Table of Contents - APTAStandards.com

For example, the element could be further defined to represent some of the
transit industry related services as follows:
• CARDSRV= Card services (e.g. Autoload, Balance Protection)
• CIDPRMT= Device Parameter Services (e.g. Display and Audio Configuration)
• CIDAPPL = Transit Application Services (e.g. Business end-of-day)
Each Service aggregate above needs to be further defined
for structure and content for
the
sub-services available underneath them. Exhibit 4.3-8 below provides an example of
possible elements in the card services (CARDSRV) aggregate.
Exhibit 4.3-8 CARDSV Aggregate Elements
TYPE = “Threshold” THRESHVAL= “10.00” LOADAMNT=”20.0 0”
4.3.6 Message Sequences
OFX is a client-server system where an end-user uses a client application to
communicate with a server at a financial institution. The form of communication is
requests
from the client to the server and responses from the server back to the client.
One or more requests can be batched in a single file.
4.3.7 Security Requirements
The main goals of OFX security are privacy, authentication and integrity. OFX utilizes
encryption to maintain privacy, certificates to identify and authenticate servers, and a
cryptographic hash to assist integrity verification. With OFX, security is applied at two
different levels in the message exchange process, channel level and application level.
The
channel level security refers to the lower level security that is implemented in the
communication layer, whereas the application level security is independent of the
underlying communication protocol and aimed at protecting the data at the user level,
just like password protecting word-processing documents. Exhibit 4.3-9 illustrates how
these two level security schemes are applied.
Page 38