EMV Software - Chip Writer

The standard has been developed jointly by Europay, MasterCard and Visa to improve the security of financial transactions since 1996. The goal is to provide standards for chip-based card payments that are globally compatible. Taking into account the description of the payment operation and the functionality of EMV cards, the following main components are taken into account: the issuing bank, the bank that issued the payment card, and whose account is located in this bank; points; the acquiring bank is a bank that services the payment terminal EMV card a plastic card that contains a microprocessor and an operating system that controls the device and controls access to objects in its memory; a payment terminal is a device that provides work with a payment card

The main components of an EMV Transaction Authentication Refers to the process of proving that the card (or the application on the card) issued by the bank authorizes the relevant payment system. This process occurs in the general case, after reading the card data, the terminal sends them through the acquiring bank and the payment system to the issuing bank. The issuer determines its authenticity based on the card data. This process is one of the main security problems of magnetic card payments. On the one hand, the integrity of the magnetic card data is reliably protected by the CVV/CVC code. Card Verification Code, CVV from the English Card Verification Value) and it is useless to modify them. On the other hand, it’s pretty easy to copy the entire card.

The authentication scheme for a magnetic stripe card Where the following problems occur in the use of magnetic stripe cards: magnetic cards are easy to copy; the payment terminal practically does not assess the risks of a magnetic stripe transaction; tracking data (from the English Track data) this means that the authentication process data is static, and these card data are transmitted to the issuing bank and do not change during the entire validity period of the card; the issuing bank – risk assessment is performed on the host, which cannot recognize the cloned cards. Authentication of the EMV card In this case, the solution to the above problem lies in the digital signature of the static card data and transaction data that are sent to the issuer. Since the digital signature is unique for each transaction, forging or copying an EMV card is a non-trivial task.

The authentication scheme for EMV cards Where their terms are described as follows: ARPC (from the English Authorization Response Cryptogram) cryptograms that are generated by the issuer and used to verify when the response came from the issuer. Field/DE 55 in connection with the ISO-8583 standard, it means “Integrated Data chip”, indicates how to encode information on the card and can give new EMV authentication data; EMV card can perform risk assessment and give new dynamic authentication data at each time; Payment terminal can perform risk assessment; The issuing bank can give dynamic cryptogram verification, return authentication cryptograms, and perform mail issue updates. That is, the dynamic authentication of the card during an EMV transaction begins at the moment the card is installed in the terminal, which transmits the transaction data to the card (amount, currency, country, etc.). Then the card and the terminal perform a mutual verification of the transaction risks. If both devices are “satisfied”, then the card signs the transaction data, and the terminal fills in the “DE 55” field with the received data and sends it to the acquiring bank. The latter, in turn, sends a message to the issuing bank. The issuer, having received the “DE 55” field, verifies the authenticity of the signature (hereinafter cryptograms)

This process is a highly simplified EVM transaction model. However, it reveals the main security aspect of EVM payments is the use of dynamic data for card authentication instead of static data, as happens with the magnetic stripe of the card. Security of an EMV transaction There are two different options for conducting a payment transaction online and offline: In online transactions, the issuer confirms in real time; In offline transactions, it is carried out by the terminal without instant confirmation by the bank. Such transactions are used for low-risk transactions or in the case, for example, of a lack of communication with the issuing bank. For these two types of transactions, there are two types of online and offline authentications, respectively: the online authentication operation is performed with the participation of the issuer; Offline authentication is confirmed by the payment terminal. It is worth clarifying that during an online transaction, both “online” and offline authentication can be performed simultaneously (if both the card and the terminal support this). Despite the redundancy of the scheme, at the authentication stage it is not always clear in which mode the transaction will take place. The transaction process between the EMV card and the terminal has its own conditionality

The legend of the transaction process diagram between the EMV card and the terminal Security functions are only part of the EMV transaction. In addition to authentication, security functions include: risk assessment of the transaction and verification of the cardholder (online and offline PIN, transaction amount, country, currency, etc.). In this way, you can observe the complete transaction process between the EMV card and the terminal.

Transaction execution procedure card terminal

INTERNAL AUTHENTICATION. If DDA; 2 (RECEIVE A CALL) if the PIN is encrypted offline; 3 (RECEIVE DATA) additionally for offline PIN; 4 (CHECK) if offline PIN; 5 (Generate a dynamic signature) if CDA; 6 (GENERATE a CRYPTOGRAM APPLICATION) if the first to generate a cryptogram response application, this is APRC. Online EMV transaction The main method of confirming the authenticity of the card in online transactions is the authentication of the card online.

This method is based on the generation of the ARQC cryptogram by the card (from the English Authorization Request Cryptogram) for each payment operation. Cryptogram generation and verification is based on the 3DES algorithm. The issuer and the card own a shared secret key MKac (from the English Application Cryptogram Master Key). At the beginning of the transaction, the card generates a SKac session key based on MKac (from the English Application Cryptogram Session Key). The 8-byte long ARQC cryptogram is generated by the card using the MAC algorithm, on the SKac session key using transaction data.

During the transaction, the ARQC cryptogram generated by the card is sent to the issuing bank, the Bank will verify the incoming ARQC with the cryptogram that it calculated independently. For this operation, the bank generates a session key, then, based on the received transaction data, its own ARQC is calculated. If the own (generated by the issuer) ARQC and ARQC cards converge, the card is genuine. Next, the issuer, using a similar algorithm based on dynamic transaction data and response data, generates an ARPC (from the English Authorization Response Cryptogram) and sends this cryptogram back to the card. At the moment when the card confirms the incoming ARPC, mutual authentication of the card and the issuer is completed. Youth Scientific and Technical Bulletin of the FS , ISSN

Online EMV transaction That is, as already mentioned, offline authentication may be present in an online transaction. However, in order not to complicate things, let’s consider a detailed description of offline authentication in the context of an offline transaction. Offline EMV transaction The peculiarity of an offline transaction is that the transaction is carried out by a card and a terminal without contacting the bank and the payment system. During such a transaction, the card can approve the transaction within the established limit, and the terminal, in turn, sends information to the bank later on schedule, or when there is a connection with the bank. Such offline transactions provide additional benefits to both the issuing bank and the cardholder. For example, the owner can pay even if there is no connection with the bank. Or, if the amount is small, the operation will take place much faster.

The scheme of static data authentication Online and offline authentication use different technologies. That is, if online uses the 3DES cryptographic algorithm, then in the case of offline, RSA with asymmetric keys is used. To use such different technologies for online identification, the keys are stored only by the card and the bank. In the case of offline, the key must be entrusted to the terminal. Given the presence of a large number of terminals, there is a possibility that the secret key trusted to terminals will not remain secret for long. At the head of everything is the payment system (more precisely, the certification authority), which issues a pair of keys: a private key (red) and a public key (blue). The bank issuer also has its own key pair. For its keys, the issuer generates a certificate in a special way (from the English Issuer Public Key Certificate), which contains the issuer’s public key. This certificate is signed (encrypted) with the private key of the payment system. During the personalization process, this certificate is uploaded to the card. When the payment terminal is installed in a retail outlet and connected to the Youth Scientific and Technical Bulletin of the FS, ISSN.

The public key of the payment system is loaded into the terminal through the acquiring bank. During the offline transaction, the terminal performs offline authentication of the card. First, the terminal deducts the Issuer Public Key Certificate from the card, and using the public key of the payment system verifies the correctness of the certificate signature (i.e. decrypts). If the signature is correct, the issuer’s public key is extracted. Then, using the issuer’s public key, the signature of the critical card data is verified, which confirms its authenticity. The method described above refers to static SDA authentication (from the English. Static Data Authentication). Currently, dynamic authentications are more often used: DDA (from the English Dynamic Data Authentication) and CDA (from the English Combined Data Authentication), which include SDA and additionally, by analogy with online, sign data that runs between the terminal and the card. The data is signed with the card’s private key, which is uploaded to the card during the personalization process. The signature is verified by the terminal using a public key recovered from the corresponding certificate. Conclusions The EMV payment card is a complex and high-tech product that reliably protects access to a bank account. A microprocessor-based EMV card is almost impossible to copy, and each transaction is protected by a unique digital signature. Any actions taking place inside the card are regulated by a strict set of rules with instructions on how to act in each specific case. In the process of creating payment EMV applications, they undergo mandatory multi-level certification and receive permission from the payment system to use them. With the help of the EMV standard and the use of the TLS v 1.2 protocol, secure data transfer between the client and the server becomes easier, as a high degree of security that ensures both banking operations.