Ian Hermon | Product Marketing Manager
In my recent blog on the evolving PCI SSC initiatives in 2018, "Minor on PCI DSS, major on almost everything else," I outlined how the organisation is covering new areas to reflect the migration from physical card payments to online digital payments. Much of the latest innovation involves the use of mobile devices (for both initiation and acceptance) to provide greater flexibility in how payments can be made and offer additional methods to authenticate transactions. In many cases the need for the user to enter a PIN or passcode, for example, has been eliminated, and often the mobile endpoint in the solution relies solely on software-based security without the need for a Secure Element (SE) or chip as used in EMV payment cards. A key challenge is ensuring high levels of security in environments where untrusted devices and networks are used.
Digital payments fuelling a mixture of hardware and software security
The traditional payment card world effectively relies on a complete end-to-end hardware-based security infrastructure. The online, digital world is different – it accepts that a consumer mobile device is inherently untrusted and relies on a range of software security approaches underpinned by strong risk management and hardware-based security at the service provider or issuer to minimize the threat of fraudulent transactions. With payment cards we have a trusted bank-issued device where the cryptographic keys are secured inside the chip and are valid for the lifetime of the card. Contrast this with the mobile device equivalent which uses a host card emulation (HCE) approach where no SE is deployed. The keys are only valid for one or a few transactions and need to be regularly replenished. The common factor with cards is that the keys themselves are generated and secured in transit using hardware security modules (HSMs). This is just one example - other payment approaches that may look like they are based purely on software have fundamental requirements for HSMs at the back end for provisioning, management and authorization.
HSMs increasingly being mandated for critical tasks
It is significant that as the various PCI specification and guidance documents are updated, there is a general trend for more specific references to HSMs to cover some very specific tasks that are essential to ensure overall payment system security. The tasks include:
- Strong random key generation;
- Enforcement of dual control for highly sensitive operations;
- Secure key loading and sharing of keys as part of cryptographic zones;
- Ensuring that master keys are not exportable or exposed in clear text outside a tamper resistant secure boundary; and,
- Ensuring that PINs and other sensitive data are not exposed at interim network nodes.
The payment card brands have extensive experience in defining security requirements and helping the ecosystem participants to better manage their risk. Through the PCI documentation they have deemed that using software-based cryptography for all of these tasks could result in:
- Malware used to capture keys and sensitive data from server memory;
- Manipulation of PIN blocks in transit; and,
- The compromise of key-encrypting keys (used to secure cryptographic zones).
This is not an acceptable situation from a risk management point of view, hence the specific HSM requirements.
The PCI specifications with strict HSM requirements
Today you will find that five core specifications published by PCI SSC mandate the use of HSMs for various cryptographic processes:
- Point-to-point encryption (P2PE);
- PIN Security;
- Token Service Provider (TSP);
- Software-based PIN on COTS device (SPoC); and,
- 3-D Secure (3DS).
If you are involved in solutions requiring compliance with any of these security standards, a good starting point would be the payment HSM page on our web site to find out more about how our payShield HSMs can simply your compliance efforts.