Genesys Cloud - Main

 View Only

Sign Up

  • 1.  secure variables

    Posted 30 days ago
    Hi All,
    We are currently developing a secure flow for setting and resetting payment card PINs in the banking sector. As part of this flow, the customer is required to enter a PIN and then re-enter it for confirmation.
     
    Both PIN entries are stored as secure variables. However, we are unable to use secure variables directly in a condition for comparison or validation. This prevents us from verifying whether the original PIN and the re-entered PIN are identical.
     
    We would appreciate your guidance on whether there is any supported method or best practice that would allow us to compare the original PIN and the re-entered PIN while keeping both values as secure variables throughout the process.
     
    Please note that using the Extract Secure Data action would convert the secure data into an insecure format. This would introduce a security risk and is therefore not acceptable for our use case.
     
    Could you please advise on the recommended approach for securely performing this PIN validation in secure flows?
    thank you

    #ArchitectandDesign
    #Security

    ------------------------------
    Narasimha
    ------------------------------


  • 2.  RE: secure variables
    Best Answer

    Posted 30 days ago

    Hi Narasimha,

    My understanding is that Call Secure Data could be an option for this.

    Rather than using Extract Secure Data, you could pass both secure PIN variables as inputs to a secure Data Action and perform the comparison in the backend. The action could then return only a non-sensitive result such as PinsMatch = true/false, which you could use in a Decision within the flow.

    The Genesys documentation specifically mentions that Call Secure Data has read access to secure variables and allows them to be used in the action expressions without first extracting them to non-secure variables:

    https://help.genesys.cloud/articles/call-secure-data-data-action/

    The Data Action would need to be marked PCI-compliant, and the actual PIN comparison would be performed by the backend rather than directly within Architect.

    Hope this helps!



    ------------------------------
    Phaneendra
    Technical Solutions Consultant
    ------------------------------



  • 3.  RE: secure variables

    Posted 30 days ago

    Thank you Phaneendra 



    ------------------------------
    Narasimha
    ------------------------------

    Original Message


  • 4.  RE: secure variables

    Posted 30 days ago

    Anytime happy to share and learn.



    ------------------------------
    Phaneendra
    Technical Solutions Consultant
    ------------------------------

    Original Message


  • 5.  RE: secure variables

    Posted 29 days ago

    It is possible to use/compare the secure variables within an Extract Secure Data step, but without extracting the variables individually to corresponding non-secure variables.

    In your scenario you could have an Extract Secure Data step that computes a Boolean value based on an expression, e.g. If(Task.enteredPIN == Task.correctPIN, true, false).

    The output of the step will then just be the result of the verification and the entered/known PIN values still need only be stored as secure variables.



    ------------------------------
    Jonathan Wilford

    ------------------------------



Related Content