CentralPayPlus Bank Integration Guide

Transcription

1 CentralPayPlus Bank Integration Guide Version: 2.0 Date: Status: Draft Classification: Restrict Subject: CPAYPlus Int. Spec Reference: NIBSSCPAYPlus September 2014, NIBSS PLC. The information contained herein is proprietary and shall not be duplicated, published or disclosed to any third party in whole or in part without its prior written consent, which shall never be presumed. Plot 1230, Ahmadu Bello Way, Bar Beach, Victoria Island, P. M. B , Lagos Phone: / Fax:

2 Table of Contents 1.0 CentralPay Integration to Bank Internet Banking UI: Message Exchange Security Hash Value: Message Encryption: Message Specification Validation Request from NIBSS Field Definition Validation Response to NIBSS Response Code... 7

3 1.0 CentralPay Integration to Bank CentralPay is a web payment platform through which customers wish to pay their merchant(s) on an online ecommerce site using bank account. This integration will involve validation of who the customer claim to be before transaction is consummated. Hence the bank is expected to provide an Internet Banking User Interface where the customers will be validated on who they are (username and password), what they have (token) and/or what they know (secret phrase). This integration shall leverage on the existing integration or network infrastructure to connecting bank. The mode of communication would be through HTML form post messaging as detailed below. 1.1 Internet Banking UI: Step 1: Customer Login Step 2: Complete Payment Username: ; Account to Debit Password: Amount Login Secret Key Token Code Pay

4 2.0 Message Exchange Security There are two (2) levels of security: 2.1 Hash Value: The exchanged message contains hash value to prevent unauthorized system from having access to exchange message. The hashing is based on SHA-256 seeded with keys which will have been pre exchanged between NIBSS and Banks. 2.2 Message Encryption: The NIP SSM is based on the renowned PGP technology. NIBSS shall make available to every bank the NIP SSM with which a pair of keys public and private keys will be generated and also, it would handle all message encryption and decryption between CentralPay and the integrating banks. This security mechanism would ensure the safety of CentralPay messages between Banks and NIBSS. 3.0 Message Specification 3.1 Validation Request from NIBSS The mode of communication would be through HTML form post messaging as detailed below: <form name="centralpay" action="ibanking URL"> <input type="hidden" name="cpay" value="" /> </form> Field Definition cpay: This is the only parameter in the form post. The value of this parameter would be the encrypted value from the NIP SSM already implemented by the bank. Furthermore, the message to be hashed would be an xml as shown below:

5 <?xml version="1.0" encoding="utf-8"?> <CPAYRequest> <sourcebankcode>0xx</sourcebankcode> <sessionid>0xx0yy </sessionid> <channelcode>2</channelcode> <amount> </amount > <mechantname>xyz MarketPlace</mechantName> <echodata>xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx</echodata> <hashvalue>xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx</hashvalue> </CPAYRequest> SourceBankCode is the code assigned to NIBSS (999) It is important to note that the Session ID is 30 characters in length and will follow the format below: Char 1 3: Senders bank s code Char 4 6: Destination Bank s code Char 7 18: Date and time (in the format yymmddhhmmss HH is 24 hour clock) Char 19 30: 12 character unique number (either serial # or random number) The EchoData tag is a tag used to indicate information that is to be returned back to the source of transaction. The HashValue is the hash of the entire XML with the exclusion of this tag i.e. <?xml version="1.0" encoding="utf-8"?> <CPAYRequest> <sourcebankcode>0xx</sourcebankcode> <sessionid>0xx0yy </sessionid> <channelcode>2</channelcode> <amount> </amount > <mechantname>xyz MarketPlace</mechantName> <echodata>xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx</echodata> </CPAYRequest> The value is then put in the HashValue tag.

6 3.2 Validation Response to NIBSS The validating bank is supposed to redirect to NIBSS response page using a form post as shown <form name="centralpay" action=" method="post"> <input type="hidden" name="cpay" value="" /> </form> cpay: This is the only parameter in the form post. The value of this parameter would be the encrypted value from the NIP SSM already implemented by the bank. Furthermore, the message to be hashed would be an xml as shown below: <?xml version="1.0" encoding="utf-8"?> <CPAYResponse> <sourcebankcode>0xx</sourcebankcode> <sessionid>0xx0yy </sessionid> <channelcode>2</channelcode> <accountnumber> </accountnumber > <accountname>ajibade Oluwasegun</accountName> <responsecode>00</responsecode> <echodata>xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx</echodata> <hashvalue>xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx</hashvalue> </CPAYResponse> Note: Account number and Account name can be empty if validation isn t successful. Also, SourceBankCode, SessionID, ChannelCode and EchoData should be returned unaltered as contained in the original request.

7 4.0 Response Code Code Description 00 Successful Validation 01 Failed Validation