สถาปัตยกรรมการพิสูจน์การชำระเงินสำหรับ DOH Payment Orchestrator — ครอบคลุม mTLS, JWT Client Assertion, HMAC, Token Binding, Key Management, Fraud Detection และ PCI DSS v4.0 ComplianceComplete authentication architecture for DOH Payment Orchestrator covering mTLS, JWT Client Assertion, HMAC, Token Binding, Key Management, Fraud Detection & PCI DSS v4.0 Compliance.
หลักการสำคัญ: Payment is NOT in the lane critical path — ชั้น payment logic ไม่ใช่ critical path ของหน้าด่าน ด่านบันทึก trip event เท่านั้น การตัดเงินเกิดทีหลังบ้าน เป็น layered security — ไม่ใช่ security-as-gate Key Principle: Payment is NOT in the lane critical path — toll lanes only capture trip events. All payment processing happens asynchronously in the back office. Security is layered (defense-in-depth), not gated (security-as-gate).
DOH Payment Orchestrator เชื่อมต่อกับ PSP/Acquirer ผ่าน mTLS โดย DOH เก็บเฉพาะ token reference — ไม่เก็บ raw PAN เด็ดขาดDOH Payment Orchestrator connects to PSP/Acquirer through mTLS. DOH stores only token references — never raw PAN.
DOH เก็บเฉพาะ network token (VTS/MDES) ที่ผูกกับ DOH Merchant ID — PAN ดิบไม่เคยเข้า DOH infrastructure ลด PCI scope เหลือ SAQ ADOH stores only network tokens (VTS/MDES) bound to DOH Merchant ID. PAN never enters DOH infrastructure — reducing PCI scope to SAQ A.
mTLS (transport) + JWT/HMAC (message) + Token Binding (credential) + Idempotency (replay) + Rate Limiting (abuse) ทุก layer ออกแบบให้ compromise ชั้นเดียวไม่พอเพียงที่จะทำให้ระบบล่มmTLS (transport) + JWT/HMAC (message) + Token Binding (credential) + Idempotency (replay) + Rate Limiting (abuse). Each layer is designed so that compromise of one layer does not collapse the system.
ระบบ payment ไม่อยู่ใน critical path ของหน้าด่าน — มี 300ms latency budget สำหรับ vehicle throughput แต่ไม่มีการตัดเงินสดที่หน้าด่าน การตัดเงินเกิดแบบ asynchronous ทีหลังบ้านPayment processing is not in the critical lane path. The lane has a 300ms latency budget, but no live payment authorization occurs at the lane — all payment is asynchronous, back-office processing.
mTLS สำหรับ transport security + JWT Client Assertion (RFC 7521) สำหรับ message-level authentication + HMAC-SHA256 fallbackmTLS for transport security + JWT Client Assertion (RFC 7521) for message-level auth + HMAC-SHA256 fallback.
Protocol: TLS 1.3 mandatory (TLS 1.2 fallback). Client certificate: RSA 2048+ หรือ ECDSA P-256. Validation: Full chain + CRL/OCSP stapling. Certificate pinning ฝั่ง DOH. Ciphers: TLS_AES_256_GCM_SHA384, ECDHE-ECDSA-AES256-GCM-SHA384TLS 1.3 mandatory (1.2 fallback). Client cert: RSA 2048+ or ECDSA P-256. Full chain + CRL/OCSP validation. DOH-side certificate pinning. AES-256-GCM ciphers only.
Primary auth mechanism: JWT signed with RS256/ES256. Header: alg + kid. Payload: iss=DOH_MERCHANT, aud=PSP API, exp=now+600s, jti=UUIDv4. Signature: HSM-private-key. No shared secret required.Primary: JWT signed RS256/ES256. Header: alg + kid. Payload: iss=DOH_MERCHANT, aud=PSP API, exp=now+600s, jti=UUIDv4. Private key in HSM. PSP only needs public key.
Stripe-style canonical signing string. Headers: X-Merchant-Id, X-Request-Id (UUIDv4), X-Timestamp (epoch), X-Signature. Signing string = Merchant-Id + Request-Id + Timestamp + Method + URI + SHA256(Body). Secret: 256-bit CSPRNG. Timestamp skew: ±5 min.Canonical signing string (Stripe-style). Headers: X-Merchant-Id, X-Request-Id (UUIDv4), X-Timestamp, X-Signature. Secret: 256-bit CSPRNG. Timestamp tolerance: ±5 min.
Every mutation includes Idempotency-Key (UUIDv4). PSP returns cached response within 24hr window. Prevents duplicate charges from network retries. Applies to: /v1/payments, /v1/tokens, /v1/refundsAll write operations include Idempotency-Key (UUIDv4). PSP caches response for 24hr window. Prevents duplicate charges from network retries. Applied to all mutation endpoints.
รูปแบบ: Opaque 256-bit random, Base64, prefix sk_live_. ส่งผ่าน Authorization: Bearer header (ไม่ใช่ URL). Server-side: bcrypt/scrypt hash เท่านั้น (ไม่เก็บ plaintext). หมุน 90 วัน พร้อม 7 วัน overlap. IP restriction: DOH egress CIDR. Rate limit: 100 req/s burst, 50 req/s sustained. Format: Opaque 256-bit random, Base64, sk_live_ prefix. Transmission via Authorization: Bearer (never URL). Server-side bcrypt/scrypt hash only. 90-day rotation with 7-day overlap. IP bound to DOH egress CIDR. Rate limit: 100 req/s burst.
Three-tier key hierarchy ใน FIPS 140-2 Level 3 HSM — กุญแจแยกตามหน้าที่ พร้อมการหมุนอัตโนมัติThree-tier key hierarchy inside FIPS 140-2 Level 3 HSM — with automated rotation schedule.
| ประเภทกุญแจKey Type | รอบการหมุนRotation Period | Overlap | การจัดเก็บStorage | การเพิกถอนRevocation |
|---|---|---|---|---|
| mTLS Client CertificatemTLS Cert | 12 months | 30 days | HSM / PKCS#11HSM | < 1 hr |
| JWT Signing Key (RS256/ES256)JWT Key | 180 days | 7 days | HSM (private) / JWKS (public)HSM / JWKS | < 1 hr |
| HMAC Secret (256-bit)HMAC Secret | 90 days | 7 days | Vault / Secrets ManagerVault / KMS | Immediate |
| PSP API Key | 90 days | 7 days | bcrypt hash (server)bcrypt hash | Immediate |
| Token Vault Encryption KeyToken Vault Key | 180 days | 7 days | HSM-wrappedHSM-wrapped | < 1 hr |
| Master KEK (AES-256)Master KEK | 12 months | 30 days | HSM (never exported)HSM only | Full re-wrap |
Primary: HashiCorp Vault Enterprise (HSM auto-unseal) หรือ cloud: AWS Secrets Manager / Azure Key Vault / GCP Secret Manager
Regulated: Thales/Entrust/Utimaco HSM via PKCS#11
Principle: ไม่มี plaintext keys ใน disk/config/env/VC เด็ดขาดPrimary: HashiCorp Vault Enterprise (HSM auto-unseal) or cloud KMS. Regulated: Thales/Entrust HSM via PKCS#11. NEVER plaintext on disk, config, env, or VC.
Compliant destruction per NIST SP 800-88. All key access logged. Quarterly inventory audit. Split-knowledge for HMAC secrets. Dual authorization for create/revoke operations.NIST SP 800-88 compliant destruction. All key access logged. Quarterly inventory audit. Split-knowledge provisioning. Dual authorization for create/revoke.
Network tokens (Visa VTS / Mastercard MDES) แนะนำเหนือ gateway tokens เพื่อ PSP portability และความปลอดภัยสูงสุดNetwork tokens (Visa VTS / Mastercard MDES) recommended over gateway tokens for PSP portability and maximum security.
| ด้านAspect | Network Token (VTS/MDES)Network Token | Gateway Token (Stripe/Adyen)Gateway Token |
|---|---|---|
| IssuerIssuer | Card network (Visa/MC) directly | Payment gateway/processor |
| PortabilityPortability | Portable across acquirers/gateways | Locked to issuing gateway |
| Liability ShiftLiability | Full network liability shift | Gateway-dependent |
| PAN Lifecycle SyncPAN Sync | Automatic (Account Updater) | Manual/gateway-specific |
| Cryptogram | Single-use per authorization | May not support |
| Assurance LevelAssurance | Token Assurance Level (TAL) | Gateway-specific scoring |
| Time to MarketT2M | 4-6 months (MDES onboarding) | Faster via single API |
สำหรับ Easy Pass Postpaid: Network Tokens แนะนำสำหรับ portability ระหว่าง EXAT, BEM, DOH. Gateway tokens เป็น fallback สำหรับ issuers ที่ยังไม่รองรับ VTS/MDES ในไทย Recommendation: Network Tokens for portability across EXAT, BEM, DOH operators. Gateway tokens as fallback for issuers not yet supporting VTS/MDES in Thailand.
Operations: Provision → Activate → Suspend/Resume → Delete. Account Updater: auto-refresh เมื่อ PAN expires/reissues (VAU 2.0 / ABU). DELETE เป็น terminal state. Operations: Provision → Activate → Suspend/Resume → Delete. Account Updater auto-refreshes on card expiry/reissue. DELETE is terminal (non-recoverable).
ระบบ 5.8 GHz DSRC, passive RFID OBU, prepaid, cached balance ที่ lane, T+1 batch settlement ผ่าน Central Clearing House5.8 GHz DSRC, passive RFID OBU, prepaid model, cached balance at lane, T+1 batch settlement through Central Clearing House.
| หน่วยงานAuthority | ระบบSystem | ถนนที่ดูแลManaged Roads | ประเภทType |
|---|---|---|---|
| EXAT | Easy Pass | Chalerm Mahanakhon, Si Rat, Udon Ratthaya, Ramindra-At Narong, Bang Phli-Suk Sawat | รัฐวิสาหกิจState Enterprise |
| BEM | Easy Pass | Si Rat (2nd Stage), Udon Ratthaya (Bang Pa-in), MRT Blue/Purple | บริษัทมหาชนPublic Company |
| DOH | M-Pass | Motorway 7 (Bangkok-Chonburi), Motorway 9 (Kanchanaphisek) | กรมราชการGovt Dept |
Key Fact: Easy Pass และ M-Pass ใช้ร่วมกันได้ (interoperable). OBU tag เดียวใช้ได้ทั้ง EXAT, BEM, DOH. DSRC protocol เดียวกัน (CEN DSRC EN 12253/EN 13372). Central Clearing House เป็น platform ร่วม. Easy Pass and M-Pass are interoperable. A single OBU tag works across EXAT, BEM, and DOH toll plazas. Systems share a common DSRC protocol (CEN DSRC EN 12253/EN 13372) and use the same passive RFID tag standard.
Lane controller queries central host แบบ real-time ก่อน authorize การผ่าน. ต้อง upgrade lane controller ทุก lane. Latency budget 300ms. ต้นทุนสูง.Lane controller queries central host for real-time authorization. Requires lane controller upgrade at every lane. 300ms latency budget. Highest cost.
Toll events batched แล้ว settle payment ทีหลัง. ไม่ต้องเปลี่ยน lane controller. T+1 batch เหมาะสำหรับ POC. มีใช้อยู่แล้วสำหรับ corporate fleet.Toll events batched, payment settled later. No lane controller changes needed. T+1 batch model is already partially in use for corporate fleet accounts. Simplest path.
Register card token linked to Easy Pass. Toll events trigger token-based MIT/UCOF charges. Similar to TfL London / EZ-Pass NY. Requires payment gateway integration + token provisioning.Card token linked to Easy Pass account. Toll events trigger token-based MIT/UCOF charges. TfL London / EZ-Pass NY model. Requires payment gateway integration.
ชั้น POC Gate: ช่องทางการเข้าถึงข้อมูล (API pull vs daily batch vs manual CSV) ต้องยืนยันก่อน POC live. ไม่มี public API documentation — integration เป็น proprietary ต้องมี commercial agreement กับ EXAT/BEM/DOH ก่อน POC Gate Requirement: Confirm the exact data access mechanism (API pull vs daily batch vs manual CSV delivery) before POC goes live. No public API documentation exists — integration is proprietary and requires commercial agreements with EXAT, BEM, and DOH before integration can proceed.
Real-time anomaly scoring บน event stream ควบคู่ไปกับ 8-layer reconciliation เป็น defense-in-depthReal-time anomaly scoring on event stream — paired with 8-layer reconciliation as defense-in-depth.
Real-time fraud scoring เป็น layer แรก ไม่ใช่ layer เดียว — ทำงานคู่กับ reconciliation แบบ defense-in-depth: Real-time fraud scoring is the first layer — not the only layer. It works with reconciliation as defense-in-depth:
SAQ A applies (token-only storage at DOH) BUT trip/tag data มี obligations ของตัวเองSAQ A applies (token-only storage at DOH) but trip/tag data carries its own security obligations.
PAN ไม่ stored post-tokenization. Token refs AES-256 encrypted at rest. Documented key lifecycle policies. All keys in FIPS 140-2 HSM or KEK-wrapped.PAN never stored post-tokenization. Token refs AES-256 encrypted at rest. Documented key lifecycle policies.
mTLS 1.2+ สำหรับ ทุก PSP/TSP channel. Strong ciphers (AES-256-GCM). Certificate pinning ฝั่ง DOH. HSTS: max-age=31536000.mTLS 1.2+ for all PSP/TSP channels. Strong ciphers. Certificate pinning on DOH side. HSTS enforced.
API security review ก่อน deployment. Formal change control สำหรับ cert/key rotation. OWASP API Top 10 mitigations applied. Idempotency บังคับ.API security review before deployment. Formal change control for cert/key rotation. OWASP API Top 10 mitigations.
Documented responsibility matrix DOH↔PSP. PSP security assessment ก่อน integration. Annual penetration testing บังคับก่อน live POC.Documented responsibility matrix DOH↔PSP. PSP security assessment before integration. Annual pen test mandated before live POC.
Trip/tag data เป็น sensitive-by-context (รู้รูปแบบการเดินทาง). ต้องทำ DPIA. Data minimization. Role-based access. Audit logs. Incident response plan.Trip/tag data is sensitive-by-context (reveals movement patterns). Requires DPIA, data minimization, RBAC, audit logs, and incident response plan.
14 สัปดาห์ เฉพาะ payment software, logic, และ security — ไม่รวม physical infrastructure14 weeks focused exclusively on payment software, logic, and security — no physical infrastructure.
Deploy FIPS 140-2 Level 3 HSM (or cloud HSM). Generate mTLS client key pair in HSM. Submit CSR to PSP. Install client certificate. Configure cert expiry monitoring.Deploy FIPS 140-2 L3 HSM or cloud HSM. Generate client key pair. Submit CSR to PSP. Install certs. Deploy monitoring.
Establish mTLS 1.3 channel. Configure outbound TLS with cert pinning. Validate full chain + CRL/OCSP. Deploy secrets management (Vault / KMS). PSP-side enforcement on /v1/payments, /v1/tokens paths.Establish mTLS 1.3 channel. Configure cert pinning. Validate CRL/OCSP. Deploy secrets management. PSP enforces client certs on payment/token paths.
Implement JWT Client Assertion (RS256/ES256, RFC 7521). Implement HMAC-SHA256 fallback signing. Implement idempotency keys (UUIDv4) on all write operations. Add timestamp validation (±5 min skew).Implement JWT Client Assertion (RS256/ES256). Implement HMAC-SHA256 fallback. Add idempotency keys. Add timestamp validation.
Onboard as Token Requestor (Visa VTS / MC MDES). Implement token provisioning (CIT → token → store ref). Implement MIT/UCOF flow (token + cryptogram → auth). Token lifecycle management. Account Updater integration.Onboard as Token Requestor. Implement token provisioning. Implement MIT/UCOF flow. Token lifecycle management. Account Updater.
Implement event normalization pipeline. Deploy feature extraction (velocity, geographic, card-tag, night-pattern). Score-and-alert engine. Integration with ledger and reconciliation workflows.Implement event normalization. Deploy feature extraction. Score-and-alert engine. Integration with ledger and reconciliation.
Annual penetration test by PCI ASV. Remediate all findings. PSP security assessment (Req 12.9). Verify all PCI DSS controls. OWASP API Top 10 verification. DPIA completion for trip/tag data.Annual pen test by PCI ASV. Remediate findings. PSP security assessment. PCI DSS control verification. OWASP API Top 10 checks.
Final security architecture review. Key inventory audit. BOT regulatory classification confirmed. All gates documented. Go/No-Go decision for controlled POC launch. Evidence report + TOR/RFP draft readiness.Final security architecture review. Key inventory audit. BOT classification confirmed. All gates documented. Go/No-Go for controlled POC. Evidence report ready.
HSM deployed ✔ • mTLS channel live ✔ • JWT + HMAC auth operational ✔ • Token binding active ✔ • Fraud pipeline running ✔ • Pen test passed ✔ • All PCI DSS controls verified ✔ • Ready for Controlled POC with 5,000-10,000 opt-in users ✔ HSM deployed ✔ • mTLS channel live ✔ • JWT/HMAC auth operational ✔ • Token binding active ✔ • Fraud pipeline running ✔ • Pen test passed ✔ • All PCI DSS controls verified ✔ • Ready for Controlled POC ✔
PSP validates merchant_id in JWT matches resource. No cross-merchant token access.PSP validates merchant_id in JWT matches target resource.
mTLS + JWT/HMAC dual auth. No basic auth. No keys in URLs. Token exp: 600s.mTLS + JWT/HMAC dual auth. No basic auth. No keys in URLs.
Idempotency keys prevent duplicate charges. PSP caches response 24hr. UUIDv4 keys.Idempotency keys prevent duplicate charges. UUIDv4 keys with 24hr window.
Per-cert + per-key rate limiting. 100 req/s burst, 50 req/s sustained. Alert on breach.Per-cert + per-key rate limits. 100 req/s burst, 50 req/s sustained.
Allowlist of DOH-submittable fields. No mass assignment. Input validation server-side.Allowlist of DOH-submittable fields. Server-side input validation.
DOH cert scoped to /payments/*, /tokens/* only. No admin endpoint access from DOH cert.DOH cert scoped to payment/token paths only.
TLS 1.3 only. HSTS max-age=31536000. CSP: default-src 'none'. X-Content-Type-Options: nosniff.TLS 1.3 only. HSTS. CSP. nosniff. Cache-Control: no-store.
DOH validates PSP responses: certificate, signature, amount. Callback URL allowlist.DOH validates PSP response integrity. Callback URL allowlist.