DOCUMENTATION

Overview of e-Commerce Payment Service

1.2.Payment Transaction Flow

Octo3’s e-Commerce Payment Service is a real-time payment transaction service which transfers funds between cardholder’s account and the merchant’s financial institution securely over the Internet.  An e-Commerce payment process flow usually involves four main parties, namely the Cardholder, the Merchant System, the Payments Platform, and the Financial Institution.

The e-Commerce Payment Service API is a simple-to-use and secure payment service interface which allows the merchant to integrate real-time payment capability into its system with minimal development effort.

The Merchant System communicates with the e-Commerce Payment Service via a secure communication channel over the Internet with the industry security standard of 256-bit SSL encryption.  By leveraging the Internet infrastructure, no additional cost on dedicated network infrastructure is required by the merchant.

​

The basic payment transaction flow is depicted below:

1. Merchant System prepares the required payment transaction parameters which form a Digital Order (DO) with a digital signature.

2. Merchant System calls the e-Commerce Payment Service API to initiate a payment request with the DO.

3. The DO is passed to the Payments Platform, either directly or indirectly depending on the Integration Model used (which is covered in the later section) over a secure channel.

4. Upon receiving the DO, the Payments Platform authenticates the request, and performs data integrity validation.  It will then process the payment request with the Financial Institution.

5. Payments Platform generates a Digital Receipt (DR) with digital signature and returns the payment result to the Merchant System. 

6. Merchant System authenticates the DR, validates the data integrity and retrieves the payment transaction result.

7. Merchant System proceeds with its business logic according to the payment transaction result. 

The e-Commerce Payment Service provides a “Query Transaction” API which returns the final transaction status of a previously submitted transaction request.  It is highly recommended for the Merchant System to make a “Query Transaction” request against any transaction which has uncertain status (e.g. due to timeout caused by network problem, etc.).

​

1.3.Communication Interface

HTTPS POST method is used as the communication method between the merchant systems and the Payments Platform.  For merchant systems, there is no special requirement on the supported platform or development languages.  Its implementation can be done with any popular programming language (such as Java, ASP.NET, PHP, etc.) as long as the communication protocol (HTTPS) is supported.

For character encodings, Unicode is the standard when transmitting messages between the merchant systems and the Payments Platform.

​

1.4.Transaction Security Measures

The e-Commerce Payment Service incorporates a highly secure design which provides data confidentiality, message integrity and authenticity for the entire payment transaction process.

 

Data confidentiality is provided by highly secure encryption technology.  The e-Commerce Payment Service is provisioned via a highly secure payment infrastructure where secure web services are incorporated with 256-bit SSL support.  Merchant System communicates with the e-Commerce Payment Service via a secure communication channel over the Internet with the industry security standard of 256-bit SSL encryption.  Data communicated among the parties in the process is securely encrypted, and only the targeted party is able to decrypt and access the data properly.  Sensitive transaction data is properly encrypted by industrial best practice cryptographic standards with Hardware Secure Model (HSM).

 

The e-Commerce Payment Service incorporates a secure design of Digital Order (DO) and Digital Receipt (DR) for the transaction communication process.  A digital signature, based on the industrial security standard HMAC-SHA1 (Hash-based Message Authentication Code – SHA1), is incorporated into the Digital Order and Digital Receipt.   A Digital Order is the payment transaction request order with a digital signature generated by the merchant system, whereas a Digital Receipt is the payment transaction response with a digital signature generated by the Payments Platform.  A HMAC verification process of the digital signature with the order information can validate whether the order has been altered during the process and also verify if the order is generated from the genuine sender.  In essence, this provides the message integrity and authenticity.

 

The Payments Platform can also provide additional security control by supporting access control based on the merchant profile, user profile, and IP address.