Tokenization: What, Why and How

Transcription

1 Tokenization: What, Why and How 11/5/2015 UL Transaction Security 2011 Underwriters Laboratories Inc.

2

3 We have EMV why do we need tokenization?

4 From Magstripe Merchant Signature Issuer Magstripe Risk Management CVV / CVC / CSC Cardholder Issuing bank Online PIN

5 to EMV Merchant Signature Offline PIN Offline Data Authentication (SDA, DDA, CDA) Card Authentication (Request Cryptogram) Issuer EMV Risk Management Cardholder Card Risk Management Issuer Authentication (Response Cryptogram) Issuing bank Online PIN

6 But EMV solves only part of the problem! I can trust the cards and their users I am protected against Liability Shift But what goes out through the back door? networks Issuers I can trust the response from the Issuer Host I can trust the card in the terminal

7 Tokenization explained

8 Beware the terminology! Tokenization and Tokens have many different meanings in this industry! We will use the EMVCo terminology.

9 What is a Token? Token: A surrogate value for a PAN that is that must pass basic validation rules of an account number. Token should be compatible with current transaction routing rails Tokenization is the process of replacing the PAN by a payment token. Token Cryptogram: A cryptogram generated using the Token and additional transaction data to create a transaction-unique value. Similar to the Application Cryptogram in EMV Can be a dynamic CVC value

10 Tokenization reduces impact of fraud Card Tokenization Reduce impact Improves security by removing payment creden4als from transac4on with minimum changes to the processing infrastructure in a technology neutral way. Reduce likelihood of fraud Token

11 Token domain In order to prevent cross-channel and cross-merchant fraud, it is possible to restrict the usage of tokens only to specific domains. Domains can be: Ø Channel specific Ø Merchant specific Ø Digital wallet specific Token domain restriction controls are performed during transaction processing. NFC payment At Starbucks

12 Token assurance level Not all tokens are equally strong... Before token issuance, identification and validation (ID &V) methods can be used. Depending on the level of authentication, the token may have a higher assurance. Card issuer authentication (SMS, 3DS,...) Risk scoring using data (IP, device ID,...) $0 authorization, CVC2, AVS checks How strong is the binding between cardholder and token? No ID&V performed

13 Tokenization roles Cardholder Acquirer Issuer Do not (always) need to know that token replaces account Process transac4ons. New fields to support tokeniza4on. Maintain current role. Authen4cate cardholder. Token Requestor Token Service Provider Network En4ty reques4ng the PAN to be replaced by a Token. Can be: Issuers Merchants Wallet providers Provide Tokens to registered Token Requestors. Token provisioning Maintain Token vault Provide APIs Risk management Should provide messaging support to process tokens. EMVCo suggests that the Network is the natural player to be the Token Service Provider.

14 Tokenization examples Acquirer Level Network Level Cloud Based Mobile s

15 Acquirer Level Tokenization Encryption and Tokenization combined POI Merchant Acquirer / Processor Network Issuer ENC ENC PAN PAN Token Token PAN PAN PAN Token Token PAN Clear text PAN Merchant s backend Database Secure vault ENCRYPTED Encrypted PAN TOKEN Tokenized PAN

16 Side Step: Card Evolution Embossed Magnetic Stripe EMV Manual payment transactions Limited fraud protection Electronic transactions Static fraud protection Electronic transactions Dynamic fraud protection Contactless MSD Improved fraud protection (dcvv) Contactless EMV Comparable to Contact EMV Local SEs

17 Network Level Tokenization de-tokenization Cryptogram validation Token Token Real card # Real card # Token Acquirer Token Network Issuer

18 Network Level Tokenization Gateway Token de-tokenization Cryptogram validation Internet Token Real card # Real card # Acquirer Token Network Issuer

19 Side Step: Card Evolution Embossed Magnetic Stripe EMV Manual payment transactions Limited fraud protection Electronic transactions Static fraud protection Electronic transactions Dynamic fraud protection Contactless MSD Improved fraud protection (dcvv) Contactless EMV Comparable to Contact EMV Local SEs

20 Cloud Based Mobile s Provisioning a Card 5. Token/Key generation 6. Token/Key sending network Wallet Provider Server 7. Token/Key delivered 4. Card approved for wallet 1. User input: card details 2. Wallet requests card Issuer 3. Identification/Verification

21 Cloud Based Mobile s 3. Authorization (Funds check) Issuing Bank 2. PAN Translation Crypto validation Acquiring Bank network 1. Use LUKs to calculate cryptogram

22 Cloud Based Mobile s MDES and VDEP Application Server AES CMS TMS Processor host System (Issuers) Mobile Application Platform Cloud-based Platform Processor host System (Issuers) Internet MDES Internet VDEP Network Network Mobile Device Mobile Device Cloud-based payments SW Aquirer Cloud-based payments SW Aquirer HCE APIs HCE APIs NFC controller Merchant POS NFC controller Merchant POS Confidential - Internal use only

23 Conclusions EMV is not enough Tokens allow for Asset Devaluation PAN (EMVco) Token vs. Token Cryptogram Protecting data at rest, ecommerce CBMP use Token Cryptograms ApplePay uses PAN tokenizantion

24 Thank You Principal Consultant UL Transaction Security

25 Challenges The idea of tokenization is to allow transactions to be performed using the current processing rails, without changes to all existing routing mechanisms. However, there are important impacts that need to be considered: Handling of clearing files with tokenized data Pre- authoriza4on followed by payment with physical card [e.g. hotel] Card product differen4ators and related interchange fees [e.g. MasterCard Black, Visa Pla4num] Card- linked benefits [e.g. points, mileage, insurance] Recurring payments and par4al shipment Refunds and cancella4on flows Handling chargebacks and disputes