied together with creation timestamp so cannot be used independently
• Completed, cancelled or expired purchase sessions cannot be reused
• Pages have ‘Pragma no-cache’ header and are immediately expired
![Page 41: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/41.jpg)
University of Washington B2C Credit Card Infrastructure
Security Details
Ke3VFNix_W3RjfYPujNbuPqFJewtFh2v1q5PQPzrMrfJIkDz3rqEvmlTaAmiBCDj5E8LwOEeTzudRbAt4KlXC_agf0OAkorIY21vTcuoJNGLe2Re88ImRiVPqcKIh6u6wpDYYQaiidp7Kk9qHnPPpF5nB1KMxngMa0YMLSVZPIkqXOkZ_sEXGyx_MMmixUaGB9zXoq0zjlWG_07uF_MsSN0zKPl65LsN4ejQppj^8r1MCV1E_2T9Ra8EuM18O89IruDSjuB6i99C5lZjj_Dlhfg7
Example of EncryptedAnd Encoded Data
![Page 42: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/42.jpg)
University of Washington B2C Credit Card Infrastructure
Performance, Stability & Scale
• Web Servers
– Win2K and IIS
– Virtual host: load balanced at n+1
– Hot swap-able & interchangeable
![Page 43: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/43.jpg)
University of Washington B2C Credit Card Infrastructure
Performance, Stability & Scale
• Web Servers – Minimal server-side caching reduces memory consumption– Automatic monitoring with failures escalated to pagers– Leverage UW DRBR (disaster recovery)
![Page 44: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/44.jpg)
University of Washington B2C Credit Card Infrastructure
Performance, Stability & Scale
• Database Servers– Win2K and MS-SQL– Primary and secondary with mirrored disk– Tape backup every two hours– Minimal database activity
![Page 45: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/45.jpg)
University of Washington B2C Credit Card Infrastructure
Performance, Stability & Scale
• Database Servers– File UDL for easier fail-over– Automatic monitoring with failures escalated to pagers– Leverage UW DRBR
![Page 46: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/46.jpg)
University of Washington B2C Credit Card Infrastructure
Client Services Project Consulting
• Project Review Marcy Tufarolo
• Architecture & Security Scott Stephenson
• Application Demo Joe Frost
![Page 47: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/47.jpg)
University of Washington B2C Credit Card Infrastructure
Demonstration
• UW Computer Training
• UW Web Donation
• UW Web Credit Card
![Page 48: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/48.jpg)
University of Washington B2C Credit Card Infrastructure
UW Computer Training
• Existing system
• Java, Informix, Apache Server
• Department application interfaceC&C Link
![Page 49: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/49.jpg)
University of Washington B2C Credit Card Infrastructure
UW Web Donation
• New System
• ASP, MS-SQL, IIS
• Generic DonationDonation Link
![Page 50: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/50.jpg)
University of Washington B2C Credit Card Infrastructure
UW Web Credit Card
• ASP, Java, MS-SQL, IIS
• Multiple Levels of SecurityCentral User Link
![Page 51: University of Washington B2C Credit Card Infrastructure University of Washington Copyright University of Washington (Joe Frost, Scott B. Stephenson, Marcia](https://reader036.vdocuments.site/reader036/viewer/2022062619/5516a156550346a25b8b54d2/html5/thumbnails/51.jpg)
University of Washington B2C Credit Card Infrastructure
UW Web Credit Card Application
Client Services Project Consulting
http://depts.washington.edu/cac/projects