PCI-DSS compliant ISO-8583 client
Custom development of high-performance PCI-DSS compliant ISO-8583 client for the processing of a huge amount of authorization messages and forwarding them to customers.
- Custom Software Development
- 2019 – 2020
- Industry: FinTech
Initial Task
Description
The Client submitted a request for the implementation of high-performance PCI-DSS compliant ISO-8583 client for the processing of a huge amount of authorization messages and forwarding them to customers for approve/decline decisions based on their processing rules and Risk Management Systems replies.
Technology stack
BackEnd
Challenges
Implementations of ISO-8583 clients
ISO-8583 is a rather low-level protocol based on persistent TCP connections with complex message structure. There are no open-source implementations of ISO-8583 clients, so we decided to build it on our own using Netty framework. Building a fault-tolerant client with robust connection management required in-depth understanding of TCP protocol. While ISO-8583 message structure is described by hundreds of specification pages, Touchlane developers were able to make it happen with required diligence
Multiple Performance Optimizations
As the ISO-8583 processing time affects cardholder experience at POS, we had strict performance requirements. In order to make it real we did multiple performance optimizations with caching, selected the appropriate messaging system based on our benchmarks. Building the system based on Reactive architecture, usage of non-blocking IO, etc. allowed us to support the high throughput and low latency.
Process
Phase / 01.
-
Analysis of performance requirements and ISO-8583 specification
As ISO-8583 is a quite complex specification expressed in hundreds of pages, we had to understand which transport does this protocol use, what are the core message types and how they should be handled. This stage has significantly broadened our understanding of the target system requirements.
-
System Design (involving POCs & benchmarking)
We've analyzed the PCI-DSS requirements, which influenced the target design by separating components that work with sensitive data into a separate module. That in turn meant that we needed an efficient message-passing solution for internal service communication. As a result of benchmarking different message-passing solutions, we've decided to use Redis Streams that met our performance needs.
Phase / 02.
-
Implementation of ISO8583 transport using Netty framework
With no good open-source ISO-8583 client solutions, we implemented our own client from scratch. As ISO-8583 uses TCP as transport and Netty is widely used by modern open-source TCP/HTTP clients, we proceeded with Netty. The client implementation was rather challenging as we had to implement things like connection pooling, keep-alives, etc. on our own, which usually go "by default".
-
Implementation of ISO8583 message parsing
That was extremely tedious task as the protocol describes 100+ data fields which have different encoding, encryption, formatting etc. Moreover, VISA and MC have different dialects of the same protocol, which increased the amount of work. Parsing itself was not a trivial task as it's rather low-level, meaning that we had to work a lot with binary operations and not commonly encodings.
Phase / 03.
-
Performance optimizations
As the cardholder experience at POS is directly dependent on the processing speed of this application, we had rather strict performance requirements (< 50ms for processing of single authorization). That's why we had to fine-tune our processing system by optimizing the SQL queries and adding caching for speeding up client integrations.
-
Integration with third party Risk Management Systems
As customers use different Risk management systems and API security mechanisms, we had to implement a variety of integration options for our clients for their seamless integration (e.g. MTLS, OAuth2, Basic Auth).
Overall Result
The project was launched in production, and the high-end system built by Touchlane developers has met all security standards and processed a large number of requests.
As the Client sells this technology, more and more new users take advantage of the developed product.
