Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Minimum knowledge for secure web payment

Minimum knowledge for secure web payment

安全なウェブ決済のために
最低限知っておいてほしいこと
WebPay meetup #1 2014/07/22

Yutaro Sugai

July 22, 2014
Tweet

More Decks by Yutaro Sugai

Other Decks in Technology

Transcript

  1. ҆શͳ΢ΣϒܾࡁͷͨΊʹ
    ࠷௿ݶ஌͓͍ͬͯͯ΄͍͜͠ͱ
    Yutaro Sugai
    @hokkai7go

    View Slide

  2. ϖΠʂ
    (ָ͠ΜͰ·͔͢)

    View Slide

  3. ҆શͳ΢ΣϒܾࡁͷͨΊʹ
    ࠷௿ݶ஌͓͍ͬͯͯ΄͍͜͠ͱ
    Yutaro Sugai
    @hokkai7go

    View Slide

  4. @hokkai7go
    !
    WebPay
    ɾαʔό܈ͷӡ༻
    ɾPCIDSSͳͲηΩϡϦςΟج४΁ͷ४ڌ
    !
    ݸਓ
    ɾ֤छRubyܥΧϯϑΝϨϯεͷϨϙʔτ൝
    ɾΔͼ·ฤू
    ɾChef࣮ફೖ໳ॻ͖·ͨ͠

    View Slide

  5. PCIDSS஌ͬͯ·͔͢ʁ

    View Slide

  6. PCIDSSͱ͸
    ΫϨδοτΧʔυ৘ใ࿙Ӯ๷ࢭͷ
    ͨΊͷࠃࡍηΩϡϦςΟج४
    ΫϨδοτΧʔυ৘ใΛऔΓѻ͏
    શͯͷࣄۀऀ΍αʔϏεϓϩόΠ
    μ͸ɺ͜ͷඪ४ʹ४ڌ͢Δඞཁ͕
    ͋Γ·͢ɻ(േଇͳ͠)

    View Slide

  7. PCIDSSͱ͸
    ܾࡁࣄۀऀ͚ͩͰͳ͘
    AWSͳͲͷαʔϏεϓϩόΠμ͕
    ४ڌ͢Δྫ͕૿͍͑ͯΔ

    View Slide

  8. Χʔυ൪߸࿙Ӯͷ
    ࡾେϦεΫϙΠϯτ

    View Slide

  9. ॲཧ ఻ૹ อଘ

    View Slide

  10. 4242#4242#4242#4242
    ఻ૹ

    View Slide

  11. 4242#4242#4242#4242
    ఻ૹ

    View Slide

  12. 4242#4242#4242#4242
    ఻ૹɾॲཧ

    View Slide

  13. 4242#4242#4242#4242
    อଘ

    View Slide

  14. ఻ૹ

    View Slide

  15. PCIDSS͸
    ఻ૹ࣌҉߸ԽΛཁٻ

    View Slide

  16. ”ΦʔϓϯͳެڞωοτϫʔΫܦ༝Ͱػີ
    ੑͷߴ͍ΧʔυձһσʔλΛ఻ૹ͢Δ৔
    ߹ɺҎԼͷΑ͏ͳɺڧྗͳ҉߸ԽͱηΩϡ
    ϦςΟϓϩτίϧʢSSL/TLSɺIPSECɺ
    SSHͳͲʣΛ࢖༻ͯ͠อޢ͢Δɻ”
    - PCIDSS ཁ݅ͱηΩϡϦςΟධՁखॱόʔδϣϯ3.0 ΑΓൈਮ

    View Slide

  17. ҉߸ԽͤͣʹΧʔυ൪߸
    ͷ఻ૹ͍ͯ͠·ͤΜ͔ʁ

    View Slide

  18. ੜͷΧʔυ൪߸ΛαʔόͰ
    ड͚ͱΓͨ͘ͳ͍Ͱ͢ΑͶ

    View Slide

  19. Έͳ͞Μ͕Χʔυ൪߸Λۃྗѻ
    Θͳ͍͍ͯ͘Α͏ʹɺτʔΫϯ
    ܾࡁͷ࢓૊ΈΛ༻ҙ͍ͯ͠·͢

    View Slide

  20. ɾΫϥΠΞϯταΠυτʔΫϯ
    ɾαʔόαΠυτʔΫϯ

    View Slide

  21. ΫϥΠΞϯταΠυτʔΫϯͷར఺
    ʮॲཧʯʮ఻ૹʯʮอଘʯͷ
    ͢΂ͯΛճආ͢Δ͜ͱ͕Ͱ͖·͢

    View Slide

  22. https://webpay.jp/docs/payments_with_token

    View Slide

  23. ΫϥΠΞϯταΠυτʔΫϯΛ࢖Θͳ͍
    ɾʮॲཧʯʮ఻ૹʯΛආ͚ΒΕͳ͍
    ɾੜͷΧʔυ൪߸Λѻ͏ϦεΫ
    ɹɾܦ࿏্ͷϩάʹΧʔυ൪߸࢒͍ͬͯ·ͤΜ͔ʁ
    ɹɾʮॲཧʯޙͷϝϞϦ͸҆શͰ͔͢ʁ

    View Slide

  24. ʮॲཧʯʮ఻ૹʯΛߦ͏͜ͱ͸ϦεΫͰ͢ɻ
    ΫϥΠΞϯταΠυτʔΫϯΛར༻ͯ͠
    ආ͚Δ͜ͱΛ͓͢͢Ί͠·͢ɻ

    View Slide

  25. ҆શͳ΢ΣϒܾࡁͷͨΊʹ
    ɾSSLͷ࢖༻(αΠτؙ͝ͱ or ࠷௿Ͱ΋ܾࡁϖʔδ)
    ɾద੾ͳΤϥʔϋϯυϦϯά
    ɾෆཁͳΧʔυ৘ใͷഁغ

    View Slide