PCI Watch

Tracking changes across the Payment Card Industry

EMVCo Statement – Security Evaluation Process for Software-Based Mobile Payments

Statements
Mobile NFC Consumer Device

EMVCo Statement – Security Evaluation Process for SoftwareBased Mobile Payments There are an increasing number of solutions being deployed that use software applications to perform payment transactions on mobile devices. As SBMP applications operate in the more vulnerable consumer device environment, solutions often use a layered security approach which takes into account various device and software components to help with combating the threats. In response to this trend, EMVCo established a Security Evaluation Process for software-based mobile payments (SBMP). The aim is to provide an efficient, flexible offering for product providers and promote a robust security foundation for SBMP solutions. EMVCo continues to enhance this process and has announced that as of 1st July 2019 the Mobile Application has now been added to the process as an additional evaluation component. As previously announced, the SBMP Security Evaluation Process is based on a ‘component’ and ‘integration’ evaluation model. This allows components to be evaluated either independently or together in order to validate the security of the overall solution. The current list of individual component evaluation and integration modules now includes:

  • Trusted Execution Environment (TEE)
  • Consumer Device Cardholder Verification Method (CDCVM)
  • Attestation
  • Software Protection Tools (SPT)
  • Mobile Applications and related Software Development Kits (SDK) EMVCo has also developed programme documents to describe the security requirements, evaluation process and methodology. To begin EMVCo’s SBMP Security Evaluation Process, product providers should contact the EMVCo SBMP Security Evaluation Secretariat and register as an EMVCo vendor, then complete and submit the SBMP registration questionnaire. The product provider must then contact a recognised EMVCo SBMP security evaluation laboratory to perform the security evaluation and submit the report to EMVCo. If the report review is successful, a unique SBMP Evaluation Certificate Number (SECN) will be issued by EMVCo to the product provider. EMVCo actively engages the payment community in developing, enhancing, and evolving future specifications and related testing processes. EMVCo has an established Associates Programme that is open to industry stakeholders. Input is received from Associates at both a technical and business level, as well as Subscribers, to support global interoperability and security. © 2019 EMVCo, LLC. All rights reserved. EMVCo encourages new participants who are interested in contributing to EMVCo’s initiatives to join the EMVCo Associates Programme or become an EMVCo Subscriber. © 2019 EMVCo, LLC. All rights reserved.