A PA-DSS-Compliant Payment Gateway with 3D Secure Authentication

Summary

INNERLUXES's Java engineers helped a European fintech software product company build a PA-DSS-compliant, multi-component payment gateway with 3D Secure payer authentication. Over a nearly three-year engagement, the team designed and built the white-label gateway and the 3D Secure server, directory server, and access control server — compliant with EMVCo 3DS v1 and v2 and the major card networks — giving the Client a robust, easy-to-deploy product that gained traction with banks worldwide.

About the Client

The Client is a European fintech software product company offering cloud and on-premises business solutions for banks, payment service providers, and ecommerce merchants. Its products are used by hundreds of organizations worldwide.

The Challenge: Specialized Payment Software Skills

The Client wanted to build a multi-component payment gateway enabling ecommerce payments with 3D Secure payer authentication, primarily for banks helping their ecommerce customers introduce secure digital payments. The core component — a white-label payment gateway hosted on the bank's server — would provide ready-to-use APIs for integration with banking systems and merchant apps, with customizable checkout interfaces so banks could communicate their brand, while back-end 3D Secure components would authenticate payers per the latest card-network protocols (EMVCo 3D Secure 2.1.0 and 2.2.0). The Client's in-house developers lacked specialized experience in large-scale payment gateways and 3D Secure compliance, so it sought seasoned payment software expertise — and, after a positive past engagement, brought INNERLUXES's Java talents back.

Designing and Building the Payment Gateway

After studying the requirements, INNERLUXES selected the best-qualified Java developers — engineers with strong track records in large-scale financial software and compliant payment solutions — and the team was ready to start within a week of the Client's request. The engineers contributed across the project:

Technical design. INNERLUXES helped architect the gateway and 3D Secure components with a SOA approach for a flexible, modular solution that scales with transaction volume and supports easy upgrades, and recommended container-based development to restrict access to critical components, simplify PA-DSS controls, and streamline DevOps for faster deployment across banks' infrastructures. The team sharpened payment-processing functionality for PCI DSS, PSD2, and UK Open Banking, and designed custom cardholder-authentication mechanisms compliant with EMVCo 3D Secure v1 (1.0.2) and v2 (2.1.0, 2.2.0), with support for Visa, MasterCard, and UnionPay schemes.

Back-end development. INNERLUXES's Java engineers coded every major server-side component of the suite:

• A 3D Secure client (merchant-side gateway app) — back-end logic for automated checkout-page generation, payment-request processing, message routing, transaction-status reporting to payers and merchants, and recordkeeping, plus merchant features for account management, payment tracking, and custom rules (e.g., transaction segmentation, buyer notifications).
• A 3D Secure server (3DSS) that initiates cardholder authentication, receives requests from acquiring banks, and displays in-app and in-browser checkout interfaces — built using EMVCo's 3DS SDK for compliant flows.
• A directory server (DS) that holds information about card-issuing and acquiring organizations, validates authentication requests and routes them to the right issuer, and verifies 3D Secure compliance with the EMVCo 3DS SDK — developed end to end with wide customization for interoperability with local card networks.
• An access control server (ACS) that stores card-enrollment and status data, processes authentication requests, checks card validity and ownership via one-time cryptograms, and — for frictionless payments — runs real-time transaction risk assessment (on payer history, transaction value, device and browser data) to decide whether a transaction can proceed or needs additional 3D Secure authentication via a one-time PIN.

To certify EMVCo 3D Secure compliance, INNERLUXES's engineers used a DS and 3DS SDK compliance-testing toolkit from an EMVCo-approved lab to attest their implementations against the standards.

API development. Since each component can be deployed standalone on a bank's infrastructure, INNERLUXES built ready-to-use APIs to integrate the 3D Secure components with core banking systems, hardware security modules, card-cryptography systems, and fraud-detection tools, plus APIs to integrate the gateway with merchant systems and ecommerce platforms.

PA-DSS compliance. To meet PA-DSS (and facilitate PCI DSS), INNERLUXES's lead engineer helped design compliant transactional-data storage, retention, and deletion policies; implemented PA-DSS-compliant JSON Web Encryption (JWE) for data at rest and in transit; set up logging and monitoring with role-based access to transactional data; and enforced secure coding backed by OWASP ASVS.

Rollout and Maintenance

INNERLUXES continues to work with the Client's developers and DevOps engineers to help the Client's customers deploy the chosen gateway components on cloud and on-premises servers — handling integrations and custom connectors to specific or legacy software, helping banks integrate the DS with local card networks, and supporting the Client's banking clients through 3DS certifications held by EMVCo and major card networks. The team also refactors code, removes redundant features to improve performance, and continuously upgrades the product to keep payment and authentication flows aligned with EMVCo's evolving standards.

Results

Over nearly three years, INNERLUXES's Java engineers helped the Client obtain a robust payment product that protects cardholder data and complies with EMVCo 3DS v2. The easy-to-deploy, EMVCo-approved solution offering secure, convenient checkout quickly gained traction among banks worldwide, helping the Client win a larger market share and generate strong revenue — and the Client expanded the cooperation to evolving another of its fintech products.

Technologies and Tools

Back end: Java, Spring (Core, Boot, Web, Data), Hibernate, Logback, SSL, JSP, JSF, REST, JUnit, Mockito, Nginx.

Databases: Oracle DB, PostgreSQL, H2.

GUI: HTML, jQuery, AngularJS, Ext JS.

Build, containers, monitoring, testing: NPM, Maven, Gradle, Apache Tomcat, WebLogic, Docker, Minikube, ELK (Elasticsearch, Kibana, Logstash), Grafana, SoapUI, Postman, Apache JMeter.