PCI Watch

Tracking changes across the Payment Card Industry

SB nº 225: EMV® 3-D Secure SDK—Device Information Data

v1.5 Specification Bulletins
3-D Secure

EMV<sup>®</sup> Specification Bulletin No. 225 September 2021 EMV 3-D Secure SDK—Device Information Data Version 1.5 This Specification Bulletin No. 225 provides updates, clarifications and errata incorporated into 3-D Secure—Device Information Data Version 1.5.

Applicability

This Specification Bulletin applies to:

  • EMV 3-D Secure—Device Information Data Version 1.5 Updates are provided in the order in which they appear in the specification. Deleted text is identified using strikethrough, and red font is used to identify changed text. Unedited text is provided only for context.

Effective Date

September 2021

countries.

Contents EMV 3-D Secure SDK—Device Information Data Version 1.5. Table 1. 2. 2. Table 2. 2. Table 2. 2. Table 2. 2. Table 2. 2. Table 2. 2. Table 2.

countries.

Chapter 1 Introduction 1.5 Data Version Number Refer to EMV<sup>®</sup> Specification Bulletin 255—3-D Secure Protocol Version Numbers for the Data Version Number status for the 3-D Secure protocol version. Table 1.2 Data Version Numbers Chapter 2 Device Information Parameters The 3DS SDK shall collect and provide to the 3DS Server either the:

  • The Common parameters (See Section 2.4) and one set of the Device Platform specific parameters (See Section 2.5 for Android, 2.6 for iOS, Section 2.7 for Windows OR
  • The Platform Provider-specific parameters See Section 2.8). All parameters shall be encoded as String or Array of String. Note: The 3DS SDK shall collect and pass the common parameters. This is the minimum requirement. In addition, the implementer shall ensure that the 3DS SDK collects as many device-platform-specific parameters as possible. The availability of a higher number of device parameters improves the effectiveness of risk-based decision making by the ACS. This, in turn, increases the probability of applying a frictionless flow.

2.1 Data Version The device identification parameters that are described in this document constitute Data Version 1.5.

2.2 Minimum Supported Platform Versions Table 2.1 Minimum Supported Platform Versions Platform Minimum Version Android Android 58 (API version 2126) iOS 1012

countries.

2.4 Common Device Identification Parameters Available in All Platforms Table 2.2 Common Parameters Available in Android, iOS and Windows 10 Platforms Identifier Parameter

Description

Permissions C002 Mobile device manufacturer and model.

  • Android: Build.MANUFACTURER + " " + Build.MODEL returns the mobile device manufacturer and model, For example,‘"samsung SMG960U1",
  • iOS: utsname.machine returns the device model., For example, "iPhone10,4 ". Note: "Apple" as a manufacturer is not included because it is the same for all iOS devices. C003 Operating system name.
  • Android: "Android" + " " + (Build.Version.SDK_INT equivalent field name from Build.Version.VERSION_CODES) + " " + Build.Version.RELEASE + " API " + Build.Version.SDK_INT returns, for example, the following format: "Android Q 10 API 29".
  • iOS: the systemName property of the UIDevice class returns the name of the operating system, for example, "iOS". C004 Operating system version.
  • Android: Build.VERSION.RELEASE returns the version of the operation system, for example, "8.1.0".
  • iOS: the systemVersion property of the UIDevice class returns the version of the operating system, for example,. "14.2". countries. Identifier C005 C006 Parameter Description Device locale set by the user.
  • Android: the device locale.Language() + "-" + locale.getCountry() returns, for example, the following format: "enUS". the country/region code for this locale, and the getLanguage returns the language code of this Locale
  • iOS: the device currentLocale.languageCode + "-" + currentLocale.countryCode returns, for example, the following format: "en-US". Time-zone offset in minutes between UTC and the device local time Example time zone offset values in minutes: If UTC -5 hours:
  • "300"
  • "+300" If UTC +5 hours:
  • "-300" Permissions C007 Advertising ID Unique ID available for advertising and fraud detection purposes. For example, in Android, this ID can be retrieved using the advertising ID APIs available in the com.google.android.gms.ads.identifier package in the Google Play Services library. Advertising ID should be in the DPNA when equals to zero with RE = 04 (null or blank), or with RE = 01 in case of access or use restrictions. In iOS, the ID can be obtained using the advertisingIdentifier of the ASIdentifierManager shared instance. No permissions required but privacy policy requirements may exist C008
  • iOS: screen resolution can be obtained from the UIScreen mainscreen bounds width and height. countries. Identifier Parameter Description Permissions C009
  • Android: default Bluetooth adapter device name can be used. C010 C013 local IP address of devicethe SDK in IPv4 or IPv6 format. The unique package name/bundle identifier of the application in which the 3DS SDK is embedded.
  • Android: obtained from the applicationContext.getPackageNam e() method.
  • iOS: obtained from the [NSBundle mainBundle] bundleIdentifier property. C016 SDK Ref Number Identifies the vendor and version of the 3DS SDK that is utilised for a specific transaction. The value is assigned by EMVCo when the Letter of Approval (LoA) of the specific 3DS SDK is issued. The ACS should verify that this value matches the SDK Reference Number present in the AReq message. No permissions required.

2.5 Android-specific Device Parameters Table 2.3 Android-specific Parameters Group or Identifier Element Description Telephony Manager A001 A002 Comments API level 29 or higher throws SecurityException or returns null. Set to RE04. API level 29 or higher, throws SecurityException or returns null. Set to RE04. Permissions

countries.

Group or Identifier Element Description Comments Permissions A006 through A016 No permissions requiredRun-time permissions A011 Use getDataNetworkType() only for API 24 or higher. A012 getPhoneCount() deprecated in API 30, Use getActiveModemCount() for API 30 and above A017 API level 29 or higher, throws SecurityException or returns null. Set to RE04. A018 No permissions requiredRun-time permissions A021 through A027 No permissions requiredRun-time permissions A138 simCarri erId Provides a platformwide unique identifier for each carrier. Available only for API 28 or higher No permissions required A139 simCarri erIdName Provides user-facing name of the specific carrier id Available only for API 28 No permissions or higher required A140 manufact urerCode Provides the Manufacturer code from the Mobile Equipment Identifier Available only for API 28 No permissions or higher required A141 simSpeci ficCarri erId Provides carrier ID of the current subscription Available only for API 29 or higher No permissions required

countries.

Group or Identifier Element Description Comments Permissions A142 simSpeci ficCarri erIdName Provides the userfacing name of the specific carrier ID Available only for API 29 No permissions or higher required A143 multiSim Supporte d Returns if the ability to register multiple SIM cards simultaneously on the network is supported by the device and by the carrier. Available only for API 29 or higher No permissions required A144 networkC ountryIs

  • Returns the ISO3166-1 alpha-2 country code equivalent of the Mobile Country Code (MCC) of the current registered operator. Available only for API 30 or higher No permissions required A145 subscrip tionId Returns the Available only for API 30 subscription ID for the or higher given phone account. No permissions required WiFiManag er A033 Deprecated in API level 29, use PackageManager.hasSy stemFeature() with PackageManager.FEAT URE_WIFI_RTT A037 Deprecated in API level 29, ability for apps to trigger scan requests will be removed in a future Android release. A146 is6GHzBa ndSuppor ted Returns a Boolean (coded as a string "0" or "1") if 6GHz band is supported. Available only for API 30 or higher Run time permission required A147 passpoin tFqdn Returns the Fully Qualified Domain Name of the network if it is a Passpoint network Available only for API 29 or higher Run time permission required countries. Group or Identifier A148 Element Description passpoin tProvide rFriendl yName Returns the Provider Friendly Name of the network if it is a Passpoint network. Comments Permissions Available only for API 29 or higher Run time permission required Bluetooth Manager A040 BondedDe viceMac Returns the array of BluetoothDevice objects MAC address coded as string that are bonded (paired) to the local adapter. For example:["48:F0:7B:61:DD:D4 ","ED:90:C2:3D:E8:14 "] A149 BondedDe vicesAli as Returns the array of BluetoothDevice alias coded as string that are bonded (paired) to the local adapter. API level 30 or higher Installation-time permissions Build A053 API level 29 or higher, throws SecurityException or returns null. Set to RE04. Settings Secure countries. Group or Identifier A076 A150 A151 Element Description Comments Permissions Encoded as either "false" or "true" Settings.Security. INSTALL_NON_MARKET _APPS constant deprecated in API level 2617. ACTION_INSTALL_PAC KAGE mechanism deprecated in API level 29. PackageManager.can RequestPackageInst alls() to be used instead from API level 29 onwards. RTT_CALL ING_MODE User selected Real Time Text (RTT) mode. Boolean coded as a string "0" or "1". Available only for API 28 or higher No permissions required SECURE_F RP_MODE Indicates whether the device is under restricted secure Factory Reset Protection (FRP) mode. Boolean coded as a string "0" or "1". Available only for API 30 or higher No permissions required Settings Global A152 APPLY_RA MPING_RI NGER Returns if ramping ringer is enabled on incoming call ringtone. Boolean coded as a string "0" or "1". Available only for API 29 No permissions or higher. required Package Manager A125 Returns an array of non-system application packages that are installed on the device. Include only packages that do not have ApplicationInfo.FL AG_SYSTEM set. countries. Group or Identifier A126 Webview A137 Element Description Comments Permissions Indirectly, this field can be used to determine whether the application has been installed from a trusted source. Deprecated in API level 30 Starting API level 30, use getInstallSourceInfo().get InstallingPackageName() Information about the WebView component utilized by the SDK for App-based HTML flow. No permissions required. webViewU serAgent The default user agent of the WebView component during App-based HTML flow. String defaultUserAgent = android.webkit.W ebSettings.getDe faultUserAgent(c ontext); No permissions required. 2.6 iOS-specific Device Parameters Table 2.4 iOS-specific Parameters Group or Identifier Attribute UIDevice I002 Description Accepted values:
  • Unspecified
  • iPhone
  • TV
  • carPlay
  • iPad
  • Mac countries. Group or Identifier UIFont I004 I006 I007 NSLocale I010 I011 I012 NSTimeZone I013 Attribute Description Returns an array of font names for all the font families listed in I003available in a particular font family using the system font family. Floating point number represented as a string, For example, ’10.5’ Floating point number represented as a string. For example, ’18 Formatted as the device locale language + "-" + device locale country. For example, "en-US". Returns an array of NString objectsstrings as provided by the OS method, each of which identifies a locale available on the system Returns the user's language preference order as an array of strings as provided by the OS method. Returns the time-zone offset in minutes between UTC and default time zone for the current application. Example time zone offset values in minutes: If UTC -5 hours:
  • "300"
  • "+300" If UTC +5 hours:
  • "-300" NSBundle I014 The file URL for the main application bundle’s App Store receipt. [[NSBundle mainBundle] appStoreReceiptURL] https://developer.apple.com/document ation/foundation/nsbundle/1407276appstorereceipturl This bundle property can be used to locate the receipt for an application purchased from the Apple App store. countries. Group or Identifier I015 Attribute Description Indirectly, this property can be used to identify whether the App has been installed from the Apple App store. appStoreReceiptExist s Encoded as either "false" or "true" Indicates whether the receipt file residing in the appStoreReceiptURL path exists and is non-empty. Indirectly, this field can be used to determine whether the application has been purchased from the Apple App store.

2.8 Platform Provider-specific Parameters Table 2.6 Platform Provider-specific Parameters Group or Identifier Parameter Description PermissionsComments D001 Platform that the device is using, as Not applicable a string.. D002 Platform-defined device model, as a No permissions required string. D003 Platform defined OS name, as a string No permissions required D005 Device locale set by the user, as a string.. The Device Locale as set by the user, is made of the device Language Code + "-" + current Country Code, for example, the following format: "en-US". No permissions required D006 Time-zone offset in minutes between UTC and the device local time Example time zone offset values in minutes:

  • If UTC -5 hours:
  • "300"
  • "+300" If UTC +5 hours:
  • "-300" No permissions required countries. Group or Identifier Parameter Description PermissionsComments D008 Pixel width and pixel height, as a string i.e., "1080x1920". No permissions required D021 DeviceId For example:
  • Hardware Device ID
  • Platform calculated device fingerprint Not applicable D022 DeviceTyp e Constant that indicates the device type. Valid Values:
  • 01 = Desktop
  • 02 = TV connected
  • 03 = Tablet/Mobile
  • 04 = Headless/Voice
  • 05 = Wearable
  • 06 = IOT
  • 99 = Other Not applicable D013 Applicati on Package Name The unique package name/bundle identifier of the application in which the 3DS SDK is embedded. Specific values in case the SDK is embedded on an Android or iOS device:
  • In Android, this is obtained from the applicationContext.getPackage Name() method.
  • In iOS, this can be obtained from the [NSBundle mainBundle] bundleIdentifier property. No permissions required. D015 SDK Version 3DS SDK version as applied by the implementer and stored securely in the SDK (refer to Req 58 in the EMV<sup>®</sup> 3DS SDK Specification). No permissions required countries. Group or Identifier Parameter Description PermissionsComments D016 SDKRef Number Identifies the vendor and version of the 3DS SDK that is utilised for a specific transaction. The value is assigned by EMVCo when the Letter of Approval (LoA) of the specific 3DS SDK is issued and is provided as a string. No permissions required The ACS should verify that this value matches the SDK Reference Number present in the AReq message. D017 Challenge Window Size Challenge window width and height in pixels, as a string i.e., "500x600" D021 DeviceId Unique and immutable identifier linked to a device that is consistent across 3DS transactions for the specific user device. For example:
  • Hardware Device ID
  • Platform calculated device fingerprint D022 DeviceType Constant that indicates the device type. Valid Values:
  • 01 = Desktop
  • 02 = TV connected
  • 03 = Tablet/Mobile
  • 04 = Headless/Voice
  • 05 = Wearable
  • 06 = IOT
  • 99 = Other D023 List of cardholder input methods Not applicable enabled on the device as an array of strings, i.e., ["01", "02"] D024 List of output methods enabled on the device as an array of strings: Not applicable countries. Group or Identifier Parameter Description PermissionsComments D025 Preferred network and issuer logo colour preference provided as a string No permissions required D026 This identifier is a unique immutable hash of the users account identifier for the given platform, provided as a string. Note: The UserID may change if the User resets the device. No permissions required but privacy policy requirements may exist D027 Gets the set of languages preferred by the user, in the order of preference as an array of strings as defined in IETF BCP47. No permissions required D028 Provided as a string Not applicable D029 IPAddress External IP address of the device as collected by the SDK in IPv4 or IPv6 format, provided as string. D030 BrowserAccept Headers Exact content of the HTTP Accept Headers as sent to the 3DS Requestor from the Cardholder’s browser, provided as string. Browser-SDK only. D031 BrowserUserAgent Exact content of the HTTP UserAgent header, provided as string. D032 DeviceID-Type Information about the Device ID:
  • 01 = Hardware based identifier
  • 02 = Hardware fingerprint identifier
  • 03 = Key based software identifier
  • 04 = Software fingerprint identifier Provided as a string, for example: "03" countries. Group or Identifier Parameter Description D033 Originati ngDeviceI DType Information about the Device ID: Valid values:
  • 01 = Hardware based identifier
  • 02 = Hardware fingerprint identifier
  • 03 = Key based software identifier
  • 04 = Software fingerprint identifier Provided as a string, for example: "03" PermissionsComments 2.10 Device Information JSON Data The values listed in Table 2.7 shall only be present in the DPNA data object. The values (SWxx) listed in EMV 3-D Secure SDK Specification shall only be present in the SW data object. Table 2.8 Device Parameters JSON Structure Platform Device Information Android {"DV":"1.5","DD":{"C001":"Android","C002":"HTC One_M8","C004":"5.0.},"DPNA":{"C010":"RE01","C011":"RE03"},"SW":[ "SW01","SW04"]} iOS {"DV":"1.50","DD":{"C001":"iOS","C002":"iPhone 5c6,1","C003":" iPhone OS ","C004":"9.}," DPNA":{"C010":"RE01","C011":"RE03"},"SW":["SW01","SW04"]} Windows 10 {"DV":"1.50","DD":{"C001":"Windows","C002":"NOKIA RM984_1006","C003":"WindowPhone","C004":"10.0.10586.1},"DPNA":{"C010":"RE02","C011":"RE03"},"SW":[" SW01","SW04"]} countries. Platform Device Information Platform Provider specific {"DV":"1.5","DD":{"D001":"Android","D002":"Personal device","D003":"aPhone","D004":"13.0.186.},"DPNA":{"D028":"RE02","D031":"RE03"},"SW":[" SW01","SW04"]} countries.

Legal Notice

The EMV<sup>®</sup> Specifications are provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in these Specifications. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THESE SPECIFICATIONS. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to the Specifications. EMVCo undertakes no responsibility to determine whether any implementation of the EMV<sup>®</sup> Specifications may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of the EMV<sup>®</sup> Specifications should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, the Specifications may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement these Specifications is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party’s infringement of any intellectual property rights in connection with the EMV<sup>®</sup> Specifications

countries.