2
www.thalesesecurity.com THALES HSMs SECURE MOBILE POINT-OF-SALE SOLUTIONS FROM MINT PAYMENTS How an innovative leader in mPOS solutions ensures that cardholder data and PINs are protected at all times THE CHALLENGE: CARD ACCEPTANCE NEEDS TO BE SIMPLE, SECURE AND AVAILABLE ANYWHERE With the decline of cash payments, merchants of all sizes are increasingly looking for a flexible, cost effective and secure payments solution to accept EFTPOS (electronic funds transfer at point of sale) and credit card transactions on the go. It is no longer just the established bank acquirers and third party processors that want to offer card-based payment solutions to merchants, with telcos and other service providers looking to integrate card payments into their solutions or expand their current offerings. Together with the increasing desire for integrators to develop payment functions into their mobile apps, a solution supporting secure card acceptance without the traditional merchant POS device installation, configuration and security audit complexity is urgently needed. THE SOLUTION: FLEXIBILITY AND SECURITY POWERED BY THALES HSMs In order to address these issues, Mint Payments chose Thales hardware security modules (HSMs) to provide high assurance encryption and key management functionality as an integral part of their PCI DSS compliant data center. Mint’s mobile card acceptance solution uses a small portable card reader that connects via Bluetooth to a merchant-owned smartphone or tablet. The device is magnetic stripe, EMV Chip and contactless enabled, allowing the merchant to accept “customer present” payments securely. Tight control of the remotely initiated key injection process for card reader activation, encryption of the payment data at the point of capture and the use of hardware security modules (HSMs) at the payment platform level, enables mPOS solution providers like Mint to attain PCI DSS compliance and delivers a clear win for all participants in the value chain. Thales payShield 9000 hardware security modules (HSMs) are used in the Mint infrastructure for a variety of purposes, including: Generating keys for the card readers Decrypting card data PIN block translation at the payment platform prior to sending the transaction into the acquirer network for authorization HOW MINT AND THALES DELIVER THE WIN-WIN FOR CORPORATES AND MERCHANTS The Mint solution for mPOS using Thales HSMs is comprised of three main product offerings: Minterprise: a branded mobile payments platform for enterprises and banks, customizable to their needs Mintegrate: a program supporting a set of SDKs and APIs that allow developers to seamlessly integrate payments into third-party software while leveraging Mint’s PCI capabilities Mint mPOS: a solution comprising a mobile app and card reader combination that allows merchants of all sizes to accept contactless, chip and PIN-based card payments securely, anytime and anywhere WHY THALES Mint Payments evaluated payment HSMs offered by other vendors before choosing the Thales payShield 9000. That choice was based on the following: Proven mPOS experience – through its technology partnerships, Thales already had proven integration with the card readers that Mint selected to take to market, reducing development risk and delivery timeframes. Richness of standard features – the core Thales payShield software contained all the functions and flexibility that Mint needed, avoiding the need to build custom functionality. Upgrade capability – Mint quickly discovered that they could start with a small base of lower capacity HSMs and swiftly add additional capacity through performance upgrades, avoiding any impact to their payment platform. Support – Thales offered timely support to Mint’s developers through its local offices, helping to provide extra assurance that expert technical assistance was always on hand when needed. Management – payShield HSMs can be managed remotely, providing operational cost savings and convenience. Product certifications – the payShield HSM already has the PCI HSM and APCA certifications which simplify the various global and regional security and audit requirements that the Mint solution needs to satisfy.
