The Triple DES security standard is being introduced to ATMs globally to address security concerns about the existing single DES standard. The major card networks are enforcing compliance with the Triple DES standard from 2006. Many banks have already upgraded the software elements of their networks in order to comply, but many still need to address the hardware upgrade of the actual ATM.
Many banks are taking the opportunity to make additional security improvements, particularly Encrypted PIN Pad (EPP) devices and remote key management strategies while upgrading ATM hardware to meet Triple DES compliance. Level Four's ATM Developer supports functionality to address migration to all of this important security technology.
ATM Developer provides a seamless upgrade of ATM Simulator for supporting Triple DES, Remote Key Management and Encrypted PIN Pad (EPP) device functions.
Using ATM Developer, banks can simulate an ATM with Triple DES functionality and test directly from the desktop. The plug-in provides support for use of double length keys and cryptography to exactly replicate the real ATM, but without the inconvenience and expense of using the actual ATM device.
ATM Developer enables testing of host cryptography and RSA functions used for remotely loading keys into the ATM. A full narrative is generated during any key management activity, therefore simplifying fault analysis and problem resolution. The user can provide externally generated encryption keys and signatures, or ATM Developer can create these. Test data can be saved in files and reloaded at any time to re-initialise the key management system to a known point.
By introducing an electronic method of managing and distributing keys, banks can centralise this process, reducing time, risk and human error. It removes the need to issue clear key values to individuals and the attendant ATM custodian procedures. It also means that encryption keys can be updated more frequently than a manual system, making obvious security breaches less prone to being compromised.
The introduction of EPP devices means PIN numbers are immediately encrypted before becoming visible to the ATM application. By deploying an EPP, ATM software no longer deals with a PIN number in its original format; it will only deal with an encrypted value of the PIN number, therefore improving the overall security of the ATM environment.
ATM Developer imitates this interaction and the functionality of an EPP, such as key storage, secure key exchange and the generation of the encrypted PIN value (PIN block generation), enabling a bank to test that its whole transaction network is able to process requests incorporating the new security technology.
|
TOP