13

我是 EMV 新手，目前我有一个紧急 EMV 应用程序开发项目，任何人都可以帮助我回答以下问题：

  1. 什么是 EMV L2 应用内核？是 API 还是只是可执行的 EMV 应用程序？

  2. 在 EMV 支付交易中，需要从 Chip&Pin 卡中获取什么样的数据（消息）信息，以便提交给银行发卡机构进行授权。支付交易数据应适用的 ISO 规范。

  3. EMV终端和收单方之间的连接方式是什么？IP还是串口？

  4. 任何用于 EMV 应用程序开发的测试工具？如收单主机模拟。

5.一个EMV应用开发需要多少时间？

4

2 回答 2

35

1] what is EMV L2 application kernel? Is an API or just an executable EMV application?

It is more an API than an application. That's a piece of software that will use the underlying hardware to communicate with your EMV card, and will manage all of the EMV application level protocol (APDUs). If you're developing for a specific payment terminal, you'll have to contact the manufacturer to buy its kernel (ex : Ingenico, VeriFone). If you develop for a PC solution, you can buy some generic kernel (ex : EmvX). You probably don't want to write your own kernel, this blog estimates the cost of doing so :

EMV recommends to take around 18 month time to develop and certify a contact kernel. [...] Something between 200’000 and 400’000 Euro is a normal value.

2] During an EMV payment transaction, what kind of data(message) information need to be captured from Chip&Pin card so that it could submit to bank card issuer for authorization. Which ISO specification that the payment transaction data should apply for.

The documentation for the EMV protocol is publicly available at EMVco.com. An EMV card is a chip card, meaning you don't capture info from the card to later submit it to your bank (acquirer). In (very brief), your card will provide its characteristics to your application, and require a variable set of parameters (ex : amount, date, tip, etc.). Your application will reply with the required info and the card will then eventually decide if it accepts the transaction offline, accepts it online (after validation by the issuer), or rejects it.

3] what kind of connectivity between EMV terminal and acquirer? IP or Serial Port?

Between terminal and acquirer, it's a dial-up connection most of time (60% of merchants in the U.S. in 2012), or IP connection.

4] Any testing tools for EMV application development? Such as acquirer host simulation.

A bunch. You'll need a card issuer simulator (Visa, Mastercard, etc.), an acquirer (bank), simulator which will depend on the acquirer you're working with (in Canada, it could be Base24). You'll then need tools to troubleshoot communication problems between your application and EMV card (ex : SmartSpy), and eventually tools to prepare for certification (ex : from ICC Solutions, or Fime)

5] How much time it will take for an EMV application development?

A lot. Where I work, it just took a little bit more than 1 year to a 6 developers team with a strong experience in EMV transactions and payment applications to write a new payment application from scratch for an Ingenico terminal and to get it ready for certification. One of the most painful part is to succeed certification tests. Targeting a PC environment may make development easier (easier debugging, more online resources and documentation, etc), but not having in-house skills and experience will increase significantly the cost

于 2014-01-13T16:43:14.080 回答
5

我至少可以添加到@nicolas-riousset 对一对夫妇的回答。

1) 不幸的是，我在这里没有什么要补充的。

2) 答案是检查您的终端和我认为终端和卡的 CVM 的适用性规范以及任何处理器特定要求。

3) IP 是的，但是现在已经建立了协议并且大多数都在使用 SSL。我相信随着那些“拨号”号码已经迁移到基于互联网的拨号号码，即使是拨号号码也已经显着下降，但我并没有驱动 POS 终端能够肯定地确认这一点。

4) 单个模拟器平台可以完成很多这样的工作，因为获得 Base24、Postilion、Connex、SmartVista 的应用并不小。我们内部有 VISA 和 MasterCard 模拟器以及其他一些模拟器，而 VISA 和 MasterCard 将是我最后的选择，因为它们对终端主机的帮助最小。我要查看的可以在单个工作站上进行收单行、发卡行和处理器模拟的简短列表如下，它们都有自己的怪癖。

  • Paragon的FastTest
  • ACI Worldwide 的“资产”
  • Clear2Pay 的 Lexcel（最近被 FIS 购买）

5) 基于 EMV 的复杂性、细微差别、人才积压等，我认为如果不是更长的话，一年似乎是合理的。

于 2014-09-24T22:54:52.297 回答