Choosing the Correct Card Technologies, Options and Card Management Strategies for Issuers

Transcription

1 Choosing the Correct Card Technologies, Options and Card Management Strategies for Issuers Philip Andreae Director Field Marketing Oberthur Technologies

2 Why Are We Here? August 2011: Visa Inc. announced its roadmap June 2012: American Express, Discover and MasterCard agreed to converge on the same common Bmeline April 2013: Acquirers and processors must support EMV transacbons October 2015: Liability shik Liability is the responsibility of the party not protecbng the transacbon Liability remains the issuer s if merchant upgrades to EMV October 2017: Liability shik for gas stabons December 2013: Following a number of compromises Target, Neiman Marcus has come for the U.S. to embrace EMV 2

3 Key Decisions What capabilibes? AuthenBcaBon method: DDA/CDA to support offline or 100% online? VerificaBon method: Online/in chip PIN or signature? AuthorizaBon method: Offline capable or 100% online? Which applicabons to support? Transit, data storage or access control? MChip, VIS, AEIPS, D- Pas or CPA? Durbin approach: Which debit networks? Leader, fast following or not interested? InternaBonal travelers first? Which segments of the credit por]olio? Which segments of the debit por]olio? Which segments of the commercial and T&E por]olio? Mass issuance or standard reissuance? Which chip? What operabng system? What memory size? Cryptographic capabilibes? Interface contact or dual? 3

4 Three Key Capabilities Define the Capability the Smart Card Must Support Unique serial number and cerbficates valid scheme, issuer and card Authentication What you have Online authen6ca6on with offline op6on Verification What you know PIN verified in chip or on issuer host Authorization You have the funds Card risk management Terminal risk management 4

5 Authentication Public key loaded in terminal Issuer is a member Card is authenbcated Payment networks have cerbficate authority Public keys are distributed to all terminals supporbng offline data authenbcabon Issuer registers with payment network Payment networks provides issuer cerbficate A set of keys and cerbficates are loaded in the card at personalizabon The point of sale terminal authenbcates the digital cerbficates provided by the card EMV supports 3 offline card authenbcabon methods: Sta@c data authen@ca@on (SDA): The data verified by the POS is always the same Dynamic data authen@ca@on (DDA): The data verified by the POS is dynamic for each transacbon Combined DDA and applica@on cryptogram (CDA): Merges DDA with the applicabon cryptogram InternaBonal schemes require DDA or CDA if offline capable is desired 5

6 Verification Chip and PIN Chip and Signature Chip and Choice Verified in Card or On Host PIN SynchronizaBon Consumer Choice EMV offers the issuer various cardholder verificabon methods, like: Online PIN verificabon In- chip PIN verificabon Clear text or encipher PIN Signature verificabon No CVM Or any combinabon, including rules: No CVM below $10 Offline PIN between $10 and $100 Offline PIN + signature above $1,000 Phantom PIN is also possible 6

7 Authorization Terminal Requests TC Offline ARQC Online AAC Decline TC Offline Card Decided ARQC Online Yes Yes Yes Why Yes Yes Why Why Yes AAC Decline The design of EMV assured issuer control: Terminal risk management: The merchant sets a floor limit under which the terminal will ask the card to approve the transacbon Card risk management: Parameters defined the issuer ulbmately decides The value of offline authorizabon: The issuer always decides Reduces the cost of authorizabon Reduced the transacbon Bme 7

8 Field 55 Supports Online Authentication and Card Life Cycle Management Merchant Acquiring Bank Payment Switch Issuing Bank or Financial Request: The ARQC to authenbcate the card to the issuer Terminal Interface to chip: Prepare authorizabon request DraK data capture Acquirer Select appropriate route Forward to payment network Payment Network Validate transacbons Route to issuer Issuer AuthenBcate ARQC Authorize transacbon Prepare ARPC and scripts Return authorizabon response or Financial Response: The ARPC authenbcates the issuer to the card (A chance to update the card with scripts) Clearing Record: The transacbon cerbficabon to assure irrefutability AuthenBcate TC Seole towards payment system 8

9 How Will the Chip Card Communicate with the Terminal? Contact card: 1. One chip connected to external contacts 2. Works only in contact mode Pure contactless card*: 1. One chip connected to the antenna and buried inside plasbc body 2. Works only in contactless mode Dual interface card*: 1. One chip embedded with external contacts and antenna connecbons 2. Works in contact and contactless mode (contactless like US contactless and NFC transacbons future proof solubon) *Not compa6ble with foil card designs 9

10 Elements of Comparison NATIVE JAVASCRIPT MULTOS Proprietary OS: Supplied by all major vendors Highly secure: Hardware (EAL5+) and sokware (EAL4+). Dominant smart card technology: Most widely deployed to date Full EMV compabbility for single and mulb- applicabons payment cards Offer best price compebbveness to issuers. Ideal choice for EMV migrabng markets and mass volume penetrabon strategy OpBmized OS and applicabons for best- in- class memory consumpbon and Bming performances Full compabbility with EMV common personalizabon systems offering issuers mulbple sourcing and seamless products migrabons (lower switching cost). Many providers compebng on performance and security, with mulbple silicon providers Industry open standard: Offer the largest mulb- sourcing to issuers High portability and security Open business model: Issuer- centric or mulb- issuer Possibility to reuse exisbng infrastructure (KMS, CA) Java cards can be issued using any global pla]orm compliant infrastructure such as personalizabon equipment and key management system Healthy compebbon brings innovabon faster to the market place, along with compebbve prices for the issuers ApplicaBons developed in Java standard language known by most developers Large pool of OS implementers compebng on performance and security, with mulbple silicon providers Proprietary standard High security standards Issuer- centric model Must set up a MULTOS compliant KMA or outsource the service to StepNexus All MULTOS implementabons must pass MULTOS type approval Centralized applicabon model Applet code size is usually smaller than for Java card. This saves space in EEPROM. ApplicaBons developed in MEL proprietary assembly language known by few developers 5 OS implementers with 5 different silicon providers. 1 OS implementer has 80% market share. Limited price compebbon between card vendors 10

11 Applications, Offline Characteristics and Interfaces Establish the Requirement of the Chip 1 Contact Contactless Dual RSA TDES Secrets MChip VSDC AEIPS Transit Access PKI 1. AID(s) 2. Keys 3. ConfiguraBon Parameters 4. Card Risk Management Parameters 5. Counters 6. PIN