IBM Payment Registry Delivers a Certificate Authority to Promote More-Secure Credit Card Transactions over the Internet

Transcription

1 Software Announcement June 26, 2001 IBM Payment Registry Delivers a Certificate Authority to Promote More-Secure Credit Card Transactions over the Internet Overview The Payment products are an end-to-end suite of products that enable a more-secure commerce over the Internet and implement the SET Secure Electronic Transaction protocol. IBM Payment Registry for AIX, Version 2.1 program gives you the security of a certificate infrastructure needed to use the SET protocol for payment card transactions over the Internet. This release enhances the product with the addition of AIX Version support, DB2 Universal Database (UDB) Version 7.1 support, and installation support via an install wizard. This release also enhances the cryptography support by adding a software cryptography option, control of the certificate authorization signing keys, and private keys as Retain Key support in support of the cryptography hardware. IBM Payment Registry administers the necessary SET certificates. It can function as any Certificate Authority (CA) within the SET Trust Hierarchy: Root (RCA) Brand (BCA) Geopolitical (GCA) Payment Gateway (PCA) Merchant (MCA) Cardholder (CCA) It can be configured to operate either as a singular, CA type or as multiple, simultaneous CAs on the same server. It can simultaneously run as a stand-alone geopolitical certificate authority (GCA). IBM Payment Registry is available in two editions: The production edition is for the customer who will be issuing electronic certificates for a production system. This customer may issue an unlimited number of certificates. The development edition is for the customer who needs electronic certificates for the development and testing of a system. This customer may issue 20 certificates for use in this manner. These certificates are not for production usage. IBM Payment Registry supports online certificate requests using the SET Version 1.0 protocol for HTTP transmissions. Certificate issuance approval is accomplished through a customer-tailored interface permitting real-time or deferred approval processing. IBM Payment Registry consists of three distinct modules. The CA server module that issues and manages certificates, runs on the AIX platform. The Approver modules for viewing and approving and Administration modules for managing the overall Operation are accessed through a Java -based interface and can be run from AIX or Windows platforms. Key Prerequisites An RS/6000 workstation running AIX with 128 MB of RAM AIX Versions 4.3.3, or later DB/2 UDB Version 7.1 (either Workgroup Edition or Enterprise Edition) Java Developers Toolkit (JDK) Version 1.3, or later Optionally, IBM 4758 PCI Cryptographic Coprocessor Refer to the Hardware Requirements and Software Requirements sections for additional detail. At a Glance IBM Payment Registry benefits include: Extensive administration of SET certificates from creation, through: Distribution Management Revocation Extensive range of certificate authority capabilities including: Root Geopolitical Brand Payment Gateway Merchant Cardholder certificates Support for multiple certificate authorities Flexible, customized registration processing, deferred and online JAVA-based Administrator and Approver capabilities Available in two editions: Production Development and test For ordering, contact: Your IBM representative, an IBM Business Partner, or IBM Americas Call Centers at 800-IBM-CALL Reference: RE001 Planned Availability Dates: To insure IBM has adequate support available for customers installing this product, availability on June 29, 2001, will be restricted in some cases. Planned availability will be June 28, This announcement is provided for your information only. For additional information, contact your IBM representative, call 800-IBM-4YOU, or visit the IBM home page at: IBM United States IBM is a registered trademark of International Business Machines Corporation

2 Description The IBM Payment Registry product provides a certificate management infrastructure for cardholders, merchants, and payment gateways (acquirers) to facilitate secure payments over the Internet using SET protocols. Acquiring and issuing banks are able to deliver the critical element of authentication to their merchants, cardholders, and gateways. IBM Payment Registry enables the card issuer to issue certificates to their cardholders. IBM Payment Registry also enables acquirer organizations to issue certificates to their merchants to establish their identities within the SET structure. IBM Payment Registry is a program that runs on an AIX server to create and administer certificates for use with the SET protocol. Payment Registry can function as a: Root CA (RCA) Brand CA (BCA) Geopolitical CA (GCA) Cardholder CA (CCA) Merchant CA (MCA) Payment Gateway CA (PCA) In your implementation of IBM Payment Registry, you can operate several CAs (for example, a Cardholder CA and a Merchant CA) on separate machines. Or, you can configure a single server to act in more than one CA capacity. Payment Registry enables multiple CCAs, PCAs, and MCAs to run simultaneously on a single machine. Accessibility by People with Disabilities The following features support use by people with disabilities: Optional font enlargement and high-contrast display settings Screen readers and screen magnifiers tested for use by people with visual impairment Product Positioning The IBM Payment Registry is positioned as the product within the Payment product family with which the user creates the certificates, the base for SET security. It would be used by the credit card issuers, service providers, large retailers, and the credit card associations to create the certificates for the entire trust chain including cardholders, merchants, and payment gateways. Trademarks IBM Payment Registry is a trademark of International Business Machines Corporation in the United States or other countries or both. AIX, DB2 Universal Database, DB2, and RS/6000 are registered trademarks of International Business Machines Corporation in the United States or other countries or both. Windows is a registered trademark of Microsoft Corporation. Java is a trademark of Sun Microsystems, Inc. Other company, product, and service names may be trademarks or service marks of others

3 IBM US Announcement Supplemental Information June 26, 2001 Offering Information Product information is available through Offering Information (OITOOL) at: Publications The IBM Payment Registry User s Guide and Reference is available only on the distributed CD-ROM. No hardcopy publications are shipped with this program. Displayable Softcopy Publications: The IBM Payment Registry User s Guide and Reference manual is provided in PDF displayable softcopy form. The files are shipped on the same CD-ROM as the basic machine-readable material at no additional charge. The manual is in PDF format and can be displayed by the Adobe Acrobat Reader on any of its supported platforms. Terms and conditions for use of the machine-readable files are shipped with the files. Technical Information Hardware Requirements: These will vary depending on the number of users and registrations performed within a given time interval. The minimum system required is an RS/6000, with: 128 MB RAM 200 MB of hard disk space 192 MB paging space CD-ROM drive Optionally, the IBM 4758 PCI Cryptographic Coprocessor may be used for added security and performance. The Coprocessor should be ordered as Model 001 or Model 002, with Support Program feature (#4374 or #4958) and function-control vector features (#5200 and #5201), based on country import regulations. s 5200 and 5201 perform equivalent cryptography functions in support of the SET protocol. Refer to the 4758 ordering information for its requirements. (This coprocessor is a requirement for use within several of the card association hierarchies.) Note: This card requires a PCI bus on the RS/6000. Optionally, if the Java -based Administrator and Approver applications are to be run from Windows, an Intel-based (or compatible) central processing unit is required. The Registry library requires an additional 10 MB of free disk space for program files for these applications. Software Requirements Server Prerequisites AIX Version 4.3.3, or later DB2 UDB Version 7.1 (either Workgroup Edition or Enterprise Edition) Java Developer s Toolkit 1.3, or later Client Prerequisites Optionally, Windows 95, Windows 98, Windows Millennium, Windows NT 4.0, or Windows 2000 is required for users choosing to operate the Java-based Administrator, Approver, Configuration Wizard, and Setcertmgr GUI applications from these environments. If the Java-based Administrator and Approver applications are to be run from the AIX operating system, refer to the following Web site for prerequisite PTFs: Java Developer s Toolkit 1.3, or later DB2 is not required on the Windows Client Compatibility: The IBM Payment Registry Version 2.1 is upgradable from IBM Payment Registry Version 1.2. It will also interoperate with all keys and certificates generated using Version 1.2 of IBM Payment Registry. To upgrade from Version 1.0 of IBM Payment Registry, you must first upgrade to Version 1.2 of IBM Payment Registry. All keys and certificates generated using Version 1.0 of IBM Payment Registry are compatible with Version 2.1. The SET protocol for all versions of IBM Payment Registry is Version 1.1. Limitations: IBM Payment Registry for SET issues only SET-based digital certificates. It cannot issue X.509 or other standards-based certificates. Planning Information Customer Responsibilities: The customer must consider the installation, design, implementation, and maintenance of the Registry system. It is recommended Business Partners or IBM Global Services be used to assist in these activities, unless a very basic, non-card association implementation is planned. To implement a complete Registry system, a customer or Business Partner should have the following skills: Working knowledge of network administration skills for AIX Understanding of TCP/IP protocols including HTTP Experience with a World Wide Web browser, such as Netscape Navigator Experience in administering a World Wide Web server, such as the IBM HTTP Server This announcement is provided for your information only. For additional information, contact your IBM representative, call 800-IBM-4YOU, or visit the IBM home page at: IBM United States IBM is a registered trademark of International Business Machines Corporation

4 Understanding of relational database concepts Ability to perform basic SQL queries Programming skills for advanced customization Planning certificate hierarchy Additional planning and installation considerations may be found at: commerce/payment/support/reg/ Softcopy of the product publication may be downloaded from the following Web site: commerce/payment/lib.html Direct Customer Support: Direct customer support is provided by IBM Operational Support Services Support Line. This fee service enhances customers productivity by providing voice and electronic access into the IBM support organization. IBM Operational Support Services Support Line will help answer questions pertaining to usage, and suspected software defects for eligible products. Installation and technical support is provided by Global Services. For more information, call 800-IBM-4YOU ( ). Packaging: Payment Registry product packages are distributed with the following: IBM Payment Registry for AIX, One CD-ROM for the Payment Registry program and documentation One Proof of Entitlement One Memo to Licensee having introductory installation information IBM Payment Registry for AIX, Development Edition One CD-ROM for the Payment Registry program and documentation One Proof of Entitlement One Memo to Licensee having introductory installation information Security, Auditability, and Control IBM Payment Registry uses the security and auditability features of the AIX operating system. In addition, Payment Registry uses the SET Secure Electronic Transaction protocol, an industry-developed standard used to provide a more-secure payment card transaction over open networks such as the Internet. The customer is responsible for evaluation, selection, and implementation of security features, administrative procedures, and appropriate controls in application systems and communication facilities. Ordering Information IBM Payment Registry (the Production and Development Edition) is a server product that has a single charge unit, server install. These are available in a fixed order quantity of 1. IBM Payment Registry ( only) is available at an upgrade price for those customers currently licensed for the following qualifying program: IBM Payment Registry for AIX, Version 1. To insure IBM has adequate support available for customers installing this product, availability will be restricted in some cases. To order this product during limited availability, contact your IBM representative. OTC 1 Medium Description Number Number CD-ROM IBM Payment Registry for AIX IBM Payment Registry for AIX Development Edition 1 One-time charge To order the program package, specify the program number as 5765-E89, and feature numbers 9001 for asset registration, 5819 for the media, and 0002 for the billing. To order the Development Edition program package, specify the program number as 5765-E89, and feature numbers 9001 for asset registration, 5809 for the media, and 0001 for the billing. Upgrades OTC 1 Medium Description Number Number CD-ROM IBM Payment Registry Program Package Upgrade Per Server Install To order the program package via an upgrade, specify the program number as 5765-E89, and feature numbers 9001 for asset registration, 5819 for the media, and 0003 for the billing. To be eligible to purchase as an upgrade, you must have previously purchased IBM Payment Registry Version 1, program number 5697-C83. Customization Options: Select the appropriate feature numbers to customize your order with delivery options desired. These features can be specified on the initial or MES orders. Example: If publications are not desired for the initial order, specify feature number 3470 to ship media only. For future updates, specify feature number 3480 to ship media updates only. If, in the future, publication updates are required, order an MES to remove feature number 3480; then, the publications will ship with the next release of the program. Description Initial Shipments Number Ship media only (suppresses initial 3470 shipment of documentation)

5 Description Number Prices Update Shipments Ship Media updates only (suppresses 3480 update shipment of documentation) Expedite Shipments Local IBM office expedite 3445 (for IBM use only) Customer expedite process charge 3446 ($30 charge for each product) Expedite shipments will be processed to receive 72-hour delivery from the time IBM Software Delivery and Fulfillment (SDF) receives the order. SDF will then ship the order via overnight air transportation. Terms and Conditions Licensing: IBM International Program License Agreement (IPLA). Proofs of Entitlement are required for all authorized use. Limited Warranty: Yes Program Services: Available until June 30, 2003 Money-Back Guarantee: Two-month, money-back guarantee Copy and Use on Home/Portable Computer: No Volume Orders (IVO): Yes, contact your IBM representative. Passport Advantage Applies: No Passport Advantage Subscription Applies: No Upgrades: Customers can acquire upgrades up to the currently authorized level of use of the qualifying programs. Usage Restriction: Yes For the Development Edition of the product, you may create up to 20 electronic certificates only for exclusive use in the development and test environment. These certificates are not for use in production systems. IBM Operational Support Services Support Line: Yes AIX/UNIX Upgrade Protection Applies: No Entitled Upgrade for Current AIX/UNIX Upgrade Protection Licensees: No AS/400 Software Subscription Applies: No Variable Charges Apply: No Educational Allowance Available: Yes, a 15% education allowance applies to qualified education institution customers. OTC Description Number OTC IBM Payment Registry for 0002 $200,000 AIX IBM Payment Registry for ,000 AIX Development Edition Upgrade from IBM Payment ,000 Registry Version 1 to Payment Registry Version 2.1 Upgrades: Contact your sales channel for IBM Operational Support Services Support Line pricing information. Customer Financing: IBM Global Financing offers attractive financing to credit-qualified commercial and government customers and Business Partners in more than 40 countries. IBM Global Financing is provided by the IBM Credit Corporation in the United States. Offerings, rates, terms, and availability may vary by country. Contact your local IBM Global Financing organization. Country organizations are listed on the Web at: Order Now Use Priority/Reference Code: RE001 Phone: Fax: Internet: Mail: 800-IBM-CALL 800-2IBM-FAX ibm direct@us.ibm.com IBM Atlanta Sales Center Dept. RE001 P.O. Box 2690 Atlanta, GA You can also contact your local IBM Business Partner or IBM representative. To identify them, call 800-IBM-4YOU. Note: Shipments will begin after the planned availability date. Trademarks IBM Payment Registry is a trademark of International Business Machines Corporation in the United States or other countries or both. RS/6000, AIX, and AS/400 are registered trademarks of International Business Machines Corporation in the United States or other countries or both. Windows and Windows NT are registered trademarks of Microsoft Corporation. Java is a trademark of Sun Microsystems, Inc. UNIX is a registered trademark is a registered trademark of the Open Company in the United States and other countries. Other company, product, and service names may be trademarks or service marks of others