Key considerations for selecting the right cloud for cards and payments processing
DXC Technology in Brazil weighed five alternatives for moving cards and payments services (C&PS) to the cloud. The outcome might surprise you.
When DXC’s Business Process Services (BPS) team in Brazil set out to upgrade systems for delivering a C&PS solution, the team primarily considered enterprise cloud vendors based on whether the cloud’s flexibility, scalability, performance and cost savings would align well with transaction-intensive environments.
Re-architecting an environment that supports dozens of workloads and applications essential for smooth and timely card processing for customers in Latin America was bound to be complex. DXC’s BPS team in Brazil needed to draw on its extensive customer experience to carefully plan a migration approach, evaluate potential solutions, and choose a platform that offered significant business and IT advantages over the existing, traditionally hosted — and outdated — system.
The BPS team evaluated five core options. This paper outlines the migration strategy DXC developed for this journey to the cloud and the reasons behind our decisions. We trust it will serve well as a guide for other organisations contemplating cloud adoption.
Challenges of the existing cards and payment services system
DXC’s BPS organisation supports the entire value chain for card services and payment merchant acquiring, including card authorisation, tokenisation, exception management and other functions. Processing these transactions involves many stages and networks that ferry transactions among merchants, processors and banks. DXC administers the card issuer’s credit criteria for applicants; authorises transactions via plastic, e-commerce or mobile payments; assesses interest and fees; and produces statement data.
DXC has more than 1,000 BPS employees in Brazil who process 61 million transactions each month for 15 major customers. With more than 20 years of experience in payments processing, DXC can deliver broad support capabilities for everything ranging from commercial agreements to fraud prevention.
The card processing system had adequately served the needs of BPS customers. However, the hardware was aging, and DXC needed a more efficient, cloud-based solution that would integrate effectively with emerging technologies and deliver the following benefits:
- Increased scalability and flexibility. Because credit card transaction volumes fluctuate, the BPS team needed a flexible cloud environment and OPEX model that would provide the ability to expand (and contract) based on volume.
- Improved performance. System latency was periodically causing customer dissatisfaction: Transformation to a fully integrated environment in the cloud would enhance performance in many areas, such as providing the ability to process more transactions faster.
- Cost savings. A major goal was to reduce hardware purchasing and maintenance costs. The BPS team wanted to tap into the power, flexibility and cost reductions that a cloud vendor could provide with as-a-service pricing.
Migration support
To manage the complexity of migrating C&PS to the cloud, the BPS team adopted a general strategy to first migrate databases and then follow with applications. The team divided the migration strategy into three primary components — treatment, complexity and wave definition:
- Treatment. The basic task facing the team was to migrate 60 business workloads and 24 apps that support the business. The team opted to migrate 19 workloads and 9 apps through image migration (mirroring the host to a virtual disk and migrating by starting an identical cloud instance from that). This included workloads that were already virtualised and running on old Windows servers. The team planned to migrate 35 workloads and 13 apps through reinstall, including Windows server workloads that needed to be upgraded. The remainder, 6 workloads and 2 apps, would be migrated through recompilation.
- Complexity. The team assigned one of three complexity levels to each of the apps supporting the business. Thirteen apps were categorised as simple to migrate, given their size and treatment. This included apps such as Linux jump server and Windows. Nine apps, such as PAYware and Postilion Office, were assigned medium complexity. Finally, two apps, PAYware Batch and IBM Sterling Connect Direct, were deemed complex.
- Wave definition. The current system was based on a “star” architecture with the most important app, PAYware, located at the center. Given the app’s architecture, the team opted to mitigate the migration risk by using a wave approach that aligned the app with the database type and migrated 3 to 8 apps and 12 to 18 servers in each wave. They would start by migrating the satellite apps and nonproduction databases in Waves 1 and 2, continue with production databases in Wave 3, and conclude with PAYware in Wave 4.
Choosing the best solution
With the migration strategy and approach firmly in place, it was time for the BPS team to select the best vendor to support it. The primary requirement was to identify a solution that would allow DXC to modernise the existing hosting environment based on equipment acquisition. The infrastructure layer needed to scale easily to meet new demands and growth without purchasing and/or duplicating hardware and software.
The team also sought a solution that would lower the cost per transaction, to make DXC more competitive in the market.
During the selection phase, the team collected a trove of information, such as the number and types of transactions being processed, requirements for storage input/output operations per second (IOPS), and capacities of the current environment.
From a technical standpoint, the BPS team needed a solution that could meet these requirements:
- Level 1 Payment Card Industry (PCI) compliance
- SLAs of 99.95 percent and 99.99 percent for critical applications
- Ability to accommodate vendor colocation encryption appliances from leading credit card providers
- Hardware security module (HSM) appliance to encrypt transactions
- Connectivity with partners and customers over dedicated MPLS links
- Infrastructure environment for quality assurance, development, production and disaster recovery, including a disaster recovery plan (DRP) infrastructure for the production environment
- Large capacity for storage input/output operations per second (IOPS)
- Ability to maintain performance at 400 transactions per second and accelerate if necessary
With operational and technical requirements clearly established, the team reviewed prospective solutions. Here’s what we considered and how we stacked up the alternatives.
Option 1: Oracle Cloud at customer
Oracle presented a solution centered on deploying Oracle Cloud at Customer (OCC) as the primary cloud solution. The approach would use current DXC data centers and OCC for virtualisation and application migration. The OCC solution includes both an Oracle Exadata Cloud at Customer (ExaCC) instance and an Oracle Cloud at Customer instance.
Here’s how the DXC analytics solution addressed the OEM’s core pricing challenge.
Pros: A key selling point of this solution was that it would bring the power and flexibility of Oracle Cloud to DXC’s own data centers, combining cloud simplicity with the convenience of an on-premises deployment. The solution also provided subscription-based, pay-as-you-go pricing and a smooth migration path of existing databases with no application changes. More specifically, Oracle Cloud at Customer was presented as an innovative solution that could accommodate migration of all the databases for DXC’s C&PS operations in Brazil. In addition, the solution provided many other innovative database and engineered systems features.
Cons: One of the drawbacks was that the Oracle Cloud at Customer contractual requirements meant DXC would need a longer-term contract than with the other options. The solution also did not leverage DXC’s existing storage environment, and the existing application environment would need to be migrated from Red Hat to Oracle Linux. Additionally, DXC would need to purchase incremental Oracle license.
Option 2: Third-party leading cloud provider
A leading third-party cloud provider proposed a solution centered on a scalable public cloud environment that would place application and database colocation appliances at the vendor’s data centers in Brazil.
Pros: The vendor provided a clear migration path to its data centers and the necessary colocation appliances from the leading credit card providers. Primary selling points were ease of use, reliability, flexibility, scalability and cost reductions from an OPEX model. The solution was fully on-demand, allowing workloads to be adjusted easily based on business needs, and could be cancelled at any time. As with any public cloud infrastructure, this vendor’s solution essentially provided unlimited scalability.
Cons: Since the DXC BPS team in Brazil relies on Oracle database technology, going with this solution would require implementing a third-party product to emulate the Oracle cluster. DXC would also need to purchase numerous Oracle licenses, including an Oracle Data Guard license for the database environment DRP. Locating the environment at the vendor’s data centers also presented some issues. For one, DXC would not be able to install its appliances and HSM equipment at the data centers. In addition, DXC would be unable to leverage the storage used in the existing C&PS environment.
Option 3: Third-party leading hardware provider
A leading third-party hardware provider proposed an approach that would combine a rack-scale hyperconverged system with networking software in a validated, ready-toorder package.
Pros: Key selling points of this solution were ease of scalability, high performance and a smooth migration from similar hardware. The turnkey solution provided a desirable server replication path from DXC’s main site to the vendor’s site. The vendor ensured the optimisation of DXC’s C&PS operations to a fully integrated environment.
Cons: As with the first two solutions, DXC would need to purchase Oracle licenses and not be able to leverage the existing DXC storage. However, unlike the first two options, this solution would mean operating under a CAPEX model, and therefore, this solution did not meet critical project requirements.
Option 4: Traditional refresh from a third-party leading hardware provider
DXC also had the option of using a traditional refresh that would maintain the existing operating model but update the servers, which would be furnished by a third-party leading hardware provider. This option would result in continued use of the on-demand DXC offering and present no migration impact. Notably, the traditional refresh and other approaches included the use of Oracle database servers.
Pros: This solution was the only one in which DXC could continue to use its existing on-demand storage offering. The solution would also allow DXC to maintain its current network. By refreshing only the existing servers, DXC would avoid the impact of a large migration of workloads and applications.
Cons: This solution did not meet critical project requirements. The obvious drawback was maintaining the existing CAPEX operating model. The solution also did not provide the performance and scalability improvements the other options did, including the ability to easily meet peaks in need.
Option 5: Third-party leading technology provider
A leading technology provider offered a well-proven cloud solution that was not closely considered due to the company’s lack of a data center presence in Brazil.
Cost comparison
Although cost was only one of the determining factors, it played a significant role in the decision-making process.
The winner: Oracle Cloud at Customer
After careful consideration, the DXC team selected the Oracle Cloud at Customer solution (Option 1) because it met all operational and technical requirements. The team also judged it the best solution for increasing the existing environment’s performance and database features, including the ability to process more transactions faster. It also promised the greatest anticipated cost savings. The team elected to implement one Oracle Exadata Cloud at Customer (ExaCC) instance and one Oracle Cloud at Customer (OCC) instance at two different sites. DXC will also implement Oracle Data Guard to meet stringent disaster recovery requirements.
The flexible environment allowed for effective integration of DXC’s existing credit card vendor encryption appliances and provided a more secure and stable service delivery platform than the leading cloud or hardware vendors could provide.
Oracle Cloud at Customer also offers improved performance levels, high availability, optimal security and seamless provisioning. Cloud automation software would reduce administration workloads and alleviate repetitive tasks.
In addition, DXC would be able to tap into the knowledge and resources developed in partnering with Oracle for more than two decades. This includes the ability to leverage the automated tools and standard processes of the DXC Migration Services for Oracle Cloud offering.
The OCC environment was projected to provide shorter I/O wait times, better CPU times, and a significant improvement in average latency, from 15 milliseconds to 0.5 milliseconds.
More specifically, Oracle emerged as the best solution by providing:
- Reduced LAN network connectivity time between applications and databases using InfiniBand technology
- Reduced I/O time by using high-performance storage integrated in the solution, including PCI Flash
- Software hybrid columnar compression
- Parallelised queries using smart analytics software
- DRP based on Oracle Data Guard process
Because the OCC environment would remain on premises at DXC, it would be easier to add new environments and platforms, meaning that there would be better scalability. By leveraging Oracle’s Cloud at Customer solution, DXC maintains control of many cloud configuration settings and policies that enable BPS to provide unique financial services to customers. Access to and control of these critical cloud configuration settings are not available from other leading cloud vendors, as their cloud solutions must run in the vendor’s data center.
The OCC solution also included the opportunity to perform data replication via Oracle Data Guard, which was included in the solution, as opposed to doing it via hardware. Finally, Oracle Exadata Cloud at Customer would accommodate a fully integrated C&PS environment and the preferred OPEX model.
Expected business benefits
DXC’s BPS team expects the following key business benefits:
Business agility. Based on the Oracle Cloud at Customer solution, the DXC business can scale the C&PS system rapidly as credit card transaction volume grows, without purchasing new hardware or hiring incremental IT staff. Likewise, the business can reduce its OCC subscription during an economic downturn without causing capital expense and depreciation issues.
Data compliance. DXC can tap into Oracle’s powerful cloud services while keeping the cloud operating environment on premises. Because the data remains on premises, DXC can comply with data sovereignty regulations and internal policies, as well as enforce data privacy and residency requirements more readily.
Better business support. Oracle Cloud Operations for OCC provides all platform support and change management, giving DXC the benefit of end-toend management of services delivered in DXC data centers. This is expected to allow C&PS accounts to accelerate time to deployment, increase availability and reduce business risk.
Resource savings. The Oracle Cloud at Customer solution provides savings on both hardware and labor. The hardware savings are achieved by taking a cloud approach, where only the required compute resources are purchased, rather than buying too much hardware to ensure sufficient capacity at peaks — which often means that capacity goes unused. Labor is saved by reducing the required number of hardware, OS and middleware professionals, who can then be redirected to higher-value business priorities.
Choose the right approach for your organisation
In looking for a solution to improve performance and reduce costs by digitally transforming operations to the cloud, DXC’s BPS operations in Brazil leaned on its technology expertise to develop well-defined requirements and then invited bids from proven vendors at the leading edge of the technology curve.
The decision to go with Oracle Cloud at Customer for the cloud migration was based on many factors, notably: anticipated performance improvements, the opportunity to maintain the environment on premises, and cost considerations.
Other organisations will, of course, be guided by their specific needs. But a key element of identifying the best solution is obtaining and developing a full understanding of the current system so no elements are overlooked when selecting a future architecture.
Enterprises looking to migrate essential business operations to the cloud should take a carefully crafted approach that does not focus on a single decision factor, but considers the full package being offered — weighing its various benefits and ability to meet project requirements. Enterprises should also carefully consider cloud solutions from several leading vendors, as the perceived market leader is not always the best choice.