« Cycling the payment application | Main | Real Systems Do Extracts - Part 1 »

Tuesday, July 25, 2006

ISO8583:2003 and jPOS

A jPOS Users list member asked how jPOS could be adapted to work with an implementation of the ISO8583 2003 standard.  Murtuza answered that "it should be a matter of creating a new packager defining the field formatter and using it, i.e., define it in XML and use the generic packager to load it for use."

Right.  The Generic Packager gets the "most bang for the buck" by adhering to the 1987 and 1993 standards, which are still the most prevalent ones in field use today.  [The three standards are 1987, 1993 and 2003.  Amongst large authorizers, American Express stands out by being one of the only ones to make the leap even from 1987 to 1993.]  jPOS' GenericPackager has 'out-of-the-box' XML files for the 87 and 93 versions.

Here's some info I put together to further flesh out Murtuza's answer:

In ISO8583:2003, for example, the STAN goes from six bytes to 12 bytes in length.

So, the Generic Packager contains this definition to begin with…

  <isofield
      id="11"
      length="6"
      name="SYSTEM TRACE AUDIT NUMBER"
      pad="true"
      class="org.jpos.iso.IFE_NUMERIC"/>

…and you’d change it to look like this:

  <isofield
      id="11"
      length="12"
      name="SYSTEM TRACE AUDIT NUMBER"
      pad="true"
      class="org.jpos.iso.IFE_NUMERIC"/>

Similarly, you’d make a sweep through the entire packager for all 128 fields (or at least the sub-set “in play” for you).

I’d recommend a ‘two-step sweep’ exercise:

  1. Go through the generic packager XML file provided with the jPOS download and adjust those items like the STAN as indicated.  [You can find a list of these changes in “Annex F” of the ISO8583:2003 spec provided by the International Standards Organization.] 
  2. Secondly, you’ll want to go through the spec provided by the authorizing organization (or gateway) to you (that’s assuming, of course, that your exercise is to put in place an ISO implementation created by someone else).  When you get into “private use” fields like 62 and 63, the Standards spec gives you only rough guidelines.  You’ll want to see what the authorizer/gateway has done in its implementation.  [Unfortunately, for most of those private use fields, the packager definition will only get you so far.  These private use fields typically have esoteric, proprietary table structures inside of an ‘IFE_LLLCHAR’ (or similar) construction.  In those cases, you’ll need some in-line code to complete the packaging and unpackaging tasks.]

Alejandro posted this follow-up (which provides more clarification on my previous sentence about the need for in-line code in some places): 

There's a twist with composite elements...some of them use standard TLV format and others (71, for example) use a bit-map format.  I believe that it may require the creation of a customized ISOFieldPackager in order to handle these.  I had to do something like that while implementing ANS X9.15 which uses five 32-bits maps.

[NOTE: 'TLV' here refers a 'Table, Length, Value' construction of field contents.]

Comments

Feed You can follow this conversation by subscribing to the comment feed for this post.

Hi somebody ...!
I have a problem need somebody helps : I'm using version 1.6.2 JPOS. how I have to using filed 35 ? ( format is ans )

Verify your Comment

Previewing your Comment

This is only a preview. Your comment has not yet been posted.

Working...
Your comment could not be posted. Error type:
Your comment has been posted. Post another comment

The letters and numbers you entered did not match the image. Please try again.

As a final step before posting your comment, enter the letters and numbers you see in the image below. This prevents automated programs from posting comments.

Having trouble reading this image? View an alternate.

Working...

Post a comment

My Photo

Tools

  • Google

    The entire web
    www.andyorrock.com
AddThis Social Bookmark Button

Resources

  • About Me
  • Dave Bergert's blog
    Insightful payment systems thoughts by my OLS colleague, Dave Bergert, CISSP, CISA, CompTIA Security+, and former Visa-certified QSA.
  • Glenbrook Partners' Blog List
    Glenbrook Partners has compiled "a current summary of the latest content from some of our favorite payments and banking blogs based upon their RSS feeds." Alejandro, Dave and I are on the list, as are many other good info sources.
  • jPOS
    Faced with payment systems challenges? Start here to learn more about Alejandro Revilla's jPOS project.
  • Randy San Nicolas' blog
    My OLS colleague Randy San Nicolas writes about his wealth of experience in various Issuer- and Acquirer-side endeavors in his Prepaid Enterprise blog.
  • soliSYSTEMS
    My friend Roque Solis is our go-to guy for RFID, smart cards, chip cards, integrated circuit(s) cards (ICC), HSMs, cryptographic accelerators, DES and public-key cryptography.
  • Specs Online - AMEX
    American Express (Amex) puts all its acquirer specs online for public retrieval.
  • Specs Online - First Data
    First Data Merchant Services (FDMS, aka 'FDR') puts all its acquirer specs online for public retrieval. [NOTE: FDMS' spec repository is accessible only via Internet Explorer; this link will not work with Firefox or other browsers.]
Blog Widget by LinkWithin

Enter your email address:

Delivered by FeedBurner

Blog powered by TypePad

If you're looking here...

  • Your attention to detail is a great asset. Use it wisely.