Sagem Denmark's remote key load solution may simplify ATM security

Sagem Denmark's remote key load solution may simplify ATM security
Tags: ATMs, Cryptera, Security, Transactional Kiosks
November 25, 2008

COPENHAGEN, Denmark — Sagem Denmark, an Ingenico Group company and a provider of payment solutions has announced the launch of Remote Key Load (RKL), a fully automatic exchange of Triple DES master keys for use in maintaining a high level of security of ATMs. According to a news release, the continuous effort of keeping ATMs secure is growing increasingly expensive and regulated. Ensuring that ATMs are locked down and protected has become more complicated since the advent of Triple DES and the requirement that ATMs use encrypting PIN pads. Those additional requirements have added to the cost and complexity of key management by necessitating longer keys and more hands-on interaction. Manual, more traditional key loading requires two different employees or technicians to visit each individual ATM to enter only parts of the master key. In addition to increased personnel costs, this method doubles the potential for error. RKL eliminates human-error concerns and improves key-loading efficiency. "As long as a system meets some basic requirements, installing the first 3DES master key is a matter of connecting the ATM to the host via regular channels and running the Remote Key Load protocol," said Lars Clausen, vice president of Sagem Denmark. "The installation takes place in about 10 seconds — without the need for human involvement." According to Sagem Denmark, these basic requirements include: the ATM and the host-ATM protocol. The ATM's EPP and the host's HSM must all support RKL. The host must have a host key pair and a suitable certificate on the public key, and the EPP must have two key pairs with corresponding certificates. Sagem Denmark will assist and support the customer with a correct and efficient implementation of the RKL solution. Beyond cutting costs and simplifying key management, RKL incorporates several security features, such as mutual authentication, meaning the host and the EPP can verify each other in a single operation. Other advantages include protection from inadvertently reinstalling old key values, an encrypted transport of the master key and a cryptographically signed message after a successful key transfer.