Despite these advantages, touchscreens introduce additional security vulnerabilities that must be addressed against determined card thieves. Compliance with the Payment Card Industry Data Security Standard (PCI DSS) becomes key to designing secure hardware/software systems that help customers create robust and protected payment products without sacrificing ease of use or an attractive industrial design. This article presents the evolution of point-of-sale (POS) payment systems, the security vulnerabilities of their touchscreens, and the criteria that must be met to pass PCI certification for any touchscreen-based terminal.
Touchscreens in POS Terminals:
For decades, consumers worldwide have paid for goods and services with credit cards at point-of-sale terminals. These terminals gradually added small, low-cost screens to help provide the merchant and user with more information about the transaction status. Buttons were added to the sides or bottom of the screen, aligning with the virtual buttons, to allow the user to select merchant options such as card type (e.g., credit vs. debit), tip amount, and receipt printing. The user entered card numbers and PIN codes using mechanical keypads. This describes most point-of-sale terminals still in use today.
A trend in the payments industry is to replace small monochrome touchscreens and mechanical buttons with larger, color touchscreens. These color displays are more visually appealing and attract both merchants and consumers. Touchscreens also allow point-of-sale terminal providers to eliminate side/bottom smart buttons and mechanical keypads. This improves system reliability by eliminating moving parts that wear out over time (both the internal key-switch mechanism and the printing on the key surface). Touchscreens also help eliminate the threat of water ingress around the keys of the terminal. Finally, color touchscreens assist merchants with their branding and advertising efforts, trends that are driving the increasing size of modern touchscreens on payment terminals of all types. 
Figure 1 - Examples of touchscreens
Another trend involving larger touchscreens in payment systems is the rise of electronic cash registers (ECRs), which are being added to complement point-of-sale (POS) terminals. Electronic cash registers are used in both traditional stores with multiple checkout lines and the increasingly popular self-service stores. ECR systems help retailers track sales, minimize sales errors, manage inventory data, and simultaneously record the financial transaction in their systems. ECR touchscreens offer great flexibility when entering data such as product type and quantity, options like purchasing bags, and selecting payment methods. ECRs are not typically secure payment devices, so they are often combined with POS terminals that process payments via cards, phones, and smartwatches.
Over time, ECRs and POS terminals have begun to merge into a single, secure, touchscreen-based payment system. Touchscreen sizes ranging from approximately 3.5" to 42" have become an integral part of modern ECR and point-of-sale terminals. User interaction, the advent of contactless NFC technology, mobile phone connectivity, and the consolidation of functions into a single system are driving the rise of fixed tablet/kiosk or battery-powered handheld point-of-sale terminals in place of standalone ECR-POS systems. Handheld POS terminals allow merchants to accept payments anywhere, both inside and outside the store. The rapidly growing trend of contactless payments, which promote ease of use and convenience, has led to an increase in unattended and self-service public payment terminals in vending machines, parking meters, automatic fuel pumps, and electric vehicle charging stations. Larger touchscreens not only allow merchants to display more information about purchased items but also help generate additional revenue streams through product promotions and advertising.
POS Security and PCI Compliance:
The security of user data, such as the primary account number (PAN), credit card credentials (number, expiration date, and CVV), and user PIN, became the top priority when designing payment systems. Magnetic stripe (swipe) card transactions had inherent security vulnerabilities and were more prone to failure as the strips wore down over time and when exposed to magnetic fields. More secure card payment methods, such as Dip (chip and PIN) and Tap (near field communication: NFC), are available alternatives. These methods are complemented by alternative authentication mechanisms such as QR codes (on paper or mobile) and biometrics (e.g., finger, face, or eye). However, the introduction of touchscreens also has a new and special role to play in the security of PIN entry systems when they replace mechanical keypads.
Figure 2 - Two-processor architecture for POS
Touch and PIN data transfer is vulnerable to man-in-the-middle attacks through touch sensor overlays, sublayers, and even probe attacks on the communication bus between the touch IC and the secure host MPU, as discussed previously. The touch controller firmware is vulnerable to hacking, allowing attackers to create a backdoor and extract card data. The touch controller configuration is susceptible to modifications that can open vulnerabilities in systems that have previously passed security certification tests.
Furthermore, outdoor touchscreen design requirements include technology to cope with extreme ambient noise, active NFC interference, stringent emission standards, an extended temperature range, thick glove detection, and extreme moisture immunity, including from highly conductive cleaning fluids that would otherwise trigger false touchscreen events. Unauthenticated configuration and software update vulnerabilities could also lead to denial-of-service attacks combined with ransomware attacks, potentially taking the entire network offline if terminals are connected to the central update system. Like a network of electric vehicle chargers with integrated payment terminals. This creates additional challenges and opportunities for the developer of the touchscreen payment system.
PCI Compliance to the Rescue.
Created by the leading payment card brands (Visa, MasterCard, American Express, Discover, and JCB), the Payment Card Industry Security Standards Council (PCI SSC) has developed and managed the globally recognized PCI DSS to protect cardholder data. Payment brands and acquirers have a responsibility to create products that comply with PCI standards to protect the storage, transmission, and processing of user data. Depending on the type of payment application, PCI compliance requirements may vary, which can influence hardware, software, and system design considerations.
Currently, most point-of-sale terminal vendors comply with PCI data security standards. The PCI security mechanism aims to isolate the PIN from the PAN and other cardholder data. This ensures the security and integrity of PIN entry through the software application and requires active monitoring of that software and encryption of user data using a strong key. Access control must be implemented to authenticate the device user or owner. Failure alarms are recommended to warn of tampering, hacking, or functional failures.
If a payment system uses a separate payment module pre-certified for PCI DSS for secure card transactions via a card reader with a mechanical keypad, the touchscreen does not transmit any secure information over the communication lines. PCI PIN Transaction Security (PTS) certification of the touchscreen is only required when it is used to enter credit card data and/or PIN codes (known as PoG, or PIN on Glass). In this case, it is necessary to shield the touch controller's communication interface or encrypt the data in the touch messages. Encryption offers point-of-sale (POS) terminal vendors the opportunity to move the touch controller integrated circuit to a simple and cost-effective single-layer flexible printed circuit (FPC) tail connected to the touch sensor. This configuration allows the touch sensor vendor to design, test, and ship the complete touch system to the POS terminal vendor, thereby reducing costs and simplifying the supply chain.
General PCI Certification Requirements:
The PCI compliance guidelines relevant to touchscreens are governed by PCI-PTS. PIN transaction security requirements can be summarized as follows:
- Measures are incorporated into the system to disconnect in case of physical or software manipulation.
- Confidential user data must be transferred (always encrypted) and should only be kept as long as necessary
- Software updates or startup should only be performed if the integrity of the software can be verified.
- Only authenticated users can update the software
- The key must be stored in a protected area, and secure mechanisms must be created to protect the initial key payload in production
- The device must perform a self-test and report any anomalies
To facilitate compliance with the latest PCI requirements, the following features could be incorporated into touch controller products at the system level:
- 24-hour Reboot Program
- 15-minute waiting time for manual key entry
- PIN encryption using Advanced Encryption Standard (AES) in ISO 4 format
- Stricter use of encryption keys for their intended purpose, with a separation between customer and manufacturer key hierarchies.
- PAN cipher
- TR-34 Remote Key Upload (RKL) Protocol
A PCI-certified laboratory validates the touchscreen to ensure it meets the security requirements of the PIN Transaction Security standard. This validation includes the following tests:
- Evaluation of the vulnerability of PIN entry security through hacking.
- Evaluation of access to sensitive data through manipulation and examination of the response mechanism used in the system.
- Validation of techniques and documentation of key management in production.
Getting straight to the point, quickly.
Designing payment terminals requires knowing how to implement a complete system solution and robust security standards. Solutions like Microchip’s maXTouch® controller portfolio can address these complex system challenges with their integrated analog front-end and proprietary firmware that can be configured for secure, encrypted communication for any end-user application.
A dedicated support team, such as the touch controller experts at Microchip Technology, can guide customers through system-level design and assist them with software and controller integration, as well as product testing and debugging. Their experience working with some of the world’s leading payment terminal vendors and certification laboratories means customers can get the support they need to navigate the critical certification process.
About the author:
Vivek Tyagi has over 10 years of experience in the semiconductor industry and is currently the product marketing manager for Microchip Technology’s Human Machine Interface division. He is responsible for industrial product segments such as point-of-sale systems and electric vehicle chargers.
Reference
https://ww1.microchip.com/downloads/aemDocuments/documents/HMID/ApplicationNotes/ApplicationNotes/DS00004863A.pdf
