Crypto technologies for banking and digital payments

Cash will be numbered. With the advent of COVID-19, the growth of digital payment transactions has accelerated, with a particular focus on contactless, online and instant payments. Accenture’s global study shows that contactless payments have grown by 150% since March 2019. Nearly 2.7 trillion transactions, worth $48 billion, are expected to shift from cash to cards and digital payments over the next decade. In addition, e-wallets, credit and debit cards are expected to account for 84.5% of global e-commerce spending by 2024. The pace of growth and transformation of new technologies in this sector, partly influenced by the pandemic, is strongly driving this phenomenon.

According to the report, what is really changing is the way technology is being integrated and the speed at which this is happening. This is because when it comes to payments, consumers want them to be simple, fast and integrated into their usual platforms. We are therefore approaching near-instant innovation, with fintechs quickly finding pain points and building products to exploit them. In this context, innovation through Open Banking APIs plays a key role in enabling third parties to create fast, easy and convenient payment systems for consumers.

Value chain transformation

Traditionally, banks owned the entire value chain when it came to creating, packaging and distributing their products in a monolithic, linear and vertically integrated model. According to another Accenture study, this model is transforming to adapt to the new reality. The value chain is fragmenting to be shared among new players offering better services and products. This is happening because they are more specialised and focused on the customer and their current needs. This new decentralised, non-linear and adaptive model demands new technologies. These must allow new financial services to be built and managed in an agile and efficient way. They must also comply with current regulations (PSD2, PCI-DSS, ISO 20022, etc.). In this respect, payment HSM devices with the appropriate certifications are key to protecting digital transactions. The result is that consumers have confidence in the payment platforms they use.

However, the financial ecosystem technology transformation implies a major change. From monolithic systems with centralised HSMs for the management of keys and financial cryptographic operations, it is moving towards distributed, service-oriented systems. Several HSMs for different uses, even from different brands, can coexist in these systems. Currently, two manufacturers cover the vast majority of the financial HSM market: Thales payShield and Utimaco Atalla. Both comply with all regulations and standards of the payment industry. However, their complex, low-level operational interfaces differ significantly. This makes migration, integration and interoperability difficult, especially in hybrid environments.

An innovative solution

For this reason, we are working on an innovative solution to simplify the way in which these HSMs can be integrated. We are also doing so with the business logic of the financial institutions that use them, which are currently undergoing a digital transformation process. This transformation involves migrating keys from monolithic to distributed systems. Also, an efficient, agile and flexible management of HSM clusters that are necessary to cover the new financial services and applications. SafeGate by Gradiant was created to meet these needs. It allows high-level integration (via REST API) of HSMs. This reduces costs and time in their implementation and maintenance.

SafeGate middleware currently supports commands from Thales payShield 10K and Utimaco Atalla AT1000 HSMs. Also, functionalities to facilitate key migration through the TR31 standard, an interface is available that demonstrates these features by making use of the REST API.

As a member of EGIDA, the first national network of security and privacy technologies formed by technology centres of excellence, we develop innovative solutions around hardware-based cryptographic devices or HSMs used in digital financial transactions in a context of growing demand where the pandemic has been a key catalyst.

EGIDA materialises as the first and only national network of security and privacy technologies formed by technology centres of excellence Gradiant (leader), Fidesol, Ikerlan and Vicomtech. This alliance allows us to develop innovative solutions around hardware-based cryptographic devices or HSMs used in digital financial transactions in a context of growing demand where the pandemic has been a key catalyst.

EGIDA arises within the framework of the Cervera Programme for Technology Centres, the national commitment to develop market-oriented research promoted by the Ministry of Science and Innovation and the Centre for the Development of Industrial Technology (CDTI).

Author: Jaime Loureiro-Acuña, Head of Secure Information Processing at Security & Privacy Department in Gradiant