Thoughts on Heartland's end to end encryption

During January of this year Heartland Payment Systems announced a major security breach on their systems. An estimated hundred million card-numbers may have been compromised in this attack based on malicious code installed on Heartland's systems. This made a dent in the trust that ordinary consumers have of payment systems. Heartland must be congratulated that they announced the event and took immediate actions to rectify. (I am sure other events like these in other companies don't always reach the media).

Recently, Heartland CEO, Robert Carr indicated that the company is working towards the implementation of "end to end encryption". This move would enable security in Heartland's systems that are more secure than what existing standards (like EMV and PCI DSS) ensure. This is once again moves in the right direction. (One should ask the question why a major breach should first happen before the right actions are taken, but this is a topic for another time).

What is of more interest to me, is the implication of this to mobile payments. It is possible to (if done correctly) implement "end-to-end encryption" with mobile payments. This should be a major consideration for all mobile banking deployments as the cost of retrofitting this can be exuberant. The distribution of keys and the encryption algorithms all should be considered carefully as it will not only have an impact on security, but also performance and cost.

It is also important to think about all the potential attacks that mobile banking deployments should defend against. The most difficult one I believe, is to design for the path running trough the mobile operator infrastructure. It is here that the payment transaction can most easily be intercepted. It seems almost impossible to design secure mobile payment solutions without some collaboration with Mobile Operators.