1

I have failed to find a good diagram or explanation of how a P2PE solution manifests itself within a point-of-sale (POS) device. Is it software running in a process on an embedded OS that knows how to communicate with the card reader? Or is it software that has been loaded into the card reader? Or what?

Related to this is that I failed to find a good diagram or description of how the various sub-components of a POS device relate to each other. Presumably there is an OS (maybe embedded) and various I/O devices, and maybe some processes that have nothing to do with cardholder data.

Related to this is that I have failed to find a good description of the differences and relationships between the following: P2PE, PIN pad, PTS, POS, payment terminal.

  • This is a very broad question, probably too much so to be able to answer in any answer of reasonable length. And there's a lot of variation in implementation. So I'm just going to give a few links: 1) computerweekly.com/answer/… 2) computerweekly.com/news/1514602/… 3) nxp.com/docs/en/fact-sheet/POSREADERLF.pdf The first two are kindof old, but still fairly accurate - the details have changed, but not the high level view. – Bobson May 15 at 4:01
  • Unfortunately those references don't really help me better understand the relationships I am asking about. I would be happy to hear quick comments, like (if true): "P2PE software runs outside the PIN device", "PIN pad equals PTS", "P2PE and PTS are subcomponents of a POS". – knokej May 16 at 13:26
2

I guess it depends on what you mean by POS, because this isn't really a defined term.

A POI (point of interaction) is something typically that interacts with a card and a person. Some POIs have card readers and PIN entry bits, some are just secure card readers, and you can get separate PIN entry bits that don't read cards (think of an ATM where the card reader and PIN pad are separate). In retail you usually interact with a POI device (aka chip and PIN machine).

A P2PE solution requires software running inside a POI such that the card data is encrypted within the secure processing area of the POI. The POI has to have a facility called "SRED" - secure read and exchange of data, not all POIs have this. Data is then only decrypted in the (hopefully) secure data centre of the solution provider.

This is not a bad explanation: https://www.pcisecuritystandards.org/documents/P2PE_At_a_Glance_v2.pdf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.