POS/ATM Protection Profile for a Common European Banking Industry Approval Scheme Common Approval Scheme POI Working Group SRC Security Research & Consulting GmbH

Content Affected payment systems components Domestic evaluation schemes and Payment Card Industry (PCI) Single European Area requirements (SEPA) Common Approval Scheme (CAS) for banking IC cards CAS for POS/ATMs (POI)  POI PP Security Requirements  Experiences in the creation of the POI PP  Foresight

Affected Payment System Components Banking IC cards Point of Sale Terminal (POS)  IC card based electronic payment  Includes PIN Entry Device (PED) and other components (e.g. card reader) Automated Teller Machine (ATM)  IC card based electronic money withdrawal  Includes Encrypting PIN Pad (EPP) and other components ATM and POS both are defined as Point of Interactions (POIs)

Domestic Evaluation schemes Throughout many European countries the banking industry  Has set security requirements  To manage risks within payment systems effectively Compliance of payment systems components with these security requirements has to be proved by security evaluations Different security levels and requirements  Obstacle for mutual recognition of security evaluations

Examples for Domestic Evaluation Schemes APACS (United Kingdom)  Common Criteria (without formal certification)  Based on APACS PED Protection Profile ZKA (Germany)  Domestic high level security requirements  Informal scheme Currence (Netherlands)  PCI+

Payment Card Industry Evaluations Global Scheme with security requirements aligned by MasterCard and VISA  Evaluator performs steps based on test and security requirements defined by PCI  Composition of design, test and vulnerability analysis adapted for ATM (EPP) and POS (PED) Comparison to Common Criteria  Design evaluation based on vendor questionnaire, no code review (ADV_IMP)  Predefined test cases, no ALC, ACM, ADO  Requirements of resistance against high attack potential

SEPA Standardisation for Card Payments Use of international standards for cross-border and domestic transactions  Technical requirements for payment system components are becoming closely aligned throughout Europe The European Payments Council in its Single European Payment Area (SEPA) Cards Framework (SCF)  Defines certification principles as interoperability principles to be worked out  Security requirements and mutual recognition are explicitly stated

„In order for the objectives of this Framework to be achieved, SEPA-level interoperability must be ensured in the following 4 domains: cardholder to terminal interface, cards to terminal (EMV), terminal to acquirer interface (protocols or minimum requirements), acquirer to issuer interface, including network protocols (authorization and clearing).“ „A common process for the certification of terminals, cards, and network interfaces will be defined in line with the principle described in Chapter “ „Card schemes will engage in mutual recognition for type approval. Any terminal certified for SEPA transactions by a certification body in one SEPA country can be deployed in any SEPA country for acceptance of SEPA cards across all SCF compliant schemes.“ SEPA Standardisation for Card Payments EPC SEPA Cards Framework SCF:

Common Approval Scheme Initiative Common Approval Scheme (CAS) initiative has been originated  to agree on common security requirements harmonising the existing requirements  to agree on common evaluation methodology  using the Payment Card Industry (PCI) security requirements for POS/ATM as the basis for technical req. Reducing the number of security evaluations to be performed by manufacturers and reducing the costs of security certification

Countries BelgiumAtos Wordline, Banksys BelgiumAtos Wordline, Banksys France Cartes Bancaires France Cartes Bancaires Germany ZKA Germany ZKA Italy Progetto Microcircuito Italy Progetto Microcircuito LuxemburgCETREL LuxemburgCETREL NetherlandsCurrence, Equens NetherlandsCurrence, Equens NorwayBSK NorwayBSK PortugalSIBS PortugalSIBS SpainServired, Sistema 4B SpainServired, Sistema 4B SwedenPNC SwedenPNC United KingdomAPACS United KingdomAPACS... (open to additional participants)... (open to additional participants) CC experts involved: Trusted Labs (France) SiVenture (United Kingdom) SRC (Germany)

CAS Cards Working Group Harmonisation of security requirements and methodology accomplished Result is a finalised Generic Security Target for CC evaluations of banking IC cards Thus no Protection Profile for banking IC cards  Generic Security Target is a guideline Co-ordination with ISCI/JHAS Preparation of pilot evaluations Open question: Who will verify whether Security Target meets Generic Security Target?

CAS Terminal Working Group Work in progress: Evaluation according to PCI or CC?  Harmonisation of security requirements (in progress) Including PCI POS PED security requirements  Harmonisation of evaluation methodology (in progress) For CC approach results in POI Protection Profile  Within a feasibility study it will be examined whether CC evaluations conformant to the developed PP(s) pave the way for SCF compliant certification criteria and mutual recognition of security certificates

Generic POI Architecture

Security Problem and Security Objectives Assets  PIN, POI management and payment transaction data, software, cryptographic keys Threats  Perform unauthorised payment transactions by disclosure of PIN or keys or manipulation of software or data Security Objectives  Confidential PIN Entry and PIN Processing  Authentic and integer payment transaction  Authentic and integer usage of software and related hardware / application separation

CAS POI Security Requirements (subset) PCI  Physical and logical security requirements Tamper-responsive hardware, … Self-test, logical anomalies, … PCI +  Extension to message integrity for ATM/POS  Extension of requirements for Life Cycle  Code analysis PCI –  Plaintext PIN protection at level less than high  Magnetic stripe security

Challenges to create a PP for a complex product Define the Target of Evaluation  Different implementation architectures shall be allowed  Different payment system components (ATM, EPP, POS, PED) shall be considered  Application separation Two Evaluation Assurance Level  High attack potential as objective for PIN Entry and Enciphered PIN processing but low costs  Protection level for Plaintext PIN and POI management and transaction data processing below high  Different hardware security requirements

Minimum POI

POI components connected via an open network

POI Protection Profile

Foresight Finalising POI PP Pilot evaluation based on POI PP Mutual recognition and certification scheme  Discussion already started with BSI, DCSSI, CESG  Founding a group like ISCI/JHAS for IC cards Decision for PCI methodology or Common Criteria based on PCI functional security requirements Any questions?

SRC Security Research & Consulting GmbH Graurheindorfer Str. 149a Bonn Tel. +49-(0) Fax:+49-(0) WWW: Contact