The procedure for this is depicted in Figure 1: Also, an ATM Vendor’s CA certificates can be imported into CKMS for validation of the received certificates.įigure 1: Integration between CKMS and the ATM Manager Key Custodians can therefore generate a key pair from CKMS and request certificates to Wincor, Diebold or NCR in the appropriate formats and receive certificates in return. In the case of the IBM Mainframe, CKMS will generate the public key data set (PKDS) files for RSA key pairs and cryptographic key data set (CKDS) files for Terminal Master Keys.ĬKMS implements certificate workflow management for the main ATM vendor CAs. In short, CKMS helps secure the crypto payload required for ATM RKL – the delivery of such payload being based on mechanisms in the ATM management system which implement ATM vendor specific transport protocol to push the generated keys to th e ATM EPP. The solution offers advanced key life-cycle management for both symmetric and asymmetric keys, including certificates, and features a secure key distribution interface which allows for key material to be securely distributed to the Host or ATM Management depending of the architecture of the acquirer – which is sometimes merged into one single system (e.g., IBM mainframe). EPP key pairs and signatures/certificates management and distribution.The Crypto Key Management System (CKMS) can help with both:
This operation is also highly sensitive since this establishes the trust between the Host/ATM Manager and all ATMs managed for a specific brand. Diebold, NCR, Wincor) each handling the certificate management workflow and signatures format in a slightly different fashion.
#Atm master key update
Most ATM vendors support Remote Key Loading protocols for this purpose, allowing to remotely update and distribute TMK keys over a proprietary protocol and ensure delivery of the payload to the ATM over a secure channel.īut how do we solve the problem of managing and updating the asymmetric EPP keys on the Host/ATM Manager side? This can be a complex operation since most acquirers have different ATM brands (e.g. Note here that some ATM manufacturers use certificates for this purpose (e.g., Diebold) while others use signatures (e.g., Wincor, NCR).įor compliance reasons, the Terminal Master Keys must be updated regularly. The encrypting pin pad (EPP) key is signed by a key entrusted by the ATM manufacturer which operates the certificate authority. Mutual-authentication of the host/ATM Manager and ATMs as well as the encryption of the Terminal Master Keys are based on asymmetric encryption, i.e. The ATM Remote Key Loading (ATM RKL) process consists of transporting securely these Terminal Master Keys from the Host/ATM Manager to the ATMs. Symmetric keys referred to as Terminal Master Keys (TMK) are used in the ATM to protect the PIN block during the transaction.
#Atm master key code
This EPP unit is used to protect the PIN code entered by the cardholder from the ATM unit to the ATM Host. This article describes how Cryptomathic CKMS addresses the challenges of key generation and distribution for ATM Remote Key Loading.ĪTMs always feature an Encrypting Pin Pad, a so-called EPP device, which has to comply against strict security requirements, namely the PCI PIN Security Requirements and Testing Procedures. Yet managing the top-level keys to establish trust between the Host and the ATM units remains a challenge. ATM Remote Key Loading has become a common practice in the industry.
0 kommentar(er)
