Point-to-Point Encryption (P2PE) Service

P2PE is deployed to protect vulnerable zones or segments in the payments infrastructure. In point of sale (POS) environments, it protects data from the point of capture in the merchant environment to the next point of processing which is normally a payment gateway or acquirer. 

P2PE encrypts data at the point of capture (i.e. at the POS terminal or mPOS reader) and this data is maintained in an encrypted state thereafter and is only ever able to be decrypted inside the secure compound of a Hardware Security Module (HSM), leveraged typically by a service provider or gateway in the transaction processing value chain. 

The importance of P2PE

The key benefit to using P2PE is that the merchant cannot decrypt the data without authorized access to the cryptographic keys. Traditional POS systems are increasingly adopting P2PE to avoid vulnerabilities relating to the cleartext transmission of magnetic stripe and chip card track data. Mobile point-of-sale (mPOS) solutions inherently deploy P2PE because they involve untrusted devices (mobile phones or tablets) and untrusted networks (the internet) and the risk of mobile malware having access to cleartext account data is unacceptably high.

Benefits of P2PE

Security

• Use encryption to secure payment card data while in transit between the terminal and acquirer as part of a POS transaction

Compliance

• P2PE deployment significantly reduces the scope and cost of PCI compliance for merchants

Brand protection

• Inherently reduce the risk of a payment data breach, which would likely cause considerable damage to reputation and brand

Efficiency

• Simple to deploy, easy to scale, highly secure in use and transparent to merchants

Data Protection on Demand Point-to-Point Encryption (P2PE) Service

Working from our deep roots in the payment processing industry, Thales recognized the growing need for payment in the cloud services, and has added a P2PE service as part of the broader Payment Services portfolio within our flagship Data Protection on Demand (DPoD) platform.

The P2PE Service is now available with the free evaluation of DPoD. 

Features and Benefits

Security and Protection

• Protects data in transit and blocks malware that “sniffs” and “captures”
• Base Derivation Key (BDK) master key management – generation, distribution & storage
• DPoD uses FIPS 140-2 Level 3 Thales Luna HSM certified hardware for its cryptographic operations to ensure no cleartext exposure of keys or sensitive data

Easy to Integrate

• Container (which runs on customer premises) provides a REST service that communicates with the cloud service
• Assists with the certification of the overall PCI P2PE solution managed by the solution provider

Easy to Manage

• No upfront investment
• Subscription service – 99.95% SLA
• Managed by Thales, no need for specialist in-house security skillset
• Scale up or down to meet dynamic workload requirements