This document describes instructions, policies and procedures, for integrators of Invenco Group’s
security products into larger systems (e.g. into payment terminals for petrol station forecourts). Its
security classification reflects that it is available only to parties approved by Invenco; anyone in
possession of it is responsible for maintaining confidentiality of the manual itself and all information
contained herein.
1.1 Important Related Documents
Invenco’s security products manage sensitive information. Accordingly the company imposes certain
strictures which apply even while Invenco does not have custody of its products. These strictures
must be adhered to by integrators (and their agents such as service technicians – Invenco makes no
distinction for the purpose of responsibility). They are compiled separately into [G7INTSEC] which is
available publicly; they are not the focus of this document.
Similarly this document is not a developer manual: it does not duplicate information essential to
programmers writing software to work with Invenco’s products. Software development is a challenging
task for integrators; Invenco provides extensive support for it. Integrators should approach the company
for resources and assistance.
1.2 Important Information on Radio Frequency Components
This section applies to the G7UPC which includes a Near Field Communication (NFC) module and
antenna for use with contactless cards.
1.2.1 FCC Compliance Statements
THIS DEVICE COMPLIES WITH PART 15 OF THE FCC RULES. OPERATION IS SUBJECT TO THE
FOLLOWING TWO CONDITIONS:
1. THIS DEVICE MAY NOT CAUSE HARMFUL INTERFERENCE, AND
2. THISDEVICEMUSTACCEPTANYINTERFERENCERECEIVED,INCLUDING
INTERFERENCE THAT MAY CAUSE UNDESIRED OPERATION.
THE GRANTEE IS NOT RESPONSIBLE FOR ANY CHANGES OR MODIFICATIONS NOT
EXPRESSLYAPPROVEDBYTHE PARTYRESPONSIBLEFORCOMPLIANCE.SUCH
MODIFICATIONS COULD VOID THE USER’S AUTHORITY TO OPERATE THE EQUIPMENT.
Note: This equipment has been tested and found to comply with the limits for a Class B digital device,
pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection
against harmful interference in a residential installation. This equipment generates uses and can radiate
radio frequency energy and, if not installed and used in accordance with the instructions, may cause
DWI-00175 S1 R151
G7OPT Integrator Manual, DWI-00175 S1 R15
harmful interference to radio communications. However, there is no guarantee that interference will not
occur in a particular installation. If this equipment does cause harmful interference to radio or television
reception, which can be determined by turning the equipment off and on, the user is encouraged to try
to correct the interference by one or more of the following measures:
• Reorient or relocate the receiving antenna.
• Increase the separation between the equipment and receiver.
This device has been designed to operate with the G7UPC NFC module antenna only. A picture of this
antenna is shown in §5.2.2.1 Antenna Kit Description. The use of other antennas with this device is
strictly prohibited.
1.2.2 Industry Canada Compliance Statements
This device complies with Industry Canada’s license-exempt RSSs. Operation is subject to the following
two conditions:
1. This device may not cause interference; and
2. This device must accept any interference, including interference that may cause undesired
operation of the device.
Le présent appareil est conforme aux CNR d’Industrie Canada applicables aux appareils radio exempts
de licence.
L’exploitation est autorisée aux deux conditions suivantes :
1. l’appareil ne doit pas produire de brouillage, et
2. l’utilisateur de l’appareil doit accepter tout brouillage radioélectrique subi, même si le brouillage
est susceptible d’en compromettre le fonctionnement.
Chapter 1. Introduction2
CHAPTER 2
Shipment Verification
2.1 Introduction
This chapter provides a guide to the security verification of the G7OPT/SDC/UPC on receipt.
It is necessary that, before the units are deployed, their integrity is verified and there is no evidence of
them having been compromised or altered during shipping.
It is also essential that full asset-tracking of units takes place during shipping, to ensure early
identification of stolen units.
Finally it must be verified that the version of each unit is as expected and as required for deployment.
The processes described outline the verification steps that should be taken, and the appropriate
escalation process to follow when relevant.
DWI-00175 S1 R153
G7OPT Integrator Manual, DWI-00175 S1 R15
2.2 Shipment Checks
Unpacking and package-checking of the shipment must include the following checks as a minimum:
• validation of correct delivery
• validation of bulk packing is intact
• validation of correct quantity and serial numbers
• validation of individual box tamper-seals.
2.2.1 Bulk Packaging Check
Before the individual items are removed from the bulk package, the bulk package must be inspected
for damage or tampering. If evidence of damage or tampering is found, the following steps should be
taken:
• take photographic evidence of the damage/tampering
• raise an exception report including the photographic evidence; see §2.5.2 Exception Escalation.
2.2.2 Serial-number Check
It is important not only that quantities are validated but also that the serial numbers of the expected
items correspond to the packing-slip.
Each box must contain the serial number of the enclosed product, which must be checked off against
the packing-slip.
Should the contents of an individual box not be validated as correct at this stage, a check for the correct
serial number must be performed at the time of opening the box.
Should a serial number be missing or unrecorded on the packing-slip an exception must be raised as
defined in §2.5.2 Exception Escalation.
2.2.3 Individual Box Checks
Ensuring the packaging of the individual item is intact is essential and must be performed on all items
received.
The following process is to be used to ensure each item has been received with integrity intact:
• check that the tamper-seals (top and bottom), as shown in picture below, are correct by inspecting
them for the following signs of tampering:
– the seal is as per the image below
– the seal does not show the words VOID
– the seal has not been cut
– there are not multiple seals overlaid
– the seal has not been covered by clear tape
– there is only one seal on the top and bottom of the box
• check that the packaging has not been opened or cut in any way
• check that the box is not damaged.
Chapter 2. Shipment Verification4
G7OPT Integrator Manual, DWI-00175 S1 R15
Fig. 2.1: Good tamper seal
Fig. 2.2: Bad tamper seal
Chapter 2. Shipment Verification5
G7OPT Integrator Manual, DWI-00175 S1 R15
2.3 Integrity Verification
Ensuring that the unit is secure and has not been tampered must be performed at staging before the
device is deployed to site.
If the device is found to be in a compromised state the escalation process below must be followed.
To check the integrity of the unit the following two processes must be followed:
2.3.1 Initial Power-on Check
When the unit is powered on, it determines whether an exception occurred during its power-on self-test
or any tampers were triggered while it was powered down. In either case the device will place itself in a
restricted mode, with distinctive indications given according to whether it was Destructive Secure Reset
or removal-tampered.
2.3.1.1 Tamper Indications
A DSR is a dramatic response to what a unit interprets as an integrity violation: the device shuts down
instantly, wiping its security keys and other sensitive information. The device is not ruined but it is
“bricked”: it cannot operate in any capacity and can be disassembled, repaired and reinitialized only
by Invenco – a return-to-base procedure. Returning a destructive-tampered unit to Invenco requires an
auditable process with formal changes of custody, probably including packaging, transport and staging.
The G7SDC will display a “DT event” screen; the G7UPC will display a fast (twice a second) red keypad
LED indication:
In contrast, the removal tamper response is intentionally less drastic. Removal tamper sensors protect
a unit that is intact: it may have been removed – even maliciously – from a system in which it was
integrated, but the unit’s integrity has not been violated and it is still operational (albeit in a restricted
mode). Significantly its cryptographic keys have not been erased, although it remains incapable of
financial transactions until restored to normal operation from the removal-tampered state. If necessary
the unit can still perform a DSR.
The G7SDC will display a “RT event” screen; the G7UPC will display a slow (once a second) red keypad
LED indication:
Chapter 2. Shipment Verification6
G7OPT Integrator Manual, DWI-00175 S1 R15
Fig. 2.4: SDC Removal Tamper (RT) event screen
If this occurs, follow the exception escalation process defined in §2.5.2 Exception Escalation.
2.3.2 Hardware Certification Status
The second test – assuming the device has booted successfully – is to check that its certificates are
loaded and intact.
This test requires the use of TMSlite to query the key-store status using the following steps:
1. Connect the terminal to the workstation that is running TMSlite, with an intermediate protocol
converter such as Invenco’s external application-software controller.
2. (First time only) Click Add, enter the terminal connection details, then click OK.
3. Select the terminal from the left-hand list, click Connect, then select “UPC” from the filter dropdown list.
4. Scroll down the list and make sure the properties upc.certificate.housekeeping and
upc.certificate.module are present and not empty. If either property is missing, follow the
exception escalation process defined in §2.5.2 Exception Escalation.
5. Repeat for the SDC by selecting “SDC” from the filter drop-down list, and make sure the properties
sdc.certificate.housekeeping and sdc.certificate.module are present and non-empty.
Fig. 2.5: TMSlite – UPC certificate entries (red text example only)
Chapter 2. Shipment Verification7
G7OPT Integrator Manual, DWI-00175 S1 R15
Note: For more details on using TMSlite, please refer to the TMSlite manual.
Chapter 2. Shipment Verification8
G7OPT Integrator Manual, DWI-00175 S1 R15
2.4 Version Verification
Before a unit is deployed into a production environment, version information should be validated to
ensure it is correct.
Use the following process to verify the hardware certification revision and software version information.
2.4.1 Hardware Certification Revision
Ideally, a hardware certification revision number check can be done at the same time as verifying the
serial number.
On the back of each unit is a product information sticker which contains, amongst other information, a
serial number and the hardware certification revision number.
Inspect this sticker and confirm the certification revision is correct.
Fig. 2.6: G7SDC serial number and hardware certification revision number
Chapter 2. Shipment Verification9
G7OPT Integrator Manual, DWI-00175 S1 R15
Fig. 2.7: G7UPC serial number and hardware certification revision number
Note: The red content in the above images is for illustrative purposes for this document and must not
exist on actual product labels.
2.4.2 Software Version Numbers
To obtain the core security modules’ version information, the terminal management interface will need
to be interrogated.
Using TMSlite or an in-house proprietary terminal management tool, retrieve the version information
and validate the information tags below.
Note: The paramount firmware-versions have the tags "upc.root.ver" and "sdc.root.ver" for their
respective devices. These versions are controlled by the build system which ensures that all firmware
components – including the Boot Monitor, Root Filesystem and Tamper Monitor – are built and versioned
at the same time.
• Unified PIN pad and Card-Reader: "upc.*.ver", where * is one of:
– hw
– bootmonitor
– init
– kernel
– root
– safekernel
– saferoot
– emvl1
• Secure Display Unit: "sdc.*.ver", where * is one of:
Chapter 2. Shipment Verification10
G7OPT Integrator Manual, DWI-00175 S1 R15
– hw
– bootmonitor
– init
– kernel
– root
– safekernel
– saferoot
– softkey
– touchscreenfrm
Chapter 2. Shipment Verification11
G7OPT Integrator Manual, DWI-00175 S1 R15
2.5 Communications
2.5.1 Receipt Verification
Invenco requests confirmation that the shipment has been received in full. This should be sent to
orders@invenco.com.
This communication must confirm the following:
• Expected quantity has been received.
• All packages/boxes are in good order and security seals intact.
• All serial numbers are accounted for.
2.5.2 Exception Escalation
Should any of the checks detailed in §2.2 Shipment Checks identify that the delivery has been
compromised, or if the checks detailed in §2.3 Integrity Verification and §2.4 Version Verification are
not correct, the following escalation process must be followed:
• Send an email to orders@invenco.com detailing the exception, including all the evidence outlined
in the verification processes above.
• If possible, follow through with a phone call to Invenco using the contact details provided on the
contact page of the Invenco website: http://www.invenco.com/contact
• Notify the shipping/courier of this exception if applicable.
Chapter 2. Shipment Verification12
CHAPTER 3
Tampers
3.1 Background – Tamper Types
Many Invenco products support two types of tamper protection; in increasing order of security they are:
• removal tamper
• destructive tamper, also known as “Destructive Secure Reset” (DSR).
3.1.1 Tamper Indications
A DSR is a dramatic response to what a unit interprets as an integrity violation: the device shuts down
instantly, wiping its security keys and other sensitive information. The device is not ruined but it is
“bricked”: it cannot operate in any capacity and can be disassembled, repaired and reinitialized only
by Invenco – a return-to-base procedure. Returning a destructive-tampered unit to Invenco requires an
auditable process with formal changes of custody, probably including packaging, transport and staging.
The G7SDC will display a “DT event” screen; the G7UPC will display a fast (twice a second) red keypad
LED indication:
In contrast, the removal tamper response is intentionally less drastic. Removal tamper sensors protect
a unit that is intact: it may have been removed – even maliciously – from a system in which it was
integrated, but the unit’s integrity has not been violated and it is still operational (albeit in a restricted
mode). Significantly its cryptographic keys have not been erased, although it remains incapable of
financial transactions until restored to normal operation from the removal-tampered state. If necessary
the unit can still perform a DSR.
DWI-00175 S1 R1513
G7OPT Integrator Manual, DWI-00175 S1 R15
The G7SDC will display a “RT event” screen; the G7UPC will display a slow (once a second) red keypad
LED indication:
Fig. 3.2: SDC Removal Tamper (RT) event screen
3.2 Removal Tampers
Removal tampers are designed with integrators and their agents in mind; they maintain financial security
while allowing legitimate operations, such as installation or swap-out by service staff. While in the
removal-tamper state, the following operations are possible using TMSlite:
• clearing removal tampers
• installing packages
• retrieving logs
The following sections describe the steps for:
• connecting an Invenco product to external tamper sensors that will protect it within an integrated
system
• clearing the removal-tamper state and promoting the unit to normal operation.
The reverse steps, for removing a unit, need no explanation; they should be straightforward and largely
mechanical. In contrast with installing a device and clearing its removal-tampered state, cryptographic
authentication is unnecessary. The main security considerations when removing a unit are to avoid an
accidental DSR in the process and not to lose it afterwards.
Note:It is strongly recommended to retrieve all logs before unit removal, for problem-solving and
root-cause analysis.
Chapter 3. Tampers14
G7OPT Integrator Manual, DWI-00175 S1 R15
3.2.1 Installation with Removal-Tamper Sensors
1. Obtain access to where the unit will be integrated into its system, paying attention to authorisation
by accredited staff.
2. Obtain custody of the unit and any documentation, cables and other ancillary products.
Adhere to the requirements for custody change, unpacking, etc. in [G7INTSEC] as appropriate.
3. Mount the unit, and others which it will be connected to, in accordance with the integrator’s
instructions and those of Invenco.
See §5.1 G7SDC Installation Guide or §5.2 G7UPC Installation Guide for details. If instructions
conflict, Invenco’s must take precedence; failure to observe this may compromise the unit’s
security and/or void its standards certification.
4. Connect the unit to all others that it is being integrated with.
Tamper connections will vary according to whether the Invenco unit is integrated standalone or in
an Invenco housing. Both methods are described in the appended installation guides. Removal
tampers are likely to have been connected already in the course of mounting the unit; additional
connections for tampers should be unnecessary.
3.2.2 Removal-Tamper Clearing and Promotion to Normal Operation
1. The unit is now integrated into the system; it is in the removal-tampered state. Power it up and
verify that restricted-mode operation is possible.
In removal tampered state:
• the UPC will display a slow (once a second) red flashing LED
• the SDC will display a “removal tamper” error message
2. To clear the removal-tampered state and enable the unit for normal operation requires a
cryptographically authenticated challenge and response between it and an authorisation device.
This transaction is performed under dual control, the two parties being a field engineer and a
control-centre operator.
(a) The field engineer must first request a challenge token from the integrated unit. This is
achieved by:
i. Connect the terminal to the workstation running TMSlite.
ii. (First time only) Click Add, enter the terminal connection details, then click OK.
Fig. 3.3: Terminal connection details.
iii. Select the terminal from the left-hand list, then click Connect.
Chapter 3. Tampers15
G7OPT Integrator Manual, DWI-00175 S1 R15
iv. Selecting the menu option Tools > Tamper Clear.
Fig. 3.4: TMSlite “Tamper Clear” menu option
v. Choosing either “UPC Tamper Clear” or “SDC Tamper Clear” from the dialog box drop-
down menu.
Fig. 3.5: TMSlite “Tamper Clear” dialog box
vi. Clicking “Challenge” to display the required challenge token.
(b) Next, the field engineer must log in to the control centre and post the token and the device’s
serial number into an installation authorisation request.
(c) The control-centre operator must now approve the request (if they deem it valid), then
generate an authorisation token and return it to the field engineer.
(d) The field engineer submits the authorisation token to the device by keying it in manually and
clicking “Apply”.
Note:
• The display unit (SDU/SDC) and keypad (UPC) must be connected together throughout this
process.
• The challenge / response operation must be completed within 30 minutes; if not, a new challenge
token must be generated and the process repeated.
The unit itself is now in normal mode and ready for operation. Devices that it is integrated with may
require additional steps; consult product manuals.
Chapter 3. Tampers16
G7OPT Integrator Manual, DWI-00175 S1 R15
3.3 Retrieving logs and exporting parameters
It is strongly recommended to retrieve all logs before unit removal, for problem-solving and root-cause
analysis.
1. Select menu item Tools > Retrieve Logs:
Fig. 3.6: Menu item Tools > Retrieve Logs
2. Select the desired subsystem (e.g. UPC) and the number of log files to retrieve, then click OK.
Fig. 3.7: Specify logs to retrieve
3. Specify the location to save the retrieved log files, then click Open.
Fig. 3.8: Specify save location
Chapter 3. Tampers17
G7OPT Integrator Manual, DWI-00175 S1 R15
4. The Task list will display “Get Logs Finished” when operation is complete and the log files have
been saved to the specified location.
Fig. 3.9: Task list: “Get Logs Finished”
5. Select menu item Tools > Export Parameters:
Fig. 3.10: Menu item Tools > Export Parameters
6. Specify the location to save the exported parameter file, then click Save.
Fig. 3.11: Specify save location
7. The exported parameters will be saved in the specified location as a comma-separated-value
(CSV) file.
Chapter 3. Tampers18
Loading...
+ 46 hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.