четверг, 30 мая 2013 г.

Terminal - Banking Chip Card. How they are talk to each other?


Introduction.

Today was a hard day for me, even if it was Sunday...but anyway I want to start a new very interesting topic about one standard, which is actually playing very important role in a world of Payment application, its name is EMV.

Everyone today has his own banking card, and this is easy way to get the access to your bank account and as a consequence to your money. Whatever you do, going to buy something, to get some cash or to pay for your mobile phone, each time you take your card from your wallet and starting from this moment you oblige to follow some rules in order make a correct payment. To be precisely, it is not you personally, this is your banking card which should be complained to EMVco standard. Let's imagine you insert your card to the reader of ATM or POS terminal and from this moment magic is takes a control on your bank account. Interesting, is not it? Let's see what is going on between your card and ATM or terminal.

First of all, I will give you some useful links about related topics, which I hope will help you to understand the process of data exchange between smart card and terminal and also helps to read this topic.

       ISO 7816 general description.

       Global Platform general description and full set of documents which can be downloaded from official web site.

       EMV on wiki and EMVco website where you can find all specifications.

       Nice page with EMV tags search engine

       ASCII to HEX/HEX to ASCII convertor

Let’s start to see what is going on between card and terminal. I need to say here, first we will speak about contact interface.About contactless interface I will describe later on.

Part I. EMV transaction via Contact Interface.

When the card inserted in to terminal, it is going to be powered and reset. Card must provide Acknowledge-To-Reset (ATR) and then will wait for incoming commands.
This is a common part which is not directly related to EMV transaction. More information about ATR you will find in ISO7816 part 3. So, now let’s have a look from EMV standard point of view.

The next step is to choose and select target application. Depending on what type of card you have (Visa, MasterCard, etc...), different payment schemes will apply during EMV transaction. 

There are two approaches can be used to determine which application is going to be used:

1.      Terminal use PSE (Payment System Environment), if the one is exists on card.
2.      Terminal build a list of candidates based on list of application stored in terminal.

Approach 1:  Using PSE

PSE is Payment System Environment which contains, roughly speaking language preference, list of applications and their priority in which they must be executed. It is not mandatory for all cards to support PSE.
Terminal select PSE using SELECT command with filename 1PAY.SYS.DDF01. If there is no PSE, card should return “6A82”, which means “file not found”. If card returns “9000”, terminal proceeds to the next step by processing response from card. The response on the SELECT command for PSE contains FCI data object, which should looks according EMV Book 1 like:

Tag
Value
Presence
6F
FCI Template
M
 
84
DF Name
M
A5
FCI Proprietary Template
M
 
88
SFI of the Directory Elementary File
M
5F2D
Language Preference
O
9F11
Issuer Code Table Index
O
BF0C
FCI Issuer Discretionary Data
O
 
XXXX -Tag according EMV Book3, Annex B
1 or more additional proprietary data elements from an application provider, issuer, or IC card supplier, or EMV-defined tags that are specifically allocated to 'BF0C'
O

Response on SELECT command for PSE

 So now terminal knows the SFI of payment system directory to read. By sending READ RECORD command with record number beginning with #1, terminal is able to read data and continuing with successive records until the card returns “6A83”, which means record number requested does not exist. Here terminal should stop reading.
Payment system directory is represented by linear EF file identified by SFI. A record may have several directory entries; basically the format of the record according to EMV Book1 is looks:

Tag
'70'
Data Length
(L)
Tag
'61'
Length
of
directory
entry 1
Directory
entry 1
(ADF)
Tag
'61'
Length
of
directory
entry n
Directory
entry n
(ADF)

Payment System Directory Record Format

Terminal process all directory entries and match ADF names with his own list of supported applications. If ADF name is equal to one supported by terminal, it join then the list of candidates for final application selection. When the terminal finishes processing all records, if at least one matching ADF name was found, the terminal makes the final decision in according with EMV standard. The process to take decision which application is going to be selected and used is conditional. You will find complete description in EMV Book 1, section 12.4 Final Selection.

For example, let’s have a look to the trace below:


T: RESET
C: ATR

T: SELECT
00A404000E315041592E5359532E444446303100

C: RESPONSE
6F20840E315041592E5359532E4444463031A50E88010A9F1101015F2D046672656E9000

T: READ RECORD
00B2015400

C: RESPONSE
701761154F07A0000000421010500243429F120243428701019000

T: READ RECORD
00B2025400

C: RESPONSE
702761254F07A0000000041010500A4D4153544552434152449F120A4D4153544552434152448701029000

T: READ RECORD
00B2035400

C: RESPONSE
6A83

As a file name, SELECT APDU contains the name of the PSE, which is in our case 1PAY.SYS.DDF01 or in a hex format “315041592E5359532E4444463031”. In the response of SELECT we can see the tag “6F” which gives us FCI content.  Tag “84” contain name of PSE. Tag “88” gives us the SFI=0Ah. Under tag “5F2D” we can see the preferred language which is in my case “6672656E”or ASCII representation is “fren”, which means French language, cause my card is French one.

Now Terminal knows the SFI of file which contains directory entries and can easy read it by using READ RECORD cmd. From the trace above, we can see how it looks.

By parsing the READ RECORD command response, we can easily identify following parameters:

Tag
Meaning
Hex Value
Description
4F
AID
A0000000041010
Application ID
50
Application Label
 
4342
4D415354455243415244 
CB
MASTERCARD
9F12
Application Preferred Name
 
4342
4D415354455243415244 
CB
MASTERCARD
87
Application Priority Indicator
01
02
CB
MASTERCARD

Here CB (Cartes Bancaires, French) is “CB Bank card Group”, short description you can find in wiki.

Approach 2:  Using a List of AIDs

If at any reasons, terminal was not succeed with PSE to identify the target application, or PSE is not supported by the card, terminal will need to build the first the list of candidates by selecting one by one the applications, base on application’s list stored in terminal.

In this case, terminal send in the loop SELECT command and tries to match the AID with DF Name field returned in the FCI on SELECT command. If they are matches both together, the AID is going to be add into the list of candidates. So, again after the list is ready, terminal is going to take the final decision like described in EMV Book 1, section 12.4 Final Selection.

So, the next step is to select the target application. To do that, terminal sends the SELECT command with ADF name chosen in previous step. We will see how it works in my next topic. Well, that is enough for today, I think…

 

4 комментария:

  1. Dear Sir,
    I am very interested in your article, and hope you can post more about EMV spec articles. you can use very simple words to let me understand me. i read the EMV spec almost three months still can't get in the concept but your article are made me understand . i am very thankfull and expected your can post about more EMV in the future.

    Thanks & Best regards,
    Kelly

    ОтветитьУдалить
  2. Very informative blog. Sir can we use SLE4442 instead of JCOP cards? Im trying to use an SLE4442 card that works like a jcop cards, when inserted into POS it will shows APP NOT SUPPORTED PLEASE SWIPE MAGNETIC. I want my SL4442 cards work like that.

    ОтветитьУдалить
    Ответы
    1. Hi, thank you for your comment, so SLE4442 is a memory card as far as I remember, you can't use it as a banking card. There is no application installed on it. You need a microprocessor card with OS and dedicated app installed.

      Удалить
    2. Thanks for super fast reply, i appreciate it. Im a newbie and not good in programming, i just do researching and reading about this smart cards, which my main purpose would work like what i stated above.

      Ok in other hand, what type of cards you suggest that would work or act like jcop cards? but uses small chip,unlike jcop uses old big chip.

      Lastly if only jcop is the main thing.Hmm how do we replace the "APP NOT SUPPORTED PLEASE SWIPE MAGNETIC" display on POS when card is inserted, into a "ENTER PIN" then "SWIPE MAGNETIC"? I'm not talking here about real EMV solution that would work like a real EMV cards. What i mean here is changing the bypass error display.

      More power, and thanks in advance.

      Удалить