Barnes P3
A turnkey solution for issuance data preparation. You can bring everything from EMV issuance data generation to personalisation in house while keeping full control of your cryptographic keys. It is developed and maintained by the affiliated company Barnes Smart Solutions and used by resellers, banks, issuers, manufacturers and bureaux worldwide.
The testing problems this solves
Barnes P3 prepares everything from EMV issuance data generation through to the personalisation input files. The data preparation stage can be brought in house with the cryptographic keys remaining under your control.
Scope
Covers data preparation through to instant issuance, with the keys remaining under your control.
| Aspect | Coverage |
|---|---|
| Process stage covered | EMV issuance data generation and output of personalisation input files |
| Key management | Full in-house control of cryptographic keys, communicating with the HSM over TLS and using TR-31 key blocks |
| Input | Existing magnetic stripe and embossing files |
| Output | Personalisation data for MULTOS, GlobalPlatform and bespoke single- or multi-application cards |
| Issuance models | Batch issuance, instant issuance and on-demand reissuance |
| Configuration | Either end-to-end issuance in house, or data preparation in house with card production at an external bureau |
| Interface | Contact (ISO/IEC 7816) and magnetic stripe |
Supported terminals and environments
Intended for the data preparation stage. The key management approach and output formats are confirmed at quotation.
Main features
| Keys stay with you | Cryptographic keys are controlled entirely in house, with secure TLS communication to the hardware security module |
|---|---|
| Key block support | Under PCI PIN Security Requirements 18-3, encrypted symmetric keys are held in key block form using TR-31, with AES encryption and CMAC, protecting the confidentiality and integrity of both the key and its metadata |
| Input and output | Generates keys and EMV parameters from existing magnetic stripe and embossing files. The input and EMV-enriched output file formats are easy to configure, and the output is flexible enough for MULTOS, GlobalPlatform and bespoke single- or multi-application cards |
| Issuance models | Supports instant issuance and on-demand reissuance. RSA key generation with caching maintains the same service levels after moving from SDA to DDA cards |
| Two arrangements | Either end to end in house, covering batch and instant issuance, or data preparation in house with card production and personalisation at an external bureau. In both cases the issuer retains the master keys |
Applications supported
| International schemes | Amex (AEIPS / ExpressPay) /Discover (D-PAS / ZIP) /JCB (J/Smart / J/Speedy) /Mastercard (M/Chip Lite / 2 Select / 4 / Flex / Advance / PayPass) /Visa (VSDC “SDA/DDA” / qVSDC / MSD / VMPA / payWave) /UnionPay (PBOC) |
|---|---|
| Regional and common | SAMA mada (Saudi Arabia) and CPA |
| EMV certified applications | Mastercard CAP (Chip Authentication Program) /Visa DPA (Dynamic Passcode Authentication) |
Operating environment
| Operating systems | Windows Server 2022 / 2019 / 2016 Standard/2012 R2 x64 Standard/Windows 11 Pro/Windows 10 Pro x64 (21H2) |
|---|---|
| Minimum hardware | 1 GHz CPU, 256 MB RAM, 20 GB disk, 10–1000 Mbit/s Ethernet, 1024×768 display |
Instant issuance configuration
A configuration that issues EMV cards on the spot in a branch or store. P3 handles secure data preparation and the card printer performs the personalisation.
| Element | Role |
|---|---|
| P3 | Securely manages and generates cryptographic keys and EMV data |
| Card printer | Writes the name, number and secure chip data to the card |
| MULTOS card | An EMV card platform certified to CC EAL6+ High, with the virtual machine at EAL7. ALU loading allows it to be loaded even in an insecure environment |
| What it achieves | Detail |
|---|---|
| Immediate delivery | Cards are issued in minutes, removing the wait |
| Simpler logistics | Reduces postage costs and delivery arrangements |
| Higher activation | Cards work as soon as they are handed over, which raises activation rates |
Barnes Smart Solutions has been a member of the MULTOS Consortium since 2018.MULTOS has been used in secure smart cards for 25 years, with more than 2.5 billion cards shipped. It also works with existing card management systems and personalisation equipment.
Where it is used
- Setting up card issuance and QC verification for a new development
- Regression after a configuration change or update
- Coverage checks ahead of certification
Relationship to certification
This is a data preparation product; it is not intended for testing or for obtaining certification. On the card side you can use MULTOS (Common Criteria EAL6+ High, with the virtual machine at EAL7). If scheme approval is required, we can introduce an accredited test laboratory; the approval itself is issued by EMVCo or the payment scheme.