News

Sagem Denmark's remote key load solution may simplify ATM security

November 25, 2008

COPENHAGEN, Denmark — Sagem Denmark, an Ingenico Group company and a provider of payment solutions, has announced the launch of Remote Key Load, a fully automatic exchange of Triple DES master keys for maintaining a high level of security at ATMs. Ensuring that ATMs are locked down and protected has become more complicated since the advent of Triple DES and the requirement that ATMs use encrypting PIN pads. Those additional requirements have added to the cost and complexity of key management by necessitating longer keys and more hands-on interaction. Manual, more traditional key loading requires that two different employees or technicians visit each individual ATM to enter only parts of the master key. In addition to increased personnel costs, the manual method doubles the potential for error. RKL eliminates human-error concerns and improves key-loading efficiency. "As long as a system meets some basic requirements, installing the first Triple DES master key is a matter of connecting the ATM to the host via regular channels and running the Remote Key Load protocol," said Lars Clausen, vice president of Sagem Denmark. "The installation takes place in about 10 seconds — without the need for human involvement." According to Sagem Denmark, basic requirements for the solution include: The ATM's EPP and the host's HSM must all support RKL. The host must have a host key pair and a suitable certificate on the public key, and the EPP must have two key pairs with corresponding certificates.

Sagem Denmark will assist and support the customer with a correct and efficient implementation of the RKL solution. Beyond cutting costs and simplifying key management, RKL incorporates several security features such as mutual authentication, meaning the host and the EPP can verify each other in a single operation. Other advantages include protection from inadvertently reinstalling old key values, an encrypted transport of the master key and a cryptographically signed message after a successful key transfer.