Hi all. Hope everyone is doing well. In this circumstance, we are having a lot of things going in our life.
Apart from that, we are today eager to learn something to grow our knowledge.
I am thankful to Payment Village for giving me this opportunity to deliver this wonderful session.
And we are going to our session, Architecting Modern Payment Gateway in .NET Core with Azure.
Why I took this topic as a concern? What exactly today we are going to discuss?
Today we are going to discuss about how we are going to architect our payment gateways in .NET Core.
That is, here I am using Stripe. You can use some other third party tools like Payble, whatever it is.
Wherever we are using the bank credentials, wherever we are using the customer end details,
we need to follow the compliance rule so that we can have the security as well as we can prevent from data breach.
That is the main concern of security. That is the main concern of everyone to make the apps available to user end.
Security is the main thing that makes us important to work with the banking clients.
So, I choose this platform as a basic platform to implement the security.
At first, today as a demo, we are first going to see how exactly our payment gateway is designed in our .NET Core.
Every framework has its own style of doing the payment activities or some other activities.
So, .NET Core has some special architecture. So, we need to understand the architecture to implement the payment activity.
So, let's go to the next slide. I want to explain about myself. Who am I?
So, it may be fit to you to understand the titles. Very good.
I am Menaka Bhaskar Pillai. I am working as an associate software engineer at Accenture Digital.
And I am a C-Shop Corner MVP with Azure and .NET certified professional with a blogger and an international speaker.
You can reach out to me via my LinkedIn or Twitter as well as you can drop me mail. I will keep on checking.
For any doubts and clarification, you can approach me via any of this platform.
So, let's begin our slides of how we are going to explore our architecting the payment gateways in our .NET Core.
So, what we are going to discuss today?
The agenda is the main thing that gives the detail of what we are going to see in further upcoming slides.
Why payment security is important at its peak now?
What are the key features of payment app?
Why we go to .NET Core for payment integration?
Key components in Azure for secure payments, Azure payment processing environments, Azure security capabilities.
You can see two words as common, .NET Core and Azure.
Because as a .NET developer, we guys are not using .NET Framework.
Even it has the upgraded version that is similar to .NET Core.
.NET Core supports each and every OS that starts from Linux to Mac to Windows.
But .NET Framework supports only Windows.
So, that's the main reason we are facing many difficulty to implement the solution via .NET Framework.
So, we are migrating to .NET Core.
And another thing is .NET Core support the open source platform.
So, you can take the code and you can also contribute your code.
So, that's the only reason we are going behind the .NET Core.
Implementing security behind the scenes is very complicated compared to doing with .NET Core and Azure.
As a cloud provider, Azure is growing as a faster and faster in implementing the security.
It have lot of services that been used for securing your application.
For a business need or on the basics of business requirement, you can use any of the service that makes your application secure from each and every point.
Today, we are going to discuss the start and end wherever we can implement Azure in securing your web application.
Before that, we need to understand the architecture of how exactly the payment application can be implemented using the .NET Core.
So, I created a small demo to view you how the architecture of the payment application looks alike.
So, we can see the demo at the middle of the topic where .NET Core comes for the payment integration.
Before that, we can go to our next slide.
Why payment security is important at its peak?
You can see, payment security is the place where the customer is giving his card details for his owner whom he want to pay something.
My card is more valuable as compared to my life.
Any breach in data or any security incompetence that leads to the amount from my card that been disappeared.
And second thing, my entire details and personal and professional details can also be leaked.
That can impact my family circumstance also.
So, implementing security in payment gateway is very major and it's very trendful in today's concern.
Every banking securities are being highly concerned about implementing the security.
So, the usage of mobile payment expected to reach by dollar 503 billion by 2020.
So, what they are telling is, we are not going to the traditional approach of paying something with via our website where it is highly protected environment where we need to log in again and get to method transaction detail.
And again we are giving some detail to encrypt your details that you are the one who belong to that bank.
We are easily accessing everything from our mobile including the payment application.
I am, I can say like Paytm also, other application, everything been integrated with the payments.
So, I am ordering something in Flipkart that takes me directly to my GPay or another wallet.
So, I can add my payment.
So, nothing of the application nowadays they are developing is with payment, without payment is very rare.
So, the concentration of security also booming here to 2025.
In addition 75% of all financial transaction will be cashless by 2025.
You can consider now itself it's a Corona time.
We are having the payment application.
So, we are directly paying without card.
So, what exactly here happening is I don't need to depend on someone or my card to pay my cash.
I can pay by single click.
So, that is the concern that makes the security as important in today's scenario.
What are the key features of payment app?
Okay, I am developing an application that supports my payment.
What are the features I need?
What are the features I need to concern while creating or developing an application?
First thing, I should have the notification pop-up.
Whenever transaction appearing, I need to get notification via my mail, via my SMS, via other things that related to my payment.
So, notification is a primary concern.
So, I can track the amount that been debited or credited.
Billing and invoicing.
Billing and invoicing is a track about how much cash I been deposited, how much cash I been withdrawn.
Transaction history is a history.
So, I can trace this amount, this much amount I been spent, this much amount I been withdrawn.
So, fingerprint security.
This is a main security that need to be implemented in further upcoming apps if it is not been in before application.
So, fingerprint is like a, it is like, it is not similar to everyone.
So, it give the distinct of humans.
So, I can access via my fingerprint.
That is also main thing.
Cryptocurrency is a booming technology.
Without cryptocurrency, we cannot say like my application is secure or not secure.
So, bitcoins and cryptocurrency are leading in securing our application.
So, here comes our main topic.
Why we go to .NET Core for payment integration?
It provides a cloud ready, environmental based configuration system.
So, deploying my application which I designed for payment purpose is very easy if it is a .NET Core application.
Because everything are very customizable.
I don't need to write lot of code to maintain my application or to develop my application.
It is a very lightweight because .NET Core itself a lightweight and it stimulates the high performance with modular HTTP request.
.NET Core as I said before it is easy to maintain as well as update.
As in first slide itself I told why people are migrating even as a .NET developer from framework to .NET Core.
It is very, very easy to support every OS starting from Mac, Linux and Windows.
So, that is for very good to develop something in .NET Core.
So, I don't need to do a code reuse or copy my code to support the other system.
It is a scalable one.
So, I can able to scale my application as per my trends.
Easy to integrate inside and outside as well as on Google Cloud Platform.
Along with other Cloud Platform that using Agilnix or IIS or other supports.
So, let's see here itself a demo how exactly the architecture of the application via .NET Core will be looks like.
So, I am going to my coding session where I implemented a simple application.
That uses the payment third party tool.
So, see this is how my architecture looks like.
I choose .NET Core web MVC.
So, I have my views, model and controller folder.
Startup is the place where my code starts to work.
So, I need to register my middleware, HTTP, every action been performed here.
I am using third party tool called Stripe to integrate my payment in my application.
So, if you are using any tool for integration either it is a Paypal or Stripe or anything.
Just go to the official documentation.
You can get idea how to integrate with your SDK.
It's a Java or .NET Core.
Since I am doing .NET Framework.
I am just converted that to my .NET Core Platform.
So, since I am a .NET developer.
I just use the .NET Core for implementing the payment solutions.
So, what I am doing is for implementing the Stripe.
We need to have two things.
That are the environmental thing that remains constant.
Here I am declaring my environmental variable as in app setting.json.
So, it's easy for me to work on that.
Sorry, here it's app setting development.json.
It holds the two primary things like publishing key and my secret key.
This acts as a main thing while we are doing our transaction.
So, in order to use our keys from the app setting to our controller or model class.
We need to register or we need to consume this value to our startup class.
So, that it may be available to all of our services.
So, what I am doing here is.
I am just configuring my key here.
So, this is the thing that we, this is a common thing that you need to do.
Like I am getting the value of secret key that is a mandatory step to be done.
So, what I am doing is I already have my class that holds the method of set API key.
This sets the key API from the secret key.
After doing that I need to register my class that going to use.
Because tightly coupled class.
So, I just need to do this by using a class.
So, I just created a data class inside my model folder to use those keys.
So, those both the keys what you declared in app setting.json need to be declared here also with the same name.
So, here I want to bound my values.
So, from the app setting.json which is declared here.
So, I registering my class.
So, I can use my class via injection dependency.
So, configuration dot get section.
So, this get section holds the value of both the publish key as well as the secret key.
Once it is done I need to design my controller.
So, how my values been obtained at.
So, I am going to my controller class.
Here my controller class has the values of charge that been the both the things been originating from the form of stripe.
That I will show while I am running the application.
So, it contain the stripe email as well as the stripe token.
So, from this I am going to create the customer.
I am going to validate my customer like the email of the my email that been I am entering along with the source everything.
After that I am just paying some amount by fixed amount.
So, while the status code is succeeded I am just viewing my transaction is succeed.
So, it is very simple to implement because I just give my end points that is environmental variables in my app setting dot json that is development json.
And after that I am consuming my both of my keys like by using a tightly coupled class that I declared as a data class.
Once after that as I am just doing the action method by consuming from my view.
So, those are my email as well as the token from my view page into my controller.
See here I am just using that.
After that what I am doing I am just creating the transaction by means of what I want to do.
So, I just give the currency value description and everything the charge options I am just creating.
After that I am returning the status code.
Here you can validate whatever the thing you want.
Suppose you want to send some mail you can add those things.
It is a additional thing for the deeper application developer you can add those things also.
But it is not that much important if you going for a test purpose.
For a demo purpose I just want to show you how it works with a third party that is right.
So, I am just running it takes some time to load.
Yeah, so a simple line of code with very less complication is integrated my payment third party tool with my .net core MVC application.
So, what I am doing is I am just testing I already have one card.
So, I am just paying this.
So, my controller will hit here.
So, you can see from the form it takes the values of email as well as my stripe token.
That is a token that been generated.
Those text box been already designed by stripe we are just consuming.
So, just keep in mind giving the name should be very punctual compared to what exactly in your stripe.
So, after that I am creating the customer service object and a charge object, charge service object.
My customer is creating a new customer using a create operation.
Once again it is loaded.
You can see my customer while I am hoovering.
I have my customer ID and my object and some other detail if you want to give something you can add.
I just given the important things.
After that my charge service.
Here I will have my ID, amount, refunded.
You can add all those things if you want.
If I am going to design a complete application not for a test I just want to give everything.
This is for the charge operations.
What kind of charging you are performing like you are charging based on your USD or INR depends upon your currency value.
So, this is a charge option that you need to be consider.
So, two things you need to consider that is a customer validation that is what we perform before creating the customer.
And you are consuming the value from your firm and by means of that you are creating that charge value.
So, after that the status code.
So, if it is validated I just want to go to the transaction ID.
This is for my display purpose.
If I want to display my transaction ID I can do here.
Or some other email triggering.
Every options can be performed after it is succeeded.
So, I can able to view this.
So, my code succeeded.
So, it is returning to view.
Transaction is succeeded.
Check email to view the receipt.
Okay, it's fine.
This is already the running application that I have already the stored value.
What if I want to do from the scratch?
Where I been written those kind of script?
What I am having in my view page?
So, I will show that also.
It's taking to load.
So, pay with card.
No, I do not want to do for the existing detail.
I want to do some cookie clear out or something.
So, it will clear.
Mostly for banking details we should not use this type of card registering.
Until unless it is necessary we should not have the practice of this.
Just I am going to give something like.
So, for testing purpose this have some test mode.
Take any card number from this for testing purpose.
So, give the year and because expiry date will be future.
So, give something in future dates.
And give any three numbers.
Because it's for testing.
Sorry.
And zip code is location code.
Do you remember me?
And it will ask you a phone number.
You can give your original number or something somewhere.
But don't give the usable number because it will trigger the start message to them.
So, give something that is not existing.
If it is validated only it will show you green tick.
So, it's validated.
So, I can just give continue.
Because I don't need to explore because I already explored that.
So, see the new code also.
Transaction has succeeded.
Check email to view the report.
So, my view page holds all my details.
So, view page will be like you need to add the view from customizable view or from the existing view.
I just use the existing views because I am showing everything in a single page today.
So, this is back.
I just need to add the script of this type along with the other future.
These are the futures that been displayed in your form.
So, if you want to add a zip local code or something you can add here or it is a inbuilt property.
So, you can choose auto property to set in your that you need to add some flavors to your form.
So, those things are customizable.
You can add those things.
That is guys this is how our payment gateway looks like using the integration with the third party tool.
Looks while we are constructing architecting in our .net core.
Do you feel this is secure?
I can develop like this and I can give to my customer and to yeah start doing your payment.
I just do a deployment in my production and give.
No, because this is not at all a secure one.
It is not even having authentication or the any token validation whether the user is existing or not existing.
And my values been already registered.
So, it is not secure.
So, how we are going to implement the security for the same application via Azure?
If you want to implement security for the same application with Azure, we have lot and lot of services.
As I said before based on your requirement based on your need decide what kind of security you want.
How much approach how much you want to deal with your application?
How much compliance your application need to be?
So, we are going to see some of the Azure service that is used to implement the security in your payment application.
And that is very much useful for architecting your application with wide level of security.
So, let us go to our slide.
So, key Azure component to secure your payments.
This is very limited guys.
If you go with Azure's complete services there are lot and lot of security components that can you can use in nook and corners of your application development.
But these are the very basic services that in ready in a normal payment application should needs need to be done.
So, the main thing is like Azure AD application.
I am doing something with my windows authentication that is up to my windows.
I cannot say after I am published to my Azure app service.
I deployed my application and after that I published my application.
I want to deal every user in a cloud.
I can use Azure AD application.
So, that it authenticate the user along with this password.
So, the particular person with the particular knowledge of particular thing he have can able to login.
Even that also provided by the cloud service.
That is quite good because my application is also already in my cloud.
And my application authentication is also in my cloud.
So, this is the first way to secure your application if you are using the payment gateways.
After that Azure key wallets.
Whenever my token is getting originated.
I want somewhere to store my token.
So, I can use my token to secure my application.
I cannot simply store my tokens that been originated in my application somewhere.
So, I can use again reuse again.
So, we can use Azure key wallet.
So, it is a secure platform you can keep everything.
It name itself and its symbol itself have the key symbol.
So, then Azure SQL always encrypted concept.
This is the main concept and main thing that need to be concerned while we are developing from our database end.
Because the encrypted concept is very useful.
While we are doing something as a backup knowledge of the transaction details or another thing we want to track for every application.
So, Azure SQL always encrypted concept is helps a lot.
Azure DDoS production.
This is a recent production that taken into the account.
Because DDoS production plays an important role of security breaches and other security danger and hazardous to your modern web application.
So, these are the 5 main core concept that need to be implemented while you are architecting your modern payment gateway or modern payment with any of the third party tools.
So, next thing is like this is I want to develop application that is completely secured from my back end to front end even from my data storage.
That I need to implement by means of Azure.
How can I do that? That's the thing.
So, they have every security features that need to be implemented while you are developing your application via Azure.
So, if you are using a database at your back end, just try to use the Azure key valid for protecting your all the necessary key values and everything that is like a tokens or something.
And there is a special thing for you governing your security of an application called Azure Security Center.
And as I told you the encrypt concept there at the SQL.
And Azure Blob storage is highly secured.
So, you can store your blog or any other file oriented data that is a transaction bills or anything in a blob storage.
OMS log analytics used to trace the logs, what are the logs you have been performed from your application level.
So, you can implement the security and application insight specially for monitoring your application.
So, any insecure communication or insecure request been getting into your application.
So, that it will product your application.
After that, coming to the Azure Active Directory and our role-based.
So, role-based authentication is very important.
It is like a role-based access control.
It is like what role exactly and how I can secure my application.
It is similar along with Azure AD also.
We can authenticate the user by AD service also.
Once I am coming to my front end, I am using the load balancer that is a payment gateways.
So, along with my app service environment, I can customize my application by adding my certificate, SSL certificate or other certificate.
So, that is very important.
And main thing is like application gateway.
Application gateway is very important.
Like I can implement by normal third party tool, we have oscillate.
If you are going with cloud, you already have the application gateway.
So, secure your application, balance your load.
Lot of request coming to one server, it is so hard.
So, the application gateway split the loads according to the servers.
So, it act as the direct contact to your client rather than to your API or some other.
So, your client do not need to approach directly.
So, all of these are producted by some of the thing is Azure DNS.
This is a very main concept if you are developing those things.
And along with the middle tier, everything I can be completely wrap up inside my DNS and environment.
So, I will have my storage policies along with other security policies and compliance and certified experts.
So, that makes my application productive if I am architecting my application via Azure services.
So, this is how the exact architecture of your application looks.
If you are implementing a normal .NET core application through your Azure service.
Guys, think after seeing this what you are getting into the knowledge like.
It is very easy and it is very cost conception is very less.
And other security breach also very less.
I will tell in further slide why my other things also like cost conception is less.
As well as why I can say this is a compliance one.
Why I can say believe this I can use this much things inside my application.
So, this is how exactly architecting the modern payment application via .NET core with Azure service looks like.
Use at least some of the services that is very important to your web application.
Where you are implementing the payment application things.
So, not all services you do need to use.
But there are some services you must need to use because of producting your application.
Even though you are not using this cloud service provider.
There is some other cloud service provider also where you need to use some of the things like authentication, load balancing, API gateway.
So, that will act as the productor of your application from malware or another hazardous things from hackers or some things.
So, data residency and boundaries.
Today we are going to discuss this data residency.
Why we need data residency?
Like our data been stored in somewhere.
So, whenever my data been lost I just need to depend on my own data center where I stored all my data.
By using or migrating to cloud it makes me available as a copy or reflect my copy to multiple region.
And it is accomplishing my multiple regions as a single availability zone to multiple availability zone.
So, inside a single region I will have multiple availability zone.
And all the availability zones are interlinked to each other.
And I will have another region that both my regions also interlinked to each other.
So, for accessing my request and approving my request for performing the action I do not need to depend on something a single availability zone.
I can perform everything with my facility perimeters.
So, I can have building entrance inside the building and data center floor.
So, it is very useful while we are designing our web application with lot of security features.
Everything inside a wrap of single thing is very hard to understand and very hard to product the data.
We need to keep our eye open to identify where it is, what it is.
So, just make and just make this things very clear.
Like that is the only reason we are migrating our things to cloud.
It provide lot of availability because data breach and data loss is not possible in cloud as we follow its policy futures.
So, this is one of the important slide to understand.
Azure SQL database security capabilities.
As we discussed in our few further slides like in our older slides I think so.
We see like encryption concept.
By means of this we have the customer data.
And we have the information production, threat production, access management and network security.
Think someone want to access your data need to pause all of the layer to access your data at the center.
That is quite that is even if he breaks the first network security.
He need to meet the access management after the threat production, after that information production to reach your customer data.
So, our how much our data is being producted inside our cloud by using the Azure SQL database security capabilities.
So, if you are working in a DB and it is very good to use DB security capabilities that is Azure security capabilities.
So, that makes our application to work good and secured.
Industry leading Azure security.
We can say why Azure is growing tremendously.
If I am choosing Azure as a service provider for me.
What is the difference of my cloud service with other services?
Why it is?
Because for a banking application or some other application where I am using my e-commerce application.
Where I am using my customer details.
It is not good to go with something which I have no knowledge.
Because data privacy is very important.
So, why I need to go to Azure?
Because the only thing is like it is not a one and only thing.
The main thing is like it they invested nearly 1 billion dollar annually.
So, for implementing the security future.
Not only for Azure security environment.
But for all the services in Azure for implementing the security.
So, each and every services of Azure implements the security.
So, that makes people who works in a normal application to the high end banking application secured in what they are using.
And this is around 3500 security expert.
And it has post a lot of compliance certification.
So, seeing the investment itself we can understand the security experts and the compliance certificate it got.
That makes us to move towards the cloud service provider.
So, we want to work in a secured environment where you need to keep everything in a very good maintained manner.
Well maintained manner.
In a secured manner.
You can start to implement your cloud service provider Azure to all your activity from back end, front end even at the middle tier also.
So, we ended the session.
I hope I made your day.
Like I just delivered my session.
This is a thank you slide.
I want to thank you all and everyone for listening my session.
For any doubts you can ask me.
I am here to clarify your doubt.
If the doubts be not satisfactory.
You want something to get more.
You can approach me again via my social platform.
So, I am available.
So, this is our today's session guys.
Thanks for giving an opportunity to Payment Village.