blocks|key|2068572|text|基本上避免承担一切责任来保存你的CC详细信息，但是我可以假设你正在使用第三方服务来做你的交易，比如PayPal/Verisign或其他什么，他们中的大多数都有API让你在他们身边保存CC凭证，他们给你一个密钥，然后你可以用它来完成或启动交易，所以他们照顾到了困难的部分，而你所要做的就是将这个字符串密钥存储在你的数据库中。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2068573|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Basically avoid by all means taking the responsiblity to save the CC details on your side, however I can assume you are using a thirdparty service to do your transaction such as PayPal/Verisign or whatever, most of them have API's that enables you to save CC credentials at their side, and they give you back a key that you can then use later to complete or initiate transactions, so they take care of the hard part, while all what you have to do is store this string key in your DB.

blocks|key|1854720|text|如果你打算存储信用卡信息，你真的需要PCI兼容，否则你就是在自找麻烦。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1854721|话虽如此，请看SQL+Server+2005及更高版本中提供的单元级加密。巧合的是:)我最近在这里做了一个关于SQL+Server2005/2008加密的T-SQL示例的演示文稿：http://moss.bennettadelson.com/Lists/Events/Attachments/9/June2008.zip+(链接位置于2008年12月23日更新)|offset|length|1854722|entityMap|0|LINK|mutability|MUTABLE|url|http://moss.bennettadelson.com/Lists/Events/Attachments/9/June2008.zip^0|0|2I|1Y|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@$D|P|E|Q|1|R]]|A|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|M]]]]

If you are going to store credit card information you really need to be PCI compliant or you're just asking for trouble.

Having said that look at the cell level encryption available in SQL Server 2005 and above. Coincidentally :) I have recently given a presentation with T-SQL samples on encryption with SQL Server 2005/2008 available here: <a href="http://moss.bennettadelson.com/Lists/Events/Attachments/9/June2008.zip" rel="nofollow noreferrer">http://moss.bennettadelson.com/Lists/Events/Attachments/9/June2008.zip</a> (Link location updated December 23, 2008)

blocks|key|1854851|text|我不认为存储CVV信息实际上是违法的(从某种意义上说，它违反了任何法律)，但它确实违反了支付卡行业规则，他们可能会施加任何数量的不同制裁。因此，您的要求实际上可能导致您无法接受信用卡;-(|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1854852|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

I don't believe it's actually illegal to store CVV info (in the sense that it's against any law), but it does violate Payment Card Industry rules, and they could impose any number of different sanctions. So, your requirements could actually result in you not being able to accept credit cards ;-(

blocks|key|2068850|text|安德鲁，你需要了解PCI-DSS，这可不是个小任务。就我个人而言，我发现它非常模糊，但这是我所理解的。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2068851|首先，根据您描述的场景，我将尝试以全额授权该卡，然后如果失败，我将存储客户的信息(但不是持卡人数据)，以便有人可以联系用户。在我过去工作的地方，我们的一些客户只会收取1美元的费用，然后立即取消交易，只是为了确保卡是有效的。然后，他们将手动处理所有订单。|2068852|如果授权成功，则需要将号码存储在何处。然后，您需要的唯一数字是信用卡号码和交易代码(至少对于我使用过的每个网关)。|2068853|这个标准，我上次看过的时候，并不是专门针对加密算法的，而是明确指出它应该是目前不可破解的加密。|2068854|现在，您不能做的一件事是在授权之后存储CCV。我的理解是，你可以在授权之前存储它，但我永远不会让任何人把它写下来。基本上，你授权了这张卡，你最好把它擦掉。|2068855|这在这一点上并不违法，但如果你被钉住了，他们会把锤子砸到你身上。他们有权对你处以高额罚款，但他们通常所做的似乎是让你接受补救。如果你不遵守，我不知道会发生什么，因为我听说的每个人都照做了。但是他们真的会用显微镜把你的战利品放上去。|2068856|最终，我相信他们唯一能做的就是阻止你接受信用卡。与我合作过的大多数商家都非常害怕这一点。|2068857|entityMap|0|LINK|mutability|MUTABLE|url|https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml^0|9|7|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|X|8|@]|9|@$A|Y|B|Z|1|10]]|C|$]]|$1|D|3|E|5|6|7|11|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|12|8|@]|9|@]|C|$]]|$1|H|3|I|5|6|7|13|8|@]|9|@]|C|$]]|$1|J|3|K|5|6|7|14|8|@]|9|@]|C|$]]|$1|L|3|M|5|6|7|15|8|@]|9|@]|C|$]]|$1|N|3|O|5|6|7|16|8|@]|9|@]|C|$]]|$1|P|3|-4|5|6|7|17|8|@]|9|@]|C|$]]]|Q|$R|$5|S|T|U|C|$V|W]]]]

Andrew, you need to understand the <a href="https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml" rel="noreferrer">PCI-DSS</a>, no small task. Personally, I find it extremely vague but here is what I understand.

First off, from the scenario you describe I would attempt to authorize the card for the full amount and then if that failed I would store the customer's information (but not the cardholder data) so someone could contact the user. Where I use to work some of our customers would only charge $1.00 and then void the transaction immediately, just to make sure the card was valid. They would then process all orders manually. 

Where you will need to store the number is on a successful authorization. The only number you need then is the credit card number and the transaction code (at least with every gateway I have ever worked with).

The standard, last time I looked at it, is not specific on encryption algorithms but instead makes it clear it should be currently unbreakable encryption.

Now, one thing you cannot do is store the CCV subsequent to authorization. My understanding is that you can store it prior to authorization but I could never get anyone that would put that in writing. Basically, you authorize the card, you better wipe it.

And it is not illegal at this point but if you get nailed they will bring the hammer down on you. They have within their authority to level heavy fines against you, but it seems like what they usually do is put you in remediation. If you don't comply I don't know what happens because everyone I have heard this happening to complied. But then they really go up your booty with a microscope.

Ultimately, I believe their only stick they really have is to prevent you from accepting credit cards. Most merchants I have worked with were scared to death of exactly that.

blocks|key|2068926|text|要达到适当的合规性并能够做这样的事情，成本大约在3万美元左右。你最好使用第三方支付服务。就我个人而言，我推荐Element+Express，他们有一个绕过PCI-DSS+PAPDB兼容的“托管”解决方案。我不得不为我自己的应用程序转换为这个，甚至是销售点机器！这是一个很大的痛苦，但我们是一个小公司。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2068927|http://www.elementps.com/software-providers/our-security-edge/hosted-payments/PA-DSS-Certification-vs-Elements-Hosted-Payments/|offset|length|2068928|上面的链接提供了一些与合规相关的成本信息。我们有客户要求我们存储信用卡号码，但我们不会这样做，因为我们也可能被罚款。不太好。不要让自己承担责任。|2068929|编辑：|2068930|此外，如果您确实决定存储信用卡信息，您肯定需要考虑您将使用的加密形式。对称？不对称？|2068931|如果您使用对称加密(Passkey)，那么如果拥有密钥(加密所需的)的服务器(站点)以任何方式被泄露，那么您将面临一些严重的安全漏洞。记住，即使是编译过的代码也不会隐藏文本键。|2068932|如果使用非对称加密(公钥/私钥对)，则会遇到一些额外的问题，但如果主要面向公共的服务器受到攻击，它们将只拥有公钥，并且如果它们还访问您的数据库。他们就不能解密内容了。|2068933|那么问题是，您将私钥存储在哪里？在运行管理功能时，是否有人将其从本地计算机粘贴到..在桌面上运行一个单独的应用程序来查看订单等。|2068934|有很多事情需要考虑。|2068935|最后注意事项:使用支付网关(Element+Express、Authorize.NET、Paypal等)并且不要在本地存储任何信用卡信息。:P|2068936|以下是有关在C#中使用X509非对称加密的链接：http://www.csharpbydesign.com/2008/04/asymmetric-key-encryption-with.html|2068937|entityMap|0|LINK|mutability|MUTABLE|url|1|http://www.csharpbydesign.com/2008/04/asymmetric-key-encryption-with.html^0|0|0|3J|0|0|0|0|0|0|0|0|0|0|O|21|1|0^^$0|@$1|2|3|4|5|6|7|16|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|17|8|@]|9|@$D|18|E|19|1|1A]]|A|$]]|$1|F|3|G|5|6|7|1B|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|1C|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|1D|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|1E|8|@]|9|@]|A|$]]|$1|N|3|O|5|6|7|1F|8|@]|9|@]|A|$]]|$1|P|3|Q|5|6|7|1G|8|@]|9|@]|A|$]]|$1|R|3|S|5|6|7|1H|8|@]|9|@]|A|$]]|$1|T|3|U|5|6|7|1I|8|@]|9|@]|A|$]]|$1|V|3|W|5|6|7|1J|8|@]|9|@$D|1K|E|1L|1|1M]]|A|$]]|$1|X|3|-4|5|6|7|1N|8|@]|9|@]|A|$]]]|Y|$Z|$5|10|11|12|A|$13|C]]|14|$5|10|11|12|A|$13|15]]]]

It costs somewhere in the neighborhood of $30,000 to become properly compliant and to be able to do that kind of stuff. You are better off using a 3rd party payment service. Personally, I recommend Element Express, and they have a "Hosted" solution that bypasses the PCI-DSS PAPDB compliance. I've had to convert to this for my own applications, even a Point of Sale machine!!! It's a big pain, but we're a small company.

<a href="http://www.elementps.com/software-providers/our-security-edge/hosted-payments/PA-DSS-Certification-vs-Elements-Hosted-Payments/" rel="nofollow noreferrer">http://www.elementps.com/software-providers/our-security-edge/hosted-payments/PA-DSS-Certification-vs-Elements-Hosted-Payments/</a>

The above link has some good information about the costs associated with becoming compliant. We have had customers ask us to store credit card numbers, and we won't do it because we could be fined as well. Not good. Don't open yourself up to liability.

Edit:

Additionally, if you DO decide to store the credit card information you definitely need to consider the forms of encryption you are going to use. Symmetric ? Asymmetric ? 

If you do Symmetric encryption (Passkey) then you open yourself up to some serious security vulnerabilities if the server(site) that has the key (needed to encrypt) is compromised in any way. Remember, even compiled code won't hide a text key.

If you use Asymmetric encryption (public/private keypairs) then you run into some additional issues, but if the primary public facing server is compromised they will only have the public key, and if they also access your database.. they won't be able to decrpyt the contents.

The question then is, where do you store the private key ? Do you have someone paste it in from their local computers when running admin functions.. have a separate application that runs on the desktop to view orders, etc. 

There are a lot of things to take into consideration.

Final note: Use a payment gateway (Element Express, Authorize.NET, Paypal, etc.) and don't store any credit card info locally. :P

Here is a link about using X509 Asymmetric Encryption in C#: <a href="http://www.csharpbydesign.com/2008/04/asymmetric-key-encryption-with.html" rel="nofollow noreferrer">http://www.csharpbydesign.com/2008/04/asymmetric-key-encryption-with.html</a>

blocks|key|2069019|text|我有一篇关于在数据库中存储敏感数据的确切情况的博客文章。这篇博文使用了我使用Triple+DES算法构建的String+Encryptor类，但如果您愿意，也可以插入自己的类。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2069020|这篇博文包含了所使用的视频和源代码。你可以在http://www.wrightin.gs/2008/11/how-to-encryptdecrypt-sensitive-column-contents-in-nhibernateactive-record-video.html上查看。我想它一定会解决你的问题。|offset|length|2069021|entityMap|0|LINK|mutability|MUTABLE|url|http://www.wrightin.gs/2008/11/how-to-encryptdecrypt-sensitive-column-contents-in-nhibernateactive-record-video.html^0|0|M|38|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@$D|P|E|Q|1|R]]|A|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|M]]]]

I have a blog post that deals with this exact situation of storing sensitive data in the database. The blog post uses a String Encryptor class that I built using a Triple DES algorithm but you can plug in your own if you would like.

The blog post contains the video and source code that was used. You can check it out at <a href="http://www.wrightin.gs/2008/11/how-to-encryptdecrypt-sensitive-column-contents-in-nhibernateactive-record-video.html" rel="nofollow noreferrer">http://www.wrightin.gs/2008/11/how-to-encryptdecrypt-sensitive-column-contents-in-nhibernateactive-record-video.html</a>. I think it will definitely solve your issue.

I have a business requirement that forces me to store a customer's full credit card details (number, name, expiry date, CVV2) for a short period of time.

Rationale: If a customer calls to order a product and their credit card is declined on the spot you are likely to lose the sale. If you take their details, thank them for the transaction and then find that the card is declined, you can phone them back and they are more likely to find another way of paying for the product. If the credit card is accepted you clear the details from the order.

I cannot change this. The existing system stores the credit card details in clear text, and in the new system I am building to replace this I am clearly not going to replicate this!

My question, then, is how I can securely store a credit card for a short period of time. I obviously want some kind of encryption, but what's the best way to do this?

Environment: C#, WinForms, SQL-Server.

Storing credit card details

非对称加密

对称加密

SQL Server

数据库

服务器

我有一个业务需求，它迫使我在短时间内存储客户的完整信用卡详细信息(号码、姓名、到期日期、CVV2)。理由:如果客户打电话来订购产品，而他们的信用卡当场被拒绝，你很可能会失去这笔交易。如果你获取了他们的详细信息，感谢他们的交易，然后发现卡被拒绝了，你可以给他们回电话，他们更有可能找到另一种支付产品的方式。如果信用卡被接受...

问存储信用卡详细信息
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问存储信用卡详细信息EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问存储信用卡详细信息
EN