Nearly 1.3 million German citizens will soon be testing a new payment-card system. In this project, bank and savings customers will be offered tap-and-go payment-card facilities in shops and gas stations for payments as high as 20 Euros. Dubbed Girogo, this project will be trialed in Hanover, Braunschweig, and Wolfsburg.
Of course, this form of payment is hardly new. Yet the project is unique because it addresses security, which is one of the major concerns that people have with such payment systems. Among user concerns are how secure their bank details will be and how the cards will ensure that data cannot be stolen. To address these issues, the German Banking Industry Committee (Deutsche Kreditwirtschaft) has approved the use of a security chip designed by semiconductor supplier Infineon Technologies (www.infineon.com). According to Infineon, it is the first such device in the world to receive the German Banking Industry Committee's approval for contactless bank cards.
The German Banking Industry Committee's security requirements are regarded as the world's most stringent standards. This fact takes on greater significance with today's clear trend toward chip-based cards, which are superseding magnetic-stripe cards. Interestingly, the German Banking Industry Committee says that the introduction of chip-based cards has been instrumental in reducing card-related crimes. Data theft at cash dispensers, for example, is reported to have dropped 45% in 2011 from the previous year.
The Girogo bank card is a dual-interface card. Customers can use it for standard, contact-based payment by inserting the card into a normal "chip and PIN" credit-card payment terminal. Yet the user no longer has to insert the card into a reader. For contactless payment, the cardwhich includes a wireless chipis held in front of the reader at the checkout (see photo). Because no signature or pin entry is required, the payment process takes less than a second.
At the heart of this contactless payment card is Infineon's SLE 78 security controller. The SLE 78 family is the firm's latest system to target the high-security chip-card markets. It follows the SLE 66PE family, which is currently used across all worldwide chip-card markets.
From a design view, one of the advantages of the SLE 78 is that it provides a simple migration path while introducing an additional security concept. Rather than relying entirely on shields and sensors, that conceptcalled the Integrity Guardconcentrates on core security to protect against fraudulent attacks. According to Infineon, this approach offers long-term device security while ensuring CC EAL5+ (high) certification. Among the features of Integrity Guard is the following: implementation of dual central processing units (CPUs) for fault detection; full CPU, memory, bus, and cache encryption; error-detection codes in all memories; error codes for cache protection; and address and data scrambling of memories.
The dual CPU is particularly important in security terms, as this facility enables the cross-checking of usage data. Such cross-checking helps to identify any errors stemming from the fraudulent use of cards. This system complies with EMVCo (Europay, Mastercard, and Visa) security requirements for payment cards.