Point to Point Encryption

Maximizing security for credit card information in an increasingly complex regulatory environment is a critical challenge for merchants today. Point-to-point encryption (P2PE), which differs from end-to-end encryption, is a payment security solution that instantaneously converts confidential credit card data and information into indecipherable code at the swipe of the card to prevent hacking and fraud.

Securing card data from point A to point B

How it works

After a credit card is swiped through a P2PE PCI certified card reading device at the merchant location or point of sale, the device immediately encrypts the card information. The PCI certified device uses an algorithmic calculation to encrypt the confidential credit card data in a tamper resistant module, known as the point of interaction (POI). From the POI, the encrypted, indecipherable codes are sent to the payment gateway or processor for decryption.[1] The keys for encryption and decryption are never available to the merchant, making card data entirely invisible to the retailer. Once the encrypted codes are within the secure data zone of the payment processor, the codes are decrypted to the original card numbers and then passed to the bank for reading and authorization. The bank either passes or rejects the transaction, depending upon the card holders credit account. The merchant is then notified if the payment is accepted or rejected to complete the process. This process, from the encryption at the point of interaction to decryption at the P2PE solution provider's location, occurs under the span of one second.

Benefits of point-to-point encryption

Customer benefits

P2PE significantly reduces the risk of credit card fraud by instantaneously encrypting confidential cardholder data at the moment a credit card is swiped.

Merchant benefits

P2PE significantly facilitates merchant responsibilities:

Point-to-point encryption versus end-to-end encryption

Point-to-point

A point-to-point connection directly links system 1 (the point of payment card acceptance) to system 2 (the point of payment processing). Therefore, without the involvement of any other systems, not only do payment transactions take less time but there is greater security and confidentiality. A true P2PE solution is determined with three main factors:

  1. The solution uses a hardware-to-hardware encryption and decryption process along with a POI device that has SRED (Secure Reading and Exchange of Data) listed as a function.
  2. The solution has been certified to have a POI device that follows strict controls regarding shipping, receiving, tamper-evident packaging and installation.
  3. A solution includes merchant education in the form of a P2PE Instruction Manual, which guides the merchant on POI device use, storage, return for repairs and regular PCI reporting.

End-to-end

Many providers offer end-to-end encryption, which is not a PCI certified P2PE encryption. An end-to-end connection indirectly links system 1 (the point of payment card acceptance) to system 2 (the point of payment processing) but with multiple systems in between and this increases hacker opportunity. At the same time, it allows credit card data to exist somewhere within the merchant environment in an unencrypted form, which is risky for both cardholders and merchants as the unencrypted data can be easily read and stolen.

PCI point-to-point encryption requirements

The requirements include:

  1. Secure encryption of payment card data at the point of interaction (POI),
  2. P2PE validated application(s) at the point of interaction,
  3. Secure management of encryption and decryption devices,
  4. Management of the decryption environment and all decrypted account data,
  5. Use of secure encryption methodologies and cryptographic key operations, including key generation, distribution, loading/injection, administration and usage.[5]

Validated point-to-point encryption solutions

The following payment companies provide security through point-to-point encryption:[6]

Qualified Security Assessors of point-to-point encryption

References

  1. ↑ "Point-to-Point Encryption (P2PE) | Payment Technology". Creditcall. Retrieved 2014-08-25.
  2. ↑ "Frequently Asked Questions". PCI Compliance Guide. Retrieved 2014-08-25.
  3. ↑ "Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire P2PE-HW and Attestation of Compliance". Retrieved 2015-04-19.
  4. ↑ "Tokenization | Element Payment Services". Elementps.com. Retrieved 2014-08-25.
  5. ↑ "PCI SAQ P2PE-HW | Point-to-Point Encryption | Hardware Terminals | PCI Compliance Policies". Pcipolicyportal.com. Retrieved 2014-08-25.
  6. ↑ "Validated Point-to-Point Encryption (P2PE) Solutions". PCI Security Standards Council, LLC. Retrieved 2015-04-19.
  7. ↑ "Bluefin Releases White Paper Review on PayConex P2PE Conducted by Coalfire Systems - Bluefin Payment Systems : Bluefin Payment Systems". Bluefin.com. Retrieved 2014-08-25.
  8. ↑ "Creditcall obtains PCI P2PE certification for ChipDNA".
  9. ↑ "EPS Total Care First Fully-Validated PCI P2PE Solution - WINDSOR, England, Oct. 30, 2013 /PR Newswire UK/". england: Prnewswire.co.uk. 2013-10-30. Retrieved 2014-08-25.
  10. ↑ "The Logic Group Achieves World’s First Accreditation for PCI P2PE". The-logic-group.com. 2013-05-23. Retrieved 2014-08-25.
  11. ↑
  12. ↑ "P2PE Assessor Companies". Pcisecuritystandards.org. Retrieved 2014-08-25.
This article is issued from Wikipedia - version of the Monday, April 18, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.