JSE-listed Prism Holdings is one of the first organisations in SA to develop an EMV software kernel or library that meets stringent global security standards for smart card transactions.
The Johannesburg-based secure electronic transactions company was officially granted EMV Type 2 Approval on its application kernel for the VeriFone SC5000 Point-of-Sale (POS) PINpad device from EMVCo last week.
The EMV Type 2 certification of Prism`s kernel for the SC5000 PINpad means retailers and banks that install the devices with the locally developed software are assured that these comply with global standards. They can safely accept any EMV-type smart card from anywhere.
EMVCo is the non-profit organisation established by Europay International, MasterCard International and Visa International (EMV) to manage, maintain and enhance the EMV Integrated Circuit Card Specifications for payment systems as the adoption of smart cards as a payment mechanism becomes more pervasive.
Gerhard Claassen, MD of the Crypto Business Unit at Prism, says EMV is the de facto global standard for the design, security and functionality of smart card terminals and applications.
"VISA and MasterCard have mandated that all POS terminals be EMV-compliant by early 2005, liability shifts as of 1 January 2005. This means that liability for any fraud committed after this date will rest with the environment that is not EMV compliant.
SA`s national EMV pilot is scheduled for early 2004 and several organisations which have installed SC5000 terminals from Prism - including Edcon, Pick `n Pay, Absa and Shoprite - will be participating in this pilot," he says.
According to Claassen, EMV Type 1 Approval evaluates the electro-mechanical compliancy for EMV-ready devices. EMV Type 2 Approval scrutinises the risk management and security rules that govern EMV smart card transactions - the interaction between the card and the terminal`s software.
"It`s the kernel that sets the rules for determining whether, for example, the card being offered as a payment mechanism passes the various security checks which make smart cards so much more secure than traditional magnetic stripe cards," he says.
"Whereas magnetic stripe cards are open to the skimming of account data off the card itself, smart cards securely store that data on the silicon chip providing increased levels of transaction security to the payments industry. The EMV standard paves the way for the eventual elimination of card skimming fraud."
In order to obtain EMV Type 2 Approval, the Prism kernel was subjected to stringent testing by Cetecom ICT Services - one of the worldwide leading technological service providers in the telecommunications and information technology sector which acts as a neutral third-party in measuring software and device compliance with individual global standards.
Cetecom found that Prism`s kernel met the requirements for certification as stated in the EMV 4.0 specifications for Terminal Level 2 and recommended to EMVCo that it be certified.
"It`s important that we met the EMV 4.0 specification because testing to the earlier EMV `96 version 3.1.1 will be discontinued on 1 March 2004. So products that met the earlier certification standards may no longer be acceptable as secure payment mechanisms," Claassen concludes.
Share
EMVCo, LLC, was formed in February 1999 by Europay International, MasterCard International and Visa International to manage, maintain and enhance the EMV Integrated Circuit Card Specifications for Payment Systems as technology advances and the implementation of chip card programs become more prevalent. The formation of EMVCo ensures that single terminal and card approval processes are developed at a level that will allow cross-payment system interoperability through compliance with the EMV specifications.
EMVCo established the terminal Type Approval process to create a mechanism to test compliance with the EMV specifications. Type Approval provides an increased level of confidence that interoperability and consistent logical behaviour between compliant applications have been achieved.
EMVCo Type Approval testing is divided into two levels. The Level 1 Type Approval process tests compliance with electromechanical characteristics, logical interface, and transmission protocol requirements defined in part 1 of the EMV specifications. Level 2 Type Approval tests compliance with debit/credit application requirements defined in the remainder of the EMV specifications.
Level 1 and Level 2 Type Approval processes are based on the EMV `96 version 3.1.1 specifications. Level 1 and Level 2 testing based on EMV 2000 version 4.0 is also available. Testing to EMV `96 version 3.1.1 will discontinue on 1 March 2004.
EMVCo Type Approval Level 2 addresses the conformance of terminal resident application software or part of the terminal resident application software that supports the required and optional EMV specification functionality.
Prism Holdings
JSE-listed Prism Holdings Limited is a leader in the field of secure electronic transaction products, solutions and services. The group has a strong presence in SA and an established and expanding footprint across Africa and South-East Asia.
Prism has a proven track record in the delivery of secure electronic payment technologies and end-to-end solutions for the retail, utilities, banking, cellular and petroleum industries. The group has developed and implemented innovative payment-centric Intellectual Property that bridges the following technologies:
* Chip cards including SIM cards, financial smart cards and telephone cards.
* Point-of-sale frameworks, applications and devices.
* OEM transaction modules including PINpads, card readers and self-service terminals.
* Transaction security modules and servers.
* Payment servers, messaging gateways and value-added-services gateways.
* End-to-end secure electronic payment architectures for wired and wireless networks.
VeriFone, Inc
VeriFone, Inc, (http://www.verifone.com) recognised worldwide as the trusted leader in secure electronic payment technologies, provides expertise, solutions and services for today with a smart migration strategy for tomorrow. VeriFone is leading the industry in the delivery of solutions that add value to the point of sale, resulting in improved merchant retention and the generation of new sources of revenue for its partners and customers.
VeriFone solutions are specifically designed to meet the needs of vertical markets including financial, retail, petroleum, government and healthcare. VeriFone has shipped over 11 million electronic payment systems.
Editorial contacts