Transaction data signing

For more information about the transaction data signing mechanism, refer to the Mobile Authenticator Studio Product Guide.

Listing transactions to sign

With transaction data signing enabled, Mobile Authenticator Studio is able to retrieve a list of transactions on user demand, and sign each transaction locally. The signature is then sent back to a server for validation.

Listing pending transactions (overview)

Integrating transaction data signing involves the following steps:

1. The app submits an HTTP(S) request to the integrator back-end system. The request contains a one-time password (OTP) to authenticate the issuer.

2. The integrator validates the OTP.

3. On successful authentication, the list of pending transactions can be retrieved from the database.

4. The response that contains the transaction list is sent back to the app.

Transaction list request

The request sent by Mobile Authenticator Studio is configured in the TransactionList section of the configuration file:

The URL can use the HTTP POST or GET methods. For more information about URL customization, refer to the Mobile Authenticator Studio Customization Guide.

Transaction list response

The transaction content can be used for a standard transaction (i.e. with up to 8 data fields) or a Secure Channel transaction.

The response expected by Mobile Authenticator Studio must be formatted as described in the DTD:

1. <!ELEMENT DP4Mobile (Activation?,PendingTransactions?)>

2. <!ATTLIST DP4Mobile retCode CDATA #REQUIRED>

3. <!ATTLIST DP4Mobile message CDATA #REQUIRED>

4. <!ATTLIST DP4Mobile serverTime CDATA #IMPLIED>

6. <!ELEMENT PendingTransactions (Transaction*)>

8. <!ELEMENT Transaction (Item*)>

9. <!ATTLIST Transaction identifier CDATA #REQUIRED>

10. <!ATTLIST Transaction name CDATA #REQUIRED>

11. <!ATTLIST Transaction secureChannelMessage CDATA #IMPLIED>

13. <!ELEMENT Item EMPTY>

14. <!ATTLIST Item value CDATA #REQUIRED>

15. <!ATTLIST Item dtfIndex (1|2|3|4|5|6|7|8) #IMPLIED>

16. <!ATTLIST Item hidden (true|false) #IMPLIED>

17. <!ATTLIST Item align (left|right|center) #IMPLIED>

18. <!ATTLIST Item bold (true|false) #IMPLIED>

19. <!ATTLIST Item italic (true|false) #IMPLIED>

If the transaction content is used for a standard transaction, the secureChannelMessage attribute must be empty.

Example

<?xml version="1.0" encoding="UTF-8"?>
<DP4Mobile retCode="0" message="Operation Successful" >
  <PendingTransactions>
    <Transaction identifier="795ba1121281608b84a8000"
     name="Transaction 1">
      <Item value="Amount" bold="true" align="center" />
      <Item value="123" dtfIndex="1" />
      <Item value="" />
      <Item value="Destination" italic="true" />
      <Item value="456" dtfIndex="2" />
      <Item value="789" hidden="true" dtfIndex="3" />
    </Transaction>
    <Transaction identifier="3456426341316aec21ef0190"      name="Transaction 2" >
      <Item value="Amount" bold="true" align="center" />
      <Item value="111" dtfIndex="1" />
      <Item value="Destination" italic="true" />
      <Item value="222" dtfIndex="2" />
      <Item value="333" hidden="true" dtfIndex="3" />
    </Transaction>
  </PendingTransactions>
</DP4Mobile>

If the transaction content is used for a Secure Channel transaction, no item element must be present.

Example

<?xml version="1.0" encoding="UTF-8"?>
<DP4Mobile retCode="0" message="Operation Successful" >
  <PendingTransactions>
    <Transaction identifier="795ba1121281608b84a8000"      name="Transaction 1" secureChannelMessage="00C1C...E74AE" />
    <Transaction identifier="3456426341316aec21ef0190"      name="Transaction 2" secureChannelMessage="00C1C...E74AE" />
  </PendingTransactions>
</DP4Mobile>

Each transaction contains a list of items that will be displayed in the app. Each item has a number of attributes. For Secure Channel transactions, no item must be present.

Validating transactions

Internal transaction validation

Internal transaction validation (overview)

Once Mobile Authenticator Studio has signed the content of a transaction, it can manage the validation of the transaction inside the app by connecting to a web service. The web service must be able to validate the signature of a transaction identified by its unique transaction identifier.

The request sent by Mobile Authenticator Studio is configured in the TransactionValidation section of the configuration file:

The URL can use the HTTP POST or GET methods. For more information about URL customization, refer to the Mobile Authenticator Studio Customization Guide.

The response expected by Mobile Authenticator Studio must be formatted as described in the DTD:

1. <!ELEMENT DP4Mobile (Activation?,PendingTransactions?)>

2. <!ATTLIST DP4Mobile retCode CDATA #REQUIRED>

3. <!ATTLIST DP4Mobile message CDATA #REQUIRED>

4. <!ATTLIST DP4Mobile serverTime CDATA #IMPLIED>

5. <!ATTLIST DP4Mobile confirmationCode CDATA #IMPLIED>

Example

<?xml version="1.0" encoding="UTF-8"?>
<DP4Mobile retCode="0" message="Operation Successful"  confirmationCode="123456" >
  <PendingTransactions/>
</DP4Mobile>

A confirmation code attribute can be added to the response. It will be displayed by the app together with the message.

Rejecting transactions

Transaction rejection (overview)

The user can reject a transaction. When a transaction is rejected, no signature will be generated and the transaction will be removed from the list of pending transactions. Transaction rejection is managed by connecting to a web service.

The request sent by Mobile Authenticator Studio is configured for every TransactionDataSigningAction element of the configuration file:

The URL can use the HTTP POST or GET methods. For more information about URL customization, refer to the Mobile Authenticator Studio Customization Guide.

Transaction rejection is only available for Android and iOS.

The response expected by Mobile Authenticator Studio must be formatted as described in the DTD:

1. <!ELEMENT DP4Mobile (Activation?,PendingTransactions?)>

2. <!ATTLIST DP4Mobile retCode CDATA #REQUIRED>

3. <!ATTLIST DP4Mobile message CDATA #REQUIRED>

4. <!ATTLIST DP4Mobile serverTime CDATA #IMPLIED>

Example

<?xml version="1.0" encoding="UTF-8"?>
<DP4Mobile retCode="0" message="Operation Successful" >
  <PendingTransactions />
</DP4Mobile>

A confirmation code attribute can be added to the response. It will be displayed by the application along with the message.