EMV 101. Guy Berg Senior Managing Consultant MasterCard Advisors

Transcription

1 EMV 101 Guy Berg Senior Managing Consultant MasterCard Advisors

2 EMV Fundamentals I. Transaction Processing Comparison Ø Magnetic Stripe vs. EMV Transaction Security Points Ø Data Breach and Skimming Protection Mechanisms Ø Mobile NFC Connection with EMV II. EMV Application Fundamentals Ø On-line Card Authentication Ø Off-line Card Authentication Ø Offline Authorization Ø Risk Management Ø Cardholder Verification Method

3 Magnetic Stripe Transaction uses static authentication data that can be skimmed Track data Auth Code Track Data Auth Code Payment Network Acquirer System 3) Authorization message Ø Track data is often in the clear Ø The authentication data is static 2) Terminal performs little or no risk assessment relative to the magnetic stripe Issuer Auth System 1) Magnetic stripe is easily cloned 4) Authorization/Authentication Ø Risk assessment performed at the host Ø Host cannot recognized cloned cards

4 EMV Transaction Processing Introduces dynamic authentication that makes copied data useless at POS Field/DE 55 ARPC Field/DE 55 Field/DE 55 ARPC Payment Brand (3) Add New EMV EMV Field authentication 55 data data Acquirer System (2) Terminal performs risk assessment (1) EMV Chip application performs risk assessment New dynamic authentication data Issuer Auth System (4) New Issuer Authorization Functions Ø Dynamic cryptogram validation Ø May return an authentication cryptogram Ø Post issuance updates

5 EMV leverages card, terminal, messaging and host system security technology to protect against counterfeit fraud Multiple protection mechanisms are used in concert to combat card skimming, counterfeit card production and data breach threats CVC 1 and CVV 1 Front of Card Each of these calculated values are different CVC 2 and CVV 2 Issuer EMV Dynamic Authentication Chip CVC EMV online CAM ARQC EMV offline CAM DDA/CDA Front of Card Host Authorization rules

6 1 EMV Contactless and Mobile Contactless: How it Works EMV payments are enabled on payment devices through secure elements Application Layer Secure Elements EMV Application EMV Data EMV Keys Physical Packaging SIM card (UICC) Embedded chip Micro SD Payment Devices Future Possibility Mobile NFC

7 Terminal Perspective EMV Logic Impact Contact, Contactless and Mobile EMV NFC Each Brand requires EMV terminal certification Consumer Prompting Logic Contactless Kernels (Contactless Card and Mobile NFC) Separate Visa MC AMEX Discover EMV Contact Kernel (Common Kernel) Visa MC AMEX Discover Others Terminal Operating System

8 EMV introduces new data, cryptographic processes and security keys M/Chip 4 Tags Chip Data VSDC Tags Chip Data D3 D5 D7 D9 D8 C3 C4 C5 CD CE CF C8 C9 D1 D6 9F 14 CA 9F 23 CB 9F6C 9F62 9F63 9F64 9F65 9F66 9F F6B Additional Check Table Application Control (Contact) Application Control (Contactless) Application File Locator (Contactless) Application Interchange Profile (Contactless) Card Issuer Action Code (CIAC) - Denial Card Issuer Action Code (CIAC) - Default Card Issuer Action Code (CIAC) Online Card Issuer Action Code Default (Contactless) Card Issuer Action Code Online (Contactless) Card Issuer Action Code Denial (Contactless) Card Risk Management (CRM) Country Code Card Risk Management (CRM) Currency Code Currency Conversion Table Default ARPC Response Code Lower Consecutive Offline Limit (LCOL) Lower Cum. Offline Transaction Amt (LCOTA) Upper Consecutive Offline Limit (UCOL) Upper Cum. Offline Transaction Amt (UCOTA) Magstripe Application Version Number PCVC3 Track1 (Contactless) PUNATC Track1 (Contactless) NATC Track1 (Contactless) PCVC3 Track2 (Contactless) PUNATC Track2 (Contactless) NATC Track2 (Contactless) Track1 Data (Contactless) Track2 Data (Contactless) 9F51 9F52 9F53 9F54 9F55 9F56 9F57 9F58 9F59 9F5C 9F5D 9F5E 9F68 9F72 9F73 9F77 9F78 9F79 9F7F Key Key Key Key Key Application Currency Code Application Default Action Cons Trx Counter International Limit (CTCIL) Cum Total Transaction Amount Limit (CTTAL) Geography Indicator Issuer Authentication Indicator Issuer Country Code Cons Trx Counter Limit (CTCL) Cons Trx Counter Upper Limit (CTCUL) Cum Total Trx Amt Upper Limit (CTTAUL) Available Offline Spending Amount Cons Trx International Upper Limit (CTIUL) Card Additional Processes Cons Trx Counter International Country Limit (CTCICL) Currency Conversion Parameters VLP Funds Limit VLP Single Transaction Limit VLP Available Funds Card Production Life Cycle History (CPLC) MDK AC MDK SMI MDK SMC MDK IDN MDK CVC3

9 Chip security provides both card stock security and transaction security Pre-issuance Security Transaction Security Card Stock Security EMV Card Configuration Data Issuance Security Data Preparation Key Management Risk Management Decision Criteria Online Security Functions Symmetric Keys Offline Security Functions Asymmetric Keys EMV Data Cardholder Verification Methods

10 EMV Security Functions Performed Online Online Transaction Security 1 Online Card Authentication (Online CAM) 2 EMV Data Assessed Online

11 On-line CAM (Card Authentication) EMV transaction data ARQC ARPC EMV transaction data ARQC ARPC Payment Brand Dynamic Authentication Code Acquirer System ARPC Online Request (ARQC) Issuer Auth System 3DES (Shared Key) Cryptography Hardware Security Module and Key Management System Embedded 3DES crypto processor

12 EMV message data also increases online fraud detection security EMV Data Field/DE 55 EMV Data Field/DE 55 Payment Brand Acquirer System Add EMV Field 55 data New EMV authentication data Issuer Auth System

13 New EMV data in the authorization message enhances authorization decisioning ISO 8583 Field or DE 55 Application Cryptogram Cryptogram Information Data Issuer Application Data Application Interchange Profile Terminal Verification Result Terminal Capabilities Cardholder Verification Method Results Unpredictable Number Application Transaction Counter Authorization Strategies Authorization Rules Fraud Rules Amount, Authorized (Numeric) Transaction Currency Code Transaction Date Transaction Type Transaction Currency Code Terminal Country Code

14 The new EMV information in the authorization message increases the issuers security tools Issuer Auth System Issuer Authorization Tools Ø Increased use of authentication security keys ü EMV ARQC dynamic cryptogram validation Ø Enhanced Authorization assessment rules ü Cross check terminal and card results Ø Offline PIN Optional for cardholder verification Ø Online PIN Optional for cardholder verification Ø Post issuance card updates Ø ARPC

15 EMV Security Functions Performed Offline Offline Security Functions 1 Offline Card Authentication (Offline CAM) Asymmetric Keys 2 Offline Authorization (Offline Transaction) 3 Offline PIN (Cardholder Verification Option)

16 EMV Offline security functions require asymmetric keys and certificates Card provides: Public Key Technology Security Terminal contains: Issuer Public Key Certificate Payment Network Public Key DDA/CDA Card Authentication Card Public Key Certificate Issuer Public Key Card Public Key Used to verify Signature over Dynamic Data

17 Offline Card Authentication (Simple Example) Certificate Authority CA Private Key CA Public Key Acquirer loads the Public Key to the Terminal CA Public Key CA Private Key signs ISS Public key certificate request data Issuer PK Certificate Loaded to the card before Issuance Authenticates the card is legitimate Does not verify who is using it! Offline DDA/CDA Card Authentication

18 Off-line CAM (Card Authentication Method) Options Offline Card Authentication Options DDA Dynamic Data Authentication Issuer Public Key Certificate ICC Public Key Certificate CDA Combined Data Authentication Issuer Public Key Certificate ICC Public Key Certificate Application Cryptogram (Transaction Certificate) Card (Chip) Level Certificate Dynamic offline card authentication is unique per transaction

19 Offline authorization risk parameters are loaded at personalization 2 Offline Authorization (Offline Transaction) Offline Risk Management on the Chip Consecutive Transaction Counter Last Online Application Transaction Counter Lower Consecutive Offline Limit Upper Consecutive Offline Limit Lower Consecutive Offline Amount Upper Consecutive Offline Amount Offline Authorization Parameters PIN PIN Try Limit PIN Try Counter Issuer Action Codes Card Issuer Action Codes

20 EMV Cardholder Verification settings CVM Options Example: CVM List Selected No CVM Signature On-line PIN at ATM On-line PIN at POS Off-line PIN plain texted Off-line PIN enciphered Online PIN at ATM Offline PIN at POS Signature No CVM

21 The highest priority CVM on the card that is supported by the terminal is used Terminal Capability Profile POS Terminal CVM 1 Online PIN for ATM Offline PIN CVM 2 Online PIN at POS Signature CVM 3 Signature at POS CVM 5 No CVM at POS

22 Terminal Perspective EMV Logic Impact Each Brand requires EMV terminal certification Consumer Prompting Logic Visa EMV Config Data, processing rules and AIDs MC EMV Config Data, processing rules and AIDs AMEX EMV Config Data, processing rules and AIDs Discover EMV Config Data, processing rules and AIDs Other Config Data, processing rules and AIDs EMV Contact Kernel EMV terminal functions that EMV Co tests against the EMV standards and provides a type approval Terminal Operating System

23 Acquirers are required to Brand certify each terminal type that they deploy Customer 1 Terminal Type 1 Terminal Type 2 Customer 2 Terminal Type 3 Customer 3 Customer 4 Integrated EMV Terminal Acquirer System Customer 5 Customer. Petroleum Pay at the Pump Kiosk Terminals Customer.

24 The AID provides a method for the terminal to recognize what applications exist on a chip card So what is an AID? AID An Identifier that must be registered with ISO Identifies an application owner Identifies application required logic for operation Specific product offerings MasterCard EMV Application (M/Chip) MasterCard Maestro Payment Network (Application owner) Operating rules are linked to AIDs Role of the AID Provides a way for the chip to tell the terminal what applications reside on it Provides the terminal a method to identify if it supports an application on a chip

25 The terminals maintain a list of AIDs that it supports The terminal keeps a list of AIDs that it can support An Issuer loads applications and corresponding AIDs to the chip List of AIDs supported by the terminal MC Debit/Credit AID A MC U.S. Maestro Common AID A Visa A Visa U.S. Common AID A Discover AID A Logic and configuration data specific to each AID must be added to the terminal

26 All stakeholders need to migrate to receive the full benefit of EMF Issuer EMV Messaging Acquirer ü ü ü ü ü New card data New messaging data New application logic New configuration settings Enhanced authorization/fraud strategies Card / Device NFC EMV Contact Contactless Terminal

27 Guy Berg Senior Managing Consultant MasterCard Advisors Smart Card Alliance 191 Clarksville Rd. Princeton Junction, NJ (800)