Remote Key Loading

with ProTect/Enterprise

Remote Key Loading is the process of distributing the Terminal Master Key from a central administration point to the security module of the Self-Service Client.

Remote Key Loading Remote Key Loading is the process of distributing the Terminal Master Key from a central administration point to the EPP (Encrypted PIN Pad)/PED (PIN Entry Device). With the introduction of new regulations and the need to comply with the emerging security requirements stipulated by the various credit card organizations and international standard bodies e.g. Visa, MasterCard, ANSI etc. banks are finding themselves having to allocate an ever increasing amount of their administration budget in terminal key distribution and administration. Using an automated key distribution solution, terminal operators have the opportunity to drive down operating efficiency ratios by the introduction of a fully automated process while establishing improved security policies.

KMS = Key Management System HSM = Hardware Security Module

Switch/Host

KMS/HSM

PT/E Connector PT/E Server

PT/E Connector

RKL Agent

Self-Service Client

REMOTE KEY LOADING WITH PROTECT/ENTERPRISE

Product Overview The ProTect/Enterprise-RKL (PT/E-RKL) is a software solution for the age-old problems of self-service key distribution. Delivering an automated, protocol independent and multi-vendor solution for the otherwise manual process, PT/E-RKL enables banks to achieve considerable savings while modernizing their logistic management. Consisting of an RKL Agent, RKL Server and RKL Connectors for the different Switch/ Host systems, Key Management Systems and Hardware Security Modules, PT/E-RKL was built around a modern multi-tier architecture. Created using the latest software technology (Java) and deployable within a faulttolerant, fail-over and cluster environment,

PT/E-RKL operates within the banks current IT infrastructure. Current process Key distribution and management is a manual intensive process. Once generated, keys have traditionally been distributed by the banks own security officers. These dedicated security officers would travel to and enter their half of the key pair using the terminal service panel. While this could be an acceptable process if performed as a one-off activity, the process of terminal (re)keying is regular and performed n time throughout the terminals lifetime. Introducing an automated centrally controlled software solution for key loading frees up a reservoir of resources, both human and financial.

Highlights Central Administration and distribution of keys Using PT/E-RKL, self-service terminal operators are delivered the capability of administer, monitor and supervise the different key types (certificates and signatures) throughout their lifetime. Terminals and key information, rules controlling terminal (re)keying etc, are defined and administered form a central single-point. Compliancy and regulation With the introduction of new codes of practice and regulation e.g. ANSI, Visa, Master etc, banks are being requested to comply with an ever growing list of rules, regulations and process audits. These mainly mandatory guidelines are placing even more pressure on the banks self service infra-

structure. By delivering a software solution, compliant to the different guidelines, banks are protecting themselves against possible audits, frauds and criminals elements. Migration from DES to 3DES DES (Data Encryption Standard) keys have been used from an early stage for the encryption of EPP/PED Terminal Master Keys. The evolution of high performing hardware and software permitted a group of experienced hackers to compromise the security of the DES algorithm. In response to this breach of security, the industry introduced the concept Triple DES, whereby the size of the master keys has been increased from 56 bits DES to 168 bits for triple DES. The need for security officers to introduce 64 (2 x 32) characters via the operator panel has increased the possibility of a

faulty input. Using an automated approach, Triple DES keys can be distributed from a central point without the need for error prone key entry. Return of Investment and Total Cost of Ownership ATM (re)keying is a process which must be throughout the lifetime of a terminal will be performed at least once. On average, terminals are re-keyed once a year. Taking in consideration that the average terminal rekeying process requires: the generation and printing of the key pair on secure paper, the distribution of the paper to the assigned security officers, traveling to and from the particular terminal location and time required to enter the key pair etc, depending on the labor costs this process can account for a large segment of terminal administra-

tional budget. Using the PT/E-RKL, these costs are no longer incurred. While Key generation is still performed, the process of key loading is performed electronically with human supervision and not intervention.

Features Protocol independent Through the support for both existing procedures, signatures and certificates the RKL Agent can operate within a Multi-Vendor environment Support for international standards e.g. XML, SSL, ISO 8583 etc. The RKL Agent operates independent of surrounding environment delivering a small footprint client-side The RKL procedure can be triggered centrally, locally via service panel, reboot-startup steps etc, and is not dependent of any additional terminal software Independent handlers and protocols e.g. NDC, DDC, PBM etc. Operates independent of transactional Switch/Host system

Through the use of Java, PT/E-RKL is not confined to any particular hardware and/or operating system Compliant to the unique terminal key policy Support for Self-Service Terminal Various key types Wincor Nixdorf Signatures NCR Signatures* Diebold Certificates* As of CEN/XFS 3.02 As of Java Runtime Environment 1.4

Server and connectivity Back-end systems via ISO 8583 protocol Key Management System IBM DKMS Cryptomathic KM Hardware Security Module IBM 4758 Eracom Product Orange

* Must be qualified within the customer project.

Published by Wincor Nixdorf International GmbH Heinz-Nixdorf-Ring 1 D-33106 Paderborn Phone +49 (0) 52 51 / 693 - 33 01 Fax +49 (0) 52 51 / 693 - 59 18 www.wincor-nixdorf.com Wincor Nixdorf International GmbH All rights, including rights created by patent grant or registration of a utility model or design, are reserved. Delivery subject to availability; right of technical modifications reserved. Order no. R10857-J-Z741-1-7600 Printed in Germany, August 2005, w