使用令牌替换信用卡数据的透明代理以避免 PCI DSS 范围
我负责公司的 PCI DSS 合规性工作。经过一番研究，我发现存储任何信用卡数据根本不是一个好主意，因为这会使事情变得更加复杂。
我发现一家支付提供商提供安全数据保险库和令牌化解决方案。由于我不想审核大型解决方案的所有子模块， 我考虑过编写一个透明代理服务器来代替信用卡 （通过正则表达式找到它）并将其替换为令牌，只要我想将信用卡发送给第三方，我就通过代理发送它，代理将令牌更改回信用卡。这应该会减少安全编码要求，包括对代理的代码审核，因为所有其他代码都会受到令牌的影响。
我使用 ASP.NET MVC / Webforms 和 WCF。完成这样的事情的最佳方法是什么？我考虑编写一个 HttpFilter / ISAPI 来完成这项工作。
也许已经有这样的产品了？这个想法有道理吗？
I work on the PCI DSS compliance of my company. After some research, i found out it is no good idea to store any credit card data at all, as this makes things far more complex.
I found a payment provider providing a secure data vault in combination with a tokenization solution. As i dont want to audit all sub modules of a large solution,
i thaught about writing a transparent proxy server which replaces the credit card
(finding it via a regular expression) and replacing it with a token, as soon i want to send the credit card to a third party, i send it through the proxy and the proxy changes the token back to the credit card. this should reduce the secure coding requirements, including code audits to the proxy, as all other code is just getting hit with the token.
I use ASP.NET MVC / Webforms and WCF. What is the best way to get something like this done? I thaugt about writing a HttpFilter / ISAPI to do this job.
Maybe there is already a product like this? Does this idea make sense at all?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我会警告不要采取这种方法。
1) 捕获所有可能的 CC 的正则表达式可能太复杂，或者可能不适用于某些情况（破折号、空格、点、CC 编号中的错误）。
2) 对于看起来像 CC 编号但实际上不是的数据（尤其是二进制数据），您可能会发现误报
3) 您可能无法发现输入错误的 CC 号码
4）“感觉”不对，
我建议您的支付处理器更进一步，找到一个不仅提供 PCI 兼容且符合 PCI 标准的支付处理器。令牌化的 CC 存储空间，也是您在捕获用户的 CC 详细信息时重定向到的 CC 捕获页面。这样你的应用程序就不需要做任何事情
I would caution against such an approach.
1) regex to catch all possible CC's maybe too complex or may not work for certain situations (dashes, spaces, dots, errors in the CC numbers).
2) you may catch false positives for data that looks like a CC number but isn't (especially binary data)
3) you may not be able to catch mis-typed CC numbers
4) It "feels" wrong
I would suggest going one step further with your payment processor and finding one that not only offers a PCI-compliant & tokenized CC storage space, but also a CC-capture page to which you redirect to, when it comes time to capture CC details from the user. This way your apps do not have to do anything
您可能想研究一下 Authorize.Net 的客户信息管理器 (CIM) API 之类的东西，它允许您创建存储在 Authorize.Net 服务器上的付款配置文件，并在将来使用配置文件 ID（又名令牌）对其进行收费。
You may w3ant to look into something like Authorize.Net's Customer Information Manager (CIM) API which allows you to create payment profiles which are stored on Authorize.Net's servers and charge against them at a future date using a profile ID (a.k.a. token).
PCI 安全标准委员会发布了代币化指南。您可以在这里找到它：https://www.pcisecuritystandards.org/documents/Tokenization_Guidelines_Info_Supplement.pdf
值得注意的是（无论如何你似乎都知道），虽然你可以使用标记化来减少 PCI 的影响，但不太可能删除所有您的系统必须遵守至少标记化代理将在范围内。
The PCI Security Standards Council have released a guideline on tokenization. You can find it here: https://www.pcisecuritystandards.org/documents/Tokenization_Guidelines_Info_Supplement.pdf
It's important to note (as it seems like you know anyway) that while you can use tokenization to reduce the impact of PCI, it's unlikely to remove all of your systems from having to comply as at least the tokenization proxy will be in scope.