NXP reveals the secrets of bank card security in the IoT era

　　In the vast starry sky of the Internet of Things, bright stars shine brightly. As one of them, smart bank cards are quietly changing our lives. By the end of 2016, the total number of bank cards issued by banks in China reached 6.125 billion, which means that each person holds an average of 4.4 bank cards. The widespread popularity of bank cards has made bank card payment security increasingly important. Once security is lost, this star will be covered in dust and lose its luster. Let's follow the security electronics editor to learn about the relevant content.

　　Not long ago, a ransomware virus called WannaCry, which attacks computer systems in the form of Bitcoin extortion, ravaged more than 150 countries around the world; the Disney film "Pirates of the Caribbean: Dead Men Tell No Tales", which has not yet been released, was also attacked by "hackers" and demanded a high amount of Bitcoin as ransom. This "hacker" intrusion incident that shocked the world seems to remind people that in today's society, where the intelligent era and the Internet of Things era coexist, the security attack and defense battle with hackers is becoming more and more severe.

　　The security of the Internet of Things worries us, but will our bank cards also be hacked?

　　The information technology wave has made the era of carrying cash and magnetic stripe bank cards with you when traveling gradually fade away. Magnetic stripe bank cards are gradually replaced by financial IC cards equipped with smart chips. Under the background of the rapid development of the entire Internet of Things, people's payment methods have undergone earth-shaking changes, and bank card payment services have gradually changed from "private property" in wallets to "public property" exposed to various electronic information attacks. Every POS machine consumption, every ATM withdrawal and even every bank card binding on a mobile phone APP may become a battlefield for hackers to attack. Are you really ready for this imminent battle of attack and defense of bank card payment security?

　　"Magnetic" old welcome "core"

　　In 2014, the famous film and television star Tang Wei was defrauded of more than 210,000 yuan from her bank card; similarly, at the end of 2015, during the "explosive shopping spree" of Chinese tourists going abroad, the largest amount of fraudulent transactions reached 200 million yuan. Magnetic stripe bank cards do not have computing functions, and all data is stored in a static form on the magnetic stripe, which is very easy to read and copy, resulting in endless bank card fraud incidents, and the hidden dangers of bank card security payment need to be solved urgently. In 2015, the central bank announced the official launch of the financial IC card migration work, gradually replacing magnetic stripe bank cards with financial IC cards equipped with smart chips.

　　Unlike magnetic stripe bank cards, financial IC cards have built-in main CPU and high-performance key coprocessor, each with its own division of labor. The main CPU is mainly responsible for data transmission and task allocation, while the dedicated high-performance key coprocessor is responsible for data encryption and decryption, which can effectively protect and verify sensitive information such as user certificate keys and transaction data. At the same time, its built-in multiple hardware anti-attack and anti-cloning designs greatly increase the difficulty for "hackers" to crack bank cards.

　　As a global leader in the field of bank card security chips, NXP has provided various security chip solutions for the bank card market for many years, safeguarding the security of China's financial payment industry. In 2010, after the National Commercial Cryptography Administration Office successively released the SM series of algorithms and established a complete national cryptographic product security testing and certification system, in April this year, relying on the company's technical advantages in the field of secure semiconductor products and huge local R&D investment, NXP also officially obtained the "Certificate of Designated Commercial Cryptography Product Production Unit" issued by the National Cryptography Administration, becoming the national commercial cryptography product production designated unit and the first international semiconductor company to be awarded this certificate.

　　IC card is only a temporary security fortress after all

　　From invasive attacks using reverse engineering, probes, forced manipulation, etc., to later combined attacks using power analysis, optical attacks, and reverse attacks, the high return rate of attacking bank cards has led hackers to continuously upgrade their attack methods on bank cards. China has not yet completed the comprehensive transformation from "magnetic" to "core", but "hackers" have further upgraded their intrusion techniques. For example, in recent years, foreign research institutions have discovered a "flash memory mirroring technology" that can simulate financial IC cards by reading and creating mirror data files, achieving unlimited attacks, and ultimately cracking the bank card security element.

　　In response to this "emerging" attack method, NXP has provided a physical anti-cloning (PUF) product solution. Its P60-Step-Up is the world's first security chip product that uses PUF technology for mass production, and its security performance has achieved a qualitative leap. The PUF technology of P60-Step-Up is based on the physical characteristics of SRAM (static random access memory). Each P60-Step-Up chip is equipped with a unique key, just like the fingerprint of each chip. Even if a "hacker" can copy, simulate and transfer bank card information to another bank card through similar flash memory mirroring technology, the unique "fingerprints" of the two cards will prevent the cloned card from restoring the real key and user data, thereby protecting the user's bank card security.

　　But so far, financial IC cards are only a temporary security fortress for financial payments, and the offensive and defensive battles between "red hackers" and "hackers" are far from over. Bank cards must be able to foresee possible security challenges in the next few years and always stay one step ahead. To prevent bank cards from being hacked, only by choosing suppliers who are responsible, continuously increase investment, and continuously upgrade security prevention and innovative technologies, and the national or industry security certification level can keep pace with the times, can the industry security be truly guaranteed.

　　The “cardless” transition is full of challenges

　　From China Merchants Bank launching "QuickPass" to China UnionPay launching "Cloud QuickPass", from WeChat and Alipay realizing third-party mobile payment to NFC smartphones realizing virtual card payment by binding bank cards, physical cards are gradually dying out, digital cards are emerging, and the domestic financial payment industry is transforming to "cardless". Just take out your phone and tap the screen to quickly complete a series of transactions such as merchant consumption, deposits and withdrawals, and bank branch business processing. However, the transformation to "cardless" requires cross-border cooperation and support from multiple parties such as banks, operators, and mobile phone manufacturers. Security loopholes in any link will make this seemingly "convenient and fast" payment method full of crises.

　　In summary, a powerful, advanced, and time-tested "chip" will effectively improve the security level of the entire bank card industry, protect the interests of users and card issuers, and safeguard the development of the industry. To this end, NXP provides industry-leading solutions for our customers.

　　SmartMX

　　NXP's SmartMX chip products are committed to meeting the needs of leading banking applications, enhancing the security and flexibility of bank card use, and providing more data and faster transmission rates. The chip is designed with NXP's IntegralSecurity architecture, has more than 100 advanced attack protection features, and has obtained Common Criteria Evaluation Level 6+ Certification (CC EAL), which is the most trusted and robust security configuration in the world. At the same time, NXP's SmartMX secure microcontroller uses the physical anti-cloning function (PUF) technology from Intrinsic-ID. PUF technology uses a unique "fingerprint" to protect encryption keys, making it extremely difficult to clone and reverse engineer the device, thereby protecting a single chip and effectively preventing data theft.

　　§ In 2009, NXP's SmartMX was selected as China's first generation electronic passport chip solution;

　　§ In 2012, Industrial and Commercial Bank of China selected its SmartMX2 high-security microcontroller chip to enhance the security and performance of its bank cards;

　　§ In 2015, SmartMX2 P60 obtained the "UnionPay Card Chip Product Security Certification Certificate" issued by the UnionPay Logo Product Enterprise Qualification Certification Office.

　　To date, SmartMX chips have been widely used in various contact and contactless applications with high security requirements at the hardware and software levels, including bank cards, access control management systems, public transportation infrastructure, device authentication, and e-government solutions such as electronic passports, driver's licenses, resident ID cards and medical insurance cards.

　　eSE

　　As one of NXP's two technologies to ensure secure payment, NXP's embedded secure element (eSE) solution provides advanced security features to help ensure the security of consumer data and provide privacy protection for data without relying on any external third party. In addition, eSE not only has security protection functions, but also personal data protection and related personal APP applications can obtain more added value through eSE.

　　Smart bank cards are an indispensable part of the vast Internet of Things. Today, bank cards have bid farewell to the era of magnetic stripes and have been completely replaced with "chips". At present, they are actively promoting "cardless" in order to bring a more convenient payment experience. However, in the modern information society dominated by hackers, smart bank cards are in danger of being covered with dust and losing their luster at any time. As an industry leader, NXP is committed to improving the security level of the entire bank card industry and protecting the interests of bank card users and issuing banks.

    The above is an introduction to NXP's unique secret of bank card security in the era of Internet of Things in security electronics. If you want to know more related information, please pay more attention to eeworld. eeworld Electronic Engineering will provide you with more complete, detailed and updated information.