TCP/IP Tutorial and Technical Overview - IBM Redbooks

The diagram shows the following transactions (each transaction consists of a
request/response pair):
1. PInit
This initializes the system, including details such as the brand of card being
used and the certificates held by the cardholder. SET does not insist that
cardholders have signing certificates, but it does recommend them. A
cardholder certificate binds the credit card account number to the owner of a
public key. If the acquirer receives a request for a given card number signed
with the cardholder's public key, it knows that the request came from the real
cardholder. To be precise, it knows that the request came from a computer
where the cardholder's keyring was installed and available. It could still be a
thief who had stolen the computer and cracked the keyring password.
2. Purchase order
This is the request from the cardholder to buy something. The request
message is in fact two messages combined, the order instruction (OI), which
is sent in the clear to the merchant, and the purchase instruction (PI), which
the merchant passes on to the acquirer payment gateway. The PI is
encrypted in the public key of the acquirer, so the merchant cannot read it.
The merchant stores the message for later transmission to the acquirer. The
PI also includes a hash of the OI, so the two messages can only be handled
as a pair. Note that the card number is only placed in the PI portion of the
request. This means that the merchant never has access to it, thereby
preventing a fraudulent user from setting up a false store front to collect credit
card information.
The purchase order has a response, which is usually sent (as shown here)
after acquirer approval has been granted. However, the merchant can
complete the transaction with the cardholder before authorization, in which
case the cardholder would see a message that the request was accepted
pending authorization.
3. Authorization
In this request, the merchant asks the acquirer, through the acquirer payment
gateway, to authorize the request. The message includes a description of the
purchase and the cost. It also includes the PI from the purchase order that the
cardholder sent. In this way, the acquirer knows that the merchant and the
cardholder both agree on what is being purchased and the amount.
When the acquirer receives the request, it uses the existing bank card
network to authorize the request and sends back an appropriate response.
4. Inquiry
The cardholder might want to know how his or her request is proceeding. The
SET specification provides an inquiry transaction for that purpose.
882 TCP/IP Tutorial and Technical Overview