I have recently started to study the smart ticketing systems. Most of the modern systems support the use of EMVCo standards for buying tickets in the bus. Also, in each bus usually there are more than one devices from which a passenger can buy a ticket. In my opinion these devices exchange data related to the bank cards, e.g. the validator must send some data to the main pc in the bus (on board unit, obu) when a passenger buys a ticket, and of course all the data are sent to the back office. I think that these data must be encrypted to prevent eavesdropping. Does anyone have any idea if there are any standards that specify the type of this encryption? I ve read about PCI standards and point to point encryption but I am not sure that these are applicable in smart ticketing systems.
As far as security goes, there's no specific standard that I'm aware of. Smart ticketing systems are a varied bunch, but they usually consist of:
- Some sort of passenger identifier, e.g. an RFID / NFC card or device.
- A point-of-sale (PoS) device, such as a scanner on a bus or in a station.
- A communications link between the PoS and the back-office.
- A back-office system which processes the transactions, maintains balance and customer information, and interfaces with the payment gateway.
Most importantly, card details are usually taken ahead of time, and are usually stored only in the back-end system.
The specific configuration is largely dependent upon the transport type. While a metropolitan bus service could operate a 3G cellular link back to the office, a cross-country train may have more difficulty in rural areas where cell towers are few and far between.
The normal mechanism that I've seen is that the list of valid card IDs is synced onto all PoS systems periodically (e.g. via WiFi at a station) so that individual cards can be identified as "valid" without having to call home every time someone swipes in. Each transaction is locally cached and then transmitted when a connection is available.
The security of the actual communications is entirely up to the implementation. It may rely entirely upon data-link layer encryption (e.g. WPA2), transport layer security (e.g. TLS), or may implement its own application layer security.
Of course, in the case of systems where contactless payments are performed at the PoS, the PAN may well be transmitted, and as such the communications (and PoS device) will become part of the PCI domain.