编写在线支付处理系统
我们被要求创建一个在线支付处理系统，例如 Paypal，供我们全国使用。
是否存在开源版本？ （这样我就可以研究它，也许可以改进它）
是否有任何有用的书籍/资源/材料？
如此艰巨的任务我该如何承担呢？
We've been requested to create an Online payment processing system the like of Paypal for our national use.
does an open source version of this exist ? (so I could study it and maybe improve on it)
are there any books/resources/materials that could be useful ?
How can I go about taking on such a huge task ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
首先确定谁将处理您的信用卡交易，因为他们很可能也可以处理借记卡交易。
自己处理这些是很痛苦的，因为必须满足一些标准，而且您最终需要为这种特权付费。除非您要处理大量交易，否则最好使用另一家已经可以处理这些交易的公司。
首先，只需使用 Payflow 之类的东西设计系统，以进行实际处理。
一旦您启动并运行，并且您已经处理了 PCI 标准来保护信用卡数据，那么您可以考虑尝试逐步淘汰您的支付网关并自己完成，但是，只有当您确定您处理量足够大，需要额外的开发和资源成本才能自行处理。
您需要拥有签名证书，以确保人们您的网站是安全的，并确保您有强大的加密技术来保护信用卡数据，并确保密码或对称密钥不在计算机上，而是保存在计算机上仅存在于永远不会交换到硬盘驱动器的内存中，否则如果有人可以复制硬盘驱动器，他们就可以窃取它。
http://www.allbusiness.com/销售/互联网电子商务安全交易/2310-1.html
To start with first determine who is going to process your credit card transactions, as they can also most likely do debit cards.
To process these yourself is a pain as there are standards that have to be met, and you end up needing to pay for the privilege. Unless you will be processing an enormous amount of transactions you are better off using another company that already can process them.
To start with, just design the system using something like Payflow, to do the actual processing.
Once you are up and running, and you have dealt with the PCI standards to protect credit card data, then you can look at perhaps trying to phase out your payment gateway and do it yourself, but, that should only be if you determine that you are processing in sufficient volume that it is with the additional development and resource costs to do it yourself.
You will need to have a signed certificate, to ensure people that your site is safe, and ensure that you have strong encryption to protect the credit card data, and make certain that the passphrase or symmetric key is not on the computer, but is kept only in memory that will never be swapped to a hard drive, otherwise someone could steal it, if they can copy the hard drive.
http://www.allbusiness.com/sales/internet-e-commerce-securelectronic-transaction/2310-1.html
首先，您需要对您所在国家/地区在法律方面处理资金的方式（增值税、退款等）有扎实的了解，因此如果您告诉我们这一点可能会有所帮助。
其次，这不是产品，而是服务，因此您需要员工来支持您的用户。您还需要进行交易来处理信用卡、电子支票等。由于您可能要处理大量资金，因此您还需要财务和法律建议（请阅读此 E-Gold 声明 和 维基百科条目）。您还需要非常认真地对待安全性，无论是虚拟的还是物理的，因此您需要与多个不同的团队签约来独立分析和审核您的系统。
这确实是一个广泛的问题，我建议您阅读有关 PayPal 和其他处理系统的所有维基百科条目，然后更详细地解释您的确切问题（尽管您可能真的想保守一些东西，因为这是一个公共可访问网站）。
Well, first of you need to have solid knowledge the way your country handles money in terms of laws (VAT, refunds, and so on) so it might be help if you tell us that.
Second, this is not a product it's a service so you need a staff to support your users. You also need to make deals to process credit cards, e-checks and so on. And since you're dealing with possibly large amounts of money, you also need to financial and law advice (read this E-Gold statement and the Wikipedia entry). You also need to take security very seriously, both virtual and physical, so you'll need to contract several different teams to independently analyze and audit your system.
This is really a broad question, I'd suggest you read all the Wikipedia entries about PayPal and other processing systems and then explain your exact problem in a little more detail (though you might really want to keep some stuff secret, since this is a public accessible website).
给 @James Black 和 @eyze 分别+1 以获取他们的答案。这不是一项小任务，除非您所工作的公司已经以某种方式隶属于信用处理网络，否则您将面临大量工作和大量合规问题。他们的回答已经足够好了，我没有太多要补充的，但我想补充一点。
我们考虑与一家已经从事信用卡交易授权业务的公司合作，但他们主要使用 POS 系统和终端，而不是作为互联网网关。我们希望继续使用它们来处理网站付款，因为我们将它们用于我们的商店。从本质上讲，由于它们不能充当互联网支付网关，因此我们需要在后台使用它们编写自己的支付网关。经过数周的研究，我们得出的结论是，尽管这在技术上是我们的能力范围内的，而且尽管我们了解 PCI 和其他适用标准，但这最好还是留给以此为主要业务的公司来做。我们将使用预先存在的网关之一。
另外，回答您的具体问题：
我不相信任何开源存在。进行信用卡处理的主干网络非常敏感，并且是攻击者的目标，因此非常需要限制如何在需要知道的基础上处理卡的知识。 （我记不清有多少份保密协议只是为了研究这个想法而提供的。）
出于同样的原因，我怀疑你会在书籍等方面找到很多东西。
如果你正在与一家已经处理卡片的公司合作，那么你就领先了一步，但如果你想闯入该业务你将面临巨大的障碍。
+1 each to @James Black and @eyze for their answers. This is not a minor undertaking, and unless you work for a company that is already affiliated with the credit processing network in some way, you're in for a lot of work and a lot of compliance issues. Their answers were good enough that I don't have a lot to add, but I would like to add this.
We looked at working with a company that already is in the business of authorizing credit card transactions, but they work primarily with POS systems and terminals, rather than as an Internet gateway. We wanted to stick with them for processing web site payments, since we use them for our stores. In essence, since they didn't function as an Internet payment gateway, we would need to write our own payment gateway using them in the background. After weeks of research, we came to the conclusion that even though this was technicially within our capability, and even though we have the knowledge of PCI and other applicable standards that this is something best left to companies that do this as their primary business. We'll be going with one of the pre-existing gateways.
Also, to answer your specific questions:
I do not believe anything open source exists. The backbone on which credit card processing is done is so sensitive and such a target for attackers that there is a very real need to limit the knowledge of how to process cards on a need-to-know basis. (I lost count of the number of non-disclosure agrements I was presented with just to research the idea.)
For the same reason, I doubt you will find much in the way of books, etc.
If you're working with a company that already processes cards, then you're a step ahead, but if you're trying to break into the business you are going to face huge hurdles.
我认为你的老师希望你学习如何计划，而不是如何复制，所以不要寻找参考实现，而是学习如何思考问题。
解决任何大问题的技巧是将其分解为小问题。
所以就这样做吧。
您将还想考虑测试它，并确保它提供您需要的所有功能。
一旦你开始用手中的铅笔和纸思考问题，它就会变得非常容易，恕我直言:)
I'd think your teachers want you to learn how to plan, not how to copy, so don't look for a reference implementation, instead learn how to think about a problem.
The trick to solving any large problem is breaking it down into small problems.
So do this.
You will also want to consider testing it, and making sure it delivers all the functionality you need.
Once you start thinking about a problem with a pencil and paper in your hand, it becomes very easy, IMHO :)