DieboldNixdorf.com Tokenization Roman Cinkais | 27.11.2018

Tokenization in different context Pseudonymization of data Initial Public Coin Offering Identification of sensitive data Cryptography Key Management Data Security Mobile Payments

Tokenization in payments Is process of replacing card number (PAN) with token The original card number is under the control of the issuer, and external systems can not access it Tokens are random and it is not possible to deduct the original card number from the token Reduces the risk associated with payment fraud, the original card number does not occur on the payment network It is one of the techniques for reducing scope of cardholder data environment (CDE, PCI DSS) …enables entities to offer more secure and more tailor made payment services…

Support of token categories Token categorization Irreversible (Card identification) It is not possible to get the original card number from the token Reversible (Payment tokens) There is a reverse process called de-tokenization, which we can use to get back the original card number

Standards – payment tokenization PCI TSP Security Requirements: Additional Security Requirements and Assessment Procedures for Token Service Providers (EMV Payment Tokens) EMV® Payment Tokenisation Specification: Technical Framework UX, Security and functional requirements of card associations

Alternative payment channels Payment tokenization Payment tokens can be used to create a payment transaction at payment terminals or on a website Often referred to as DPAN (Digitized PAN) Reduces the risk of compromising your actual card (payment token compromise != card compromise) Payment token Mobile/Smart Device E-Shops (e-commerce) Alternative payment channels Payment options

Payments Online Tokenization provides innovative and secure payment methods for online merchants In-App Tokenization mediates payment directly in the application in a secure way, payment is made at the time of authorization In-Store Tokenization creates the ability to pay using smartphones and wearables through NFC technology or QR codes

Risk Management – EMV Framework information related to payment token data to ensure that payments are made within defined channel, authorized by user/owner of the token Examples: tokens only for e-commerce use, or valid only for one merchant, one time token, ability to create QR payment or EFT payment, etc. Token Domain Restriction Controls The quantification of the risk associated with the environment where we request the creation of a payment token or payment based on which a form of user verification is required Examples: storage of token information inside SE/TEE, or in a software based secure envelope, security policy Token Assurance

Token Service Provider Decomposed Tokenization Registration & Onboarding Identification & Verification Life-cycle Management De-tokenization Token Requestor Management Domain Restriction Controls Eligibility Checking Token Requestor Token Vault Authorization

In-store payment T T T N

E-commerce (online) payment

Diebold Nixdorf tokenization solution What is tokenization? For what purpose it is? What can be new payment channels and options? Impact on user experience? How to deploy tokenization? Security of tokenization data and environment? Compliance with Payment Card Industry?

Thank You for listening to today’s presentation. Roman Cinkais Roman.Cinkais@DieboldNixdorf.com