Introduction

This guide gives information about how a terminal solution should be implemented for subsequent terminal transaction processing, taking into consideration various potential requirements.

Intended Audience

This guidance is aimed at PSPs that are planning to implement a card-present terminal solution based on the UniRead application.

Overview

If a PSP needs to provide its merchants a terminal solution, it is required to undertake a series of steps to allow for this solution. Below are these steps, as well as the terms that you are going to come across in the text to help you better understand this process step-by-step.

The implementation process of the terminal solution involves the following participants:

• PSP - a payment service provider that implements the terminal solution to provide the ability to process terminal transactions to its software platforms and merchants.
• Processor - a provider through which PSP’s merchants process terminal transactions.
• Fulfillment center - a service provider that processes terminal orders, installs terminal software and ships terminals to PSP’s merchants.
• Gateway - a technical platform used to process terminal and non-terminal transactions; the gateway includes the FMS module that ensures the creation and monitoring of terminal orders and is integrated with processors for terminal transaction processing, and potentially with a fulfillment center to exchange information about orders.

To understand the terminal implementation solution process, it is useful to know the following terms:

• Terminal Application - a terminal payment application UniRead, which is installed on the terminals and allows for processing terminal transactions.
• Injection keys - keys used to encrypt the data that is input into a terminal (card number, PIN, etc). The keys are uploaded to the terminals during the fulfillment process. To learn more about injection keys, follow this link.
• Signing toolkit - a device used to sign the terminal application that is going to be uploaded to a terminal. A toolkit, which looks similar to the terminal device, comes with a plastic card with a key by which the application is signed. This device is provided by a terminal manufacturer, such as Ingenico.
• Embedded SDK (Software Development Kit) - software allowing for creating and managing terminal applications.

Also, when working with the Ingenico platform, it is useful to know the meaning of the following terms:

• Telium 2 - a terminal OS used by Ingenico terminals for operation.
• LLT (Local Loading Tool) - software used to upload files (including the terminal application) to Ingenico terminals.
• RBA/KIA - the original payment application of Ingenico, which is an equivalent of the UniRead application.

Terminal Solution Implementation Steps

Implementation of a card-present terminal solution requires resolving several issues, such as which terminal models to choose, which processor is going to be used to process terminal transactions, which fulfillment center to use, etc. Every step of the implementation process is described in detail below:

Defining a list of terminal models to be used for terminal transaction processing

Each PSP is required to define which terminal models to be used to fulfill future terminal orders based on the requirements of the PSP and its clients. The list of terminal models currently supported by UniPay is available here.

Integrating with a processor to be used for terminal transaction processing

To process terminal transactions, the gateway must be integrated with a processor through which terminal transaction processing will be done.

The integration involves two phases:
1. Integration with the processor.
2. Terminal certification with the processor.
2.1 Selection of supported EMV transaction: contact, contactless or both.

If the PSP is going to use P2PE encryption in terminal transaction processing, it is required to decide whether the P2PE logic of the processor (for example, TransArmor) or UniPay will be used.

• If encryption is going to be done through the processor, the PSP must request that the processor provide the P2PE encryption keys that it uses. When using asymmetric encryption keys, it is important to ask the processor for the public keys. When using symmetric encryption keys, the uploading process of the keys to the terminals should be discussed with the fulfillment center because this type of encryption key requires that more security measures to be applied. To learn more about asymmetric and symmetric encryption keys follow this link. When choosing the encryption approach, it is necessary to verify whether the desired algorithm is supported within the gateway.
• If the encryption is going to be done through UniPay, the PSP can use the dedicated software. However, it is recommended to use the HSM device for the encryption purposes.

When the HSM device is going to be used:

• If the PSP already has an HSM device, it is necessary to confirm with UniPay which specific device is used and whether the gateway already has a required integration. (For example, the gateway is integrated with the SafeNet Luna device.)
• If the PSP does not have an HSM device, it is necessary to buy one after verifying that it can be supported by UniPay. (An HSM device is not required if the encryption can be executed at the software level.)

It should be pointed out that if the PSP wants to undergo P2PE PCI certification, it is mandatory to use an HSM device (PCI PTS validated HSM or NIST FIPS-140-2 Level 3 HSM) for P2PE encryption because, according to the PCI requirements, it is the most secure data encryption method.

Selecting how terminal fulfillment is done

The PSP can execute terminal fulfillment either independently or through a certified fulfillment center. To learn more about fulfillment centers and the fulfillment process, follow this link.

Selecting how the interaction with a fulfillment center is done

There are two possible options for interaction with the fulfillment center: using an integrated fulfillment logic or placing the orders manually, directly through a fulfillment center. If the PSP needs to use the integrated fulfillment logic, then fulfillment center integration with UniPay is required (for example - TPG). If the PSP prefers to place terminal orders directly through a fulfillment center, UniPay supports this scenario by providing a standalone fulfillment center configuration (for example, Ingenico) allowing for the creation of orders in a more convenient way. In the second case, the fulfillment center should be registered within the system to ensure that the logic works properly.

There are three fundamental aspects of the fulfillment process that are implemented in different ways, depending on the approach that has been selected:

• overall interaction with the gateway during order creation;
• notifications that are sent as an order status gets changed;
• the activation process of a terminal prior to the first use, when an activation code is required.

1) Interaction with UniPay
Integrated solution: An order is created in the gateway and sent via a configured integration to the fulfillment center. Once the order is submitted, information about the status of the order is communicated back to the gateway and becomes available for review. If any issues arise during the fulfillment process, they can be resolved via UniPay due to the access to the order information. Standalone fulfillment center: An order is created manually in the fulfillment center directly. The ID of the order is registered within the gateway (a terminal key is created) for every terminal ordered. Subsequent tracking of the fulfillment process via the gateway is unavailable and if any issues regarding the fulfilment process arise, they cannot be resolved.
2) Notifications
Integrated solution: During the terminal order process, the submitter of an order receives notifications with information about the current status as well as tracking information, such as ID or tracking number. Standalone fulfillment center: FMS does not participate in the ordering process. For this reason the notifications are not sent to the submitter.
3) Terminal activation
Integrated solution: The submitter of an order receives activation code(s) in a notification once information about the final results of the fulfillment process is communicated back to gateway from a fulfillment center. Standalone fulfillment center: A merchant tracks the order status in the gateway by themselves via PSP. When the fulfillment process is finished and the terminal order is shipped, the activation code is automatically uploaded to the gateway and is available on the Details form associated with each new terminal record.

Coordination of the terminal models, parameters and sticker content with the fulfillment center

Once a fulfillment center is chosen, the PSP needs to confirm several configurations to be used for the subsequent orders. These configurations include:

• a list of the PSP’s chosen terminal models available for ordering;
• information that will be printed on the stickers of the terminals.

Additionally, PSPs should take into account that the behavior of the ordered terminals is to a large extent controlled by the configured parameters of the terminals. Since these configurations are typically similar for the merchants that belong to a particular segment or the merchants of a software platform in a the particular country, it is possible to create terminal configurations (or parameters) templates within the system. These templates specify the behavior of a terminal. For that reason, prior to providing terminals to the merchant, it is recommended that the PSP analyze its customer base and define the logical groups that could use the same set of parameters (for example, fitness centers or restaurants). Along with that, segmentation can be based on the merchants working with certain processors, that underwent the EMV certification (EMV kernel) for certain countries and terminal manufacturers (for example, for Ingenico and Verifone separate certifications are needed).

Obtaining of the processor’s injection keys and providing them to the fulfillment center

Once a fulfillment center is chosen, you need to provide it with the injection keys of the processor that will process terminal transactions. If the fulfillment center already works with the processor, it may already have its injection keys. To verify that, KSI (key serial identifier) is required. You can obtain KSI from the processor and subsequently transfer it to the fulfillment center.

• If the fulfillment center already has the injection keys, ensure that the configurations of your profiles allow for access to them.
• If the fulfillment center does not have the injection keys, ensure that the process of obtaining the keys by the fulfillment center from the processor is initiated.

Keys that have to be injected are the following:
For US: PIN (required), P2P (optional; applied only if P2P encryption is used). To obtain the PIN key, you have to request it from a processor. The requested key will be used by all of your merchants that work with this processor. To obtain a P2PE key, no actions are required from your side. the key gets automatically retrieved from TMS server by get-key request. For Canada: PIN (required), MAC (required), P2P (optional; applied only if P2P encryption is used). To obtain the PIN and MAC key, you have to request them from a processor. As a rule, these two keys always work together and are individual for every terminal device. To obtain a P2PE key, no action is required from your side. The key gets automatically retrieved from TMS server by get-key API call.
The fulfillment center needs the keys to ensure future fulfillment of the terminals. To learn more about injection key, follow this link.

Testing the integration with the fulfillment center

It is important for the PSP to test the order submission process.

• If the PSP uses the fulfillment center integrated with UniPay, the testing process should be done as follows:

1. Place a terminal order within the gateway.
2. Verify the consistency of the information about the order between gateway and fulfillments center.
3. Check the incoming notifications, particularly branding elements and the associated information.
4. Wait until the order is received.
5. Verify if the information on the stickers is correct.
6. Verify if all order components are present.
7. Activate the terminal and make a live transaction (preferably using a PIN code).

• If the PSP does not use the fulfillment center integrated with UniPay, the testing process should be done as follows:

1. Register a TID, which is going to be assigned to the new terminal within the gateway.
2. Place an order within the fulfillment center.
3. Verify if the tracking information is available on the portal of the fulfillment center.
4. Verify the incoming notifications from the fulfillment center.
5. Wait until the order is received.
6. Verify if the information on the stickers is correct.
7. Verify if all order components are present.
8. Activate the terminal and make a live transaction (preferably using a PIN code).

Migrating a terminal from one merchant account to another one

A merchant can migrate an existing terminal from one merchant account to another merchant account. In this case, the merchant doesn't have to send them to TPG for reflashing.

Signing the terminal application by the customer

Toolkit ordering

Once testing is done successfully, it is necessary to order a toolkit from the company that provides terminals to the PSP (for example, Ingenico). Signing of the application is a measure that secures terminals from a malicious software or application uploading. It is impossible to ensure proper remote control of the deployment process without having the application signed. The toolkit allows for signing the application by a key, which is a security profile that has been previously used for terminal initialization. Any software that has not been signed cannot be installed on the terminal. Follow this link to learn how to differentiate a toolkit from the processing terminal. The application is signed by the PSP itself.

Receiving a toolkit and signing the application according to the instruction

If the PSP is going to use the UniRead application for terminal transaction processing, the application must be signed. It is highly recommended to order a toolkit in advance since its preparation and delivery take up to two months. Review Appendix 1 explaining step-by-step instruction on signing the application with a signing toolkit to learn more about the terminal installation process. For Canada: application is signed for every merchant individually. When working through Interac, the application must be signed by a fulfillment center or a processor (acquirer) directly that cooperates with Interac. The PSP should coordinate the application signing process with the acquirer. For USA: application is signed once for all merchants.
If a terminal’s source code gets updated (the PSP is notified about that in advance), the gateway support team sends an updated application to the PSP. The application must be signed by the available toolkit following the same steps.

Testing the application and submitting to the fulfillment center

Once the payment application has been signed by the PSP, it must be tested by UniPay’s QA team in the production environment. Following successful testing, the ready-to-use application (including the signed installation package with the terminal OS if the PSP is working with UniPay for the first time) is sent to the fulfillment center. The signed application is then uploaded to all terminals of the PSP independently of a processor.

Typically, when working with Ingenico terminals, the RBA application is used. RBA is similar to UniRead and works on ОS Telium 2. If the PSP works with UniRead, it is preferable to make sure that the RBA or KIA applications are not installed on the terminals since the PSP is going to use UniRead, which works with UniPay (unlike RBA).

Transferring UniPay application to the fulfillment center

When the fulfillment center receives the application, the fulfillment center needs to pay attention to two factors to ensure secure upload to future terminals:

LLT availability (for Ingenico terminals), access to TMS and stable Internet connectivity on the side of the fulfillment center

To initialize a terminal, the initial (basic) payment application upload must be done. For Ingenico terminals, this is done via LLT. To work with it, the specific access and experience that are required with initialization, configuration and subsequent updates of the terminal are executed via the TMS (terminal management system) server. Communication with the TMS server is done via the Internet.

The terminal can be connected to the Internet in three ways:

1. Ethernet cable (wired Internet and router are required) – available for the majority of terminal models;
2. Wi-Fi configuration (Wi-Fi connection is required) – available for terminal models supporting Wi-Fi;
3. Connecting a terminal to a mobile device that has access to the Internet by pairing them via Bluetooth (a smartphone or tablet working on a supported iOS or Android OS are required) – available for the models supporting this functionality.

Availability of the iOS device in the fulfillment center (optional; applies for cases when the application is uploaded to the particular terminal models)

To ensure software installation for such terminal models as Ingenico iCMP and iSMP, iPad, iPod or iPhone devices are required since these terminal models work via mobile devices. The exception is iSMP4 model, which can also work via Wi-Fi.

Appendix 1 - Terminal Application Signature

Tools and documents needed

• Signing Toolkit with Telium 2 Signature software, key card and Certificate provided by Ingenico;
• Terminal application.

General Information

Terminal application consists of 5 folders (see screenshot):
Each folder consists of 3 sub-folders (see screenshot):
Each sub-folder has multiple files.


Steps to follow to sign the application

1. Copy the folder with the terminal application to the PC. The terminal application is sent by RM directly to the client as a ZIP file or uploaded into the Dropbox.
2. Run the Telium 2 Signature program on the PC. This user interface allows configuring all settings required for the signature operation with their own contextual help.
3. Fill out the needed files into the following sections in the Telium 2 Signature program.
4. Sign the application by pressing Sign button when it gets activated. 5. Insert the key card into the signing toolkit. If everything is done properly, you will receive approval.
6. As soon as you are completed with the PROD_ADMIN folder, sign all other folders following the steps above.

Appendix 2 - QA Procedures for Terminals

When operating, terminals obtain regular updates. To learn more about the update procedure, review the Terminal Update Guide. After a terminal is updated, you should test its functionality following certain procedures. Review QA procedures in this appendix.