Me yasa Manhajar Shirin Aminci ta Kasance Kan Kayan Aikin POS da Aka Rufe?

Shirin aminci ya gaza a tashar POS saboda dalili ɗaya fiye da kowane: kayan aikin ba a taɓa gina su don barin software na waje ya shigo ba. Dillalai suna siyan dandamalin aminci, sanya hannu kan kwangilar, suna tsara kasafin kuɗin ƙaddamar da su - sannan su gano tsarin aiki na tashar, SDK, ko takardar shaidar biyan kuɗi suna toshe haɗin kai gaba ɗaya. Wannan ba matsalar software ba ce. Matsalar tsarin kayan aiki ce, kuma tana bayyana kusan duk lokacin da ɗan kasuwa ya yi ƙoƙarin ɗaure tsarin pos tare da aikin shirin aminci a kan tashar da aka tsara a matsayin na'urar biyan kuɗi ta rufe maimakon na'urar kwamfuta mai buɗewa.
Kafin a tantance kowace irin dandamali, yana taimakawa wajen daidaita lamarin Tambayar asali game da abin da tashar POS za ta iya yi da abin da ba za ta iya yi da bayanan lada ba — domin amsar ta dogara ne gaba ɗaya akan kayan aikin da ke ƙarƙashinsa, ba jerin abubuwan da software ɗin aminci ke amfani da su ba.
Wannan labarin ya bayyana takamaiman dalilan fasaha na tsarin pos na haɗin kai na aminci da ya gaza akan kayan aikin da aka kulle, abin da "kulle-ƙasa" ke nufi a matakin OS da takaddun shaida, da kuma yadda jerin kimantawa yake kama ga 'yan kasuwa waɗanda ke buƙatar tsarin pos na amincin abokin ciniki wanda ke aiki a zahiri a samarwa.

1. Menene Ma'anar "Kayan aikin POS da aka kulle" a zahiri

Kayan aikin POS da aka kulle tashar tashoshi ne inda masana'anta ke iyakance waɗanne aikace-aikace za su iya gudana, waɗanne albarkatun tsarin waɗannan aikace-aikacen za su iya shiga, ko duka biyun. Wannan zaɓi ne na ƙira da aka yi da gangan, ba lahani ba. Tashoshin da aka gabatar da katin gargajiya - na'urorin tebur da aka gina musamman don ma'amaloli na EMV da PIN - an ba su takardar shaida bisa ga ƙa'idodin PCI PTS POI waɗanda ke ɗaukar na'urar gaba ɗaya a matsayin muhallin biyan kuɗi guda ɗaya mai aminci. Ƙara manhajar aminci zuwa wannan yanayin a tarihi yana nufin ƙara hanyar lambar da ba a tabbatar ba kusa da bayanan mai katin, wanda alamun biyan kuɗi da masu siye ba sa yarda da su.
Halayen kayan aiki guda uku suna bayyana tashar da aka kulle:

• ● Tsarin aiki mai rufewa ko kuma wanda aka takaita sosai ba tare da shagon manhaja ba kuma babu hanyar lodawa ta gefe.
• ● Babu SDK da aka buga, ko SDK da aka iyakance ga tsarin rasit da kiran da aka yi amfani da su a zahiri.
• ● Tsarin firmware na aikace-aikace guda ɗaya, inda manhajar biyan kuɗi ita ce kawai manhajar da na'urar ke aiki da ita.

Babu ɗaya daga cikin waɗannan halaye da ya kasance ba daidai ba. An ƙera tashoshin samar da katin da aka keɓe daga tsoffin dillalai ta wannan hanyar musamman don rage girman binciken PCI DSS. Matsalar tana bayyana ne kawai lokacin da ɗan kasuwa ke tsammanin wannan tashar za ta gudanar da pos tare da tsarin shirin aminci, daidaitawar CRM, ko aikace-aikacen tallan - ƙwarewar da kayan aikin ba a taɓa ba da takardar shaida ko ƙera su don tallafawa ba.

2. Dalilin da yasa Manhajar Aminci ke Karya Tsarin POS da aka Rufe

Haɗin kai na aminci ya gaza a tsarin gine-gine masu rufewa saboda dalilai uku na fasaha da ke maimaitawa: ƙa'idodin sandboxing suna iyakance damar shiga bayanai, shigar da toshewar SDKs na mallakar kamfani, da kuma sake fasalin fasalin firmware.

2.1 Dokokin Sandboxing na PCI PTS Suna Ƙuntata Samun Bayanai ga Wasu

Sigar PCI PTS POI 7.0, wadda Majalisar Ka'idojin Tsaro ta PCI ta buga, yanzu tana ba da damar aikace-aikacen ɓangare na uku kamar manhajojin shagon app don gudana akan na'urorin POI masu takardar shaida. Amma ƙa'idar ta buƙaci waɗannan aikace-aikacen su kasance masu inganci. an ware shi cikin aminci daga ayyukan biyan kuɗi masu mahimmanci kuma an tabbatar da shi ta amfani da sarrafa sirri. Sabuwar buƙata a cikin wannan sigar tana toshe aikace-aikacen ɓangare na uku daga karanta bayanan PAN ko PIN na cleartext ko da aikace-aikacen yana kan jerin fararen da aka amince da su. Ga injin aminci, wannan yana da mahimmanci kai tsaye: duk wani tsarin haɗin gwiwa wanda ke ɗauka cewa aikace-aikacen aminci zai iya karanta jimlar ciniki, alamar katin, ko kuma mai gano abokin ciniki kai tsaye daga tsarin biyan kuɗi bai dace da na'urar da aka tabbatar da v7.0 ba. Dole ne manhajar aminci ta karɓi wannan bayanan ta hanyar tashar da aka amince da ita, wacce aka keɓe - kuma a kan tashoshi da yawa da aka kulle, babu irin wannan tashar.

2.2 Shigar da Kayayyakin SDK na Musamman Don Toshe Manhajar Amincin 'Yan Kasa

Dandalin aminci yana buƙatar yin rijistar abokan ciniki, duba ma'aunin maki, amfani da fansa, da kuma bugawa ko nuna lada a wurin sayarwa. Kowanne daga cikin waɗannan ayyukan yana buƙatar haɗin SDK. Tashoshin da ke da tsarin aiki na rufewa, na dillali-mallaka galibi suna fallasa babu ɗayan waɗannan haɗin ga masu haɓaka waje - mai siyarwar aminci yana haɗuwa ta hanyar hanyar haɗin yanar gizo bayan ciniki ya riga ya rufe, wanda ya yi latti don amfani da rangwame na ainihin lokaci ko haifar da lada a cikin zaman. Wannan shine tsarin gazawar da aka fi sani da 'yan kasuwa da ke ƙaura daga tsoffin tashoshin tebur zuwa shirye-shiryen aminci na pos: haɗin kai a zahiri yana "aiki" azaman daidaitawa bayan ciniki, amma ba zai iya yin komai a wurin hulɗa da kansa ba.

2.3 Zagaye na Sabunta Firmware Yana Kashe Gabatarwar Sifofin Aminci

Ko da inda tashar da aka kulle ta fallasa ƙarancin SDK, firmware akan na'urorin biyan kuɗi na manufa ɗaya yawanci ana sabunta shi akan jadawalin jinkiri, wanda ke da takaddun shaida, tunda kowane canjin firmware na iya haifar da sake tabbatar da PCI. Mai siyarwa mai aminci wanda ke son aika sabuwar ƙa'idar fansa, sabuwar kwararar rajista, ko sabon matakin lada dole ne ya jira zagayowar sakin mai siyar da kayan aiki - ba nasu ba. A kan tashar POS ta Android da aka buɗe, app ɗin aminci yana sabuntawa daban-daban ta hanyar fakitin app ɗinsa, ba tare da dogaro da firmware na tashar ba kwata-kwata.

3. Ainihin Kudirin Haɗakar Aminci da Ta Kasa

Farashin kai tsaye na haɗakar da ta gaza ya tsaya cak ko kuma ya koma baya, amma babban farashi yana da mahimmanci: dillalai suna ci gaba da siyan software na aminci a ƙimar girma yayin da daidaiton kayan aiki ya ci gaba da kasancewa a baya. Kasuwar kula da aminci ta duniya ta kai kimanin dala biliyan 17.38 a shekarar 2026, kuma ana hasashen zai girma a ƙimar hadadden shekara-shekara sama da kashi 14% zuwa 2034. Kowace dala da aka kashe akan dandamalin aminci wanda ba zai iya aiki akan kayan aikin biyan kuɗi ba dala ɗaya ce da aka kashe sau biyu - sau ɗaya akan software, kuma sake akan sabunta kayan aiki wanda yakamata ya faru da farko.
Akwai kuma kuɗin bin ƙa'ida. Shirye-shiryen aminci suna tattarawa da sarrafa bayanan abokin ciniki na sirri - sunaye, lambobin waya, tarihin siye, wani lokacin bayanan rajista na biometric don shirye-shiryen danna-don-asali. A ƙarƙashin Dokar Tarayyar Turai 2016/679 (GDPR), cewa aiwatarwa yana buƙatar tushen doka da aka rubuta da kuma kwararar izini mai bin doka a lokacin yin rajista. Haɗin kai na aminci da aka tilasta ta hanyar hanyar magance matsalar da ba ta bisa ƙa'ida ba - tashar jailbroken, APK mai gefe mara tallafi, gadar goge allo - yana sa wannan takaddun bin ƙa'ida ya fi wahalar samarwa yayin binciken, saboda hanyar bayanai da kanta ba a taɓa tsara ta don a sake duba ta ba.

4. Yadda Tsarin POS Mai Buɗaɗɗen Bayani Yake, Mai Shiryayye da Aminci

Tsarin gine-gine wanda ke tallafawa aminci cikin aminci yana da halaye uku: buɗewar SDK, rarraba software na matakin shagon aikace-aikace, da fasalulluka na asali na kayan aiki waɗanda suka wuce jujjuyawar kati.

4.1 Buɗe SDK da API Shiga

Tashoshin POS na Android tare da SDK da aka buga suna barin mai siyar da aminci ya gina kai tsaye akan APIs da aka rubuta don firinta, na'urar daukar hoto, nunin da ke fuskantar abokin ciniki, da kuma kernel na biyan kuɗi - ba tare da jiran mai ƙera kayan aiki don kowane sabon fasali ba. Wannan shine tsarin dandamali iri ɗaya da Square's Terminal API ya gabatar don kayan aikin sa, kuma yanzu shine aikin da aka saba yi a yawancin masana'antun Android POS waɗanda ke siyarwa zuwa yanayin dillalai masu siyarwa da yawa maimakon rufe kiosks na aikace-aikace ɗaya. 'Yan kasuwa suna samo kayan aiki kai tsaye daga tushen wadata - gami da Tsarin B2B na masana'antun tashoshin POS na China — ya kamata a ɗauki buɗewar SDK a matsayin matattarar siye, ba wai tunani bayan an yi magana a kai ba sai bayan an sanya hannu kan kwangilar.

4.2 Takaddun Shaida na GMS da Daidaitawar Shagon Manhaja

Takaddun shaida na Google Mobile Services (GMS) yana bawa tashar damar gudanar da fakitin manhajojin Android na yau da kullun ta hanyar Play Store ko shagon manhajojin da aka sarrafa daidai, maimakon iyakance na'urar zuwa manhajojin da aka haɗa da firmware. Tashar da aka amince da GMS za ta iya shigar da manhajar aminci kamar yadda waya ke shigar da kowace manhaja: daban-daban, bisa jadawalin sakin mai siyarwa, ba tare da zagayowar sake tabbatar da ingancin firmware ba.

4.3 Rijistar Amincin Halitta

Ƙaramin tsarin tashoshi masu tasowa yana faɗaɗa tantance aminci fiye da katunan da lambobin waya zuwa rajistar biometric. Ganewar jijiyoyin hannu misali ne ɗaya da ya riga ya kasance a cikin tsarin kasuwanci - ZCS yana ɗaya daga cikin masana'antun Android POS waɗanda ke jigilar tashoshi masu amfani da jijiyoyin hannu tare da SDK mai buɗewa, wanda ke ba da damar dandamalin aminci ya yi rijistar tsarin jijiyoyin hannu na abokin ciniki a matsayin madadin mai ganowa a lokacin biyan kuɗi maimakon buƙatar kati, app, ko neman lambar waya. Wannan nau'in fasalin asalin kayan aiki ana iya amfani da shi ne kawai ta dandamalin aminci lokacin da SDK na tashar ya fallasa shi a matsayin API mai takardu - wanda shine ainihin buƙatar tsarin buɗewa da aka bayyana a sama, ba fasali na musamman ga kowace alama ba.

5. Jerin Abubuwan da Za A Yi Nazari: Shin Amincin POS ɗinku Ya Shirya?

Kafin sanya hannu kan kwangilar software na aminci, tabbatar da waɗannan a gefen ƙarshe:

• ● Tashar jiragen ruwa tana ɗauke da SDK da aka buga, wanda aka rubuta da takardu - ba wai kawai hanyar biyan kuɗi ba.
• ● Tashar tana da takardar shaidar GMS kuma tana goyan bayan shigarwa da sabuntawa na manhaja mai zaman kanta.
• ● Mai ƙera zai iya tabbatar da bin ƙa'idodin PCI PTS POI ga duk wani aikin sandboxing na ɓangare na uku, wanda ya dace da buƙatun keɓewa a cikin sigar PTS POI ta yanzu.
• ● Mai sayar da aminci zai iya kiran sunan wani mai siyar da kaya kai tsaye wanda ke gudanar da ainihin samfurin tashar, ba kawai alamar tashar ba.
• ● An rubuta bayanan fitowar firmware na mai sayar da kayan aiki kuma baya toshe sabuntawar matakin aikace-aikace masu zaman kansu daga mai sayar da aminci.

An rufe sharuɗɗan zaɓin tashar - buɗewar OS, iyakokin takaddun shaida, zurfin SDK - dalla-dalla a cikin Cikakken tsarinmu don zaɓar dandamalin Android POS, wanda ke tafiya ta cikin irin wannan dabarar kimantawa fiye da shari'o'in amfani da aminci kawai.

6. Tambayoyi akai-akai

T1: Shin kowace tashar POS za ta iya gudanar da shirin aminci?

A'a. Tashar tana buƙatar SDK mai buɗewa, rarraba software na matakin shagon app, da kuma sandboxing mai bin PCI PTS don aikace-aikacen ɓangare na uku. Tashoshin rufewa, aikace-aikace guda ɗaya suna iyakance ko toshe software na aminci gaba ɗaya, ba tare da la'akari da abin da dandamalin mai siyar da aminci ke tallafawa akan takarda ba.
T2: Me ke sa tashar POS ta "kulle"?

Tashar da aka kulle tana takaita aikace-aikacen da za a iya shigarwa, tana fallasa babu SDK na jama'a, kuma tana gudanar da firmware da aka gina a kusa da aikace-aikacen biyan kuɗi guda ɗaya. Waɗannan halaye suna rage girman binciken PCI amma kuma suna toshe aikace-aikacen aminci, daidaitawar CRM, da sauran haɗin gwiwa na ɓangare na uku ta hanyar ƙira.
T3: Shin bin ƙa'idodin PCI yana hana aikace-aikacen aminci aiki akan kayan aikin POS?

Ba ta hanyar tsoho ba. PCI PTS POI v7.0 yana ba da damar aikace-aikacen ɓangare na uku, gami da manhajojin aminci, muddin an sanya su a cikin akwatin yashi daga katin biyan kuɗi na cleartext da bayanan PIN. Biyayya tana buƙatar warewa, ba warewa ba, kuma tsarin tashar yana tantance ko warewa zai yiwu a zahiri.
T4: Menene bambanci tsakanin daidaitawar aminci bayan ciniki da haɗin kai na ainihin lokaci?

Daidaita bayan ciniki yana amfani da lada bayan an rufe siyarwar, ta hanyar hanyar haɗin yanar gizo ta hanyar biyan kuɗi. Haɗin kai na ainihin lokaci yana amfani da lada yayin biyan kuɗi, ta hanyar haɗin SDK. Tashoshin da aka kulle galibi suna tallafawa na farko ne kawai, wanda ke hana rangwamen da fansa a cikin zaman.
T5: Za a iya amfani da tantancewar biometric, kamar jijiyoyin hannu, don yin rijistar aminci?

Eh, a kan tashoshi inda masana'anta ke fallasa kamawar biometric ta hanyar SDK mai takardu. Jikin hannu da makamantan abubuwan gano biometric suna ba da damar dandamalin aminci ya gane abokin ciniki da ya dawo ba tare da kati, lambar waya, ko neman app ba, muddin tsarin kayan aikin yana tallafawa damar ɓangare na uku ga wannan bayanan.