Blog | G5 Cyber Security

Smart Ticketing & EMV on Buses

G5 Cyber Security

TL;DR

This guide explains how to add contactless payments (EMV) and smart ticketing to bus systems, covering hardware, software, security, and testing. It’s aimed at operators looking to modernise their fare collection.

1. Understanding the Technologies

2. Hardware Requirements

  1. Ticket Machines (TVMs): Upgrade existing machines or install new ones with chip card readers, contactless payment terminals (NFC), and PIN pads.
  2. On-Bus Validators: Install validators that accept EMV contactless cards, smart cards, and potentially QR codes from mobile apps. These need to be ruggedised for the bus environment.
  3. Communication System: A reliable communication link (4G/5G or Wi-Fi) is essential for real-time transaction processing and data transfer.

3. Software Components

  1. Back Office System: This manages all ticketing data, fare rules, reporting, and reconciliation. It needs to integrate with payment processors.
  2. Validator Software: Controls the on-bus validators, handles card reading, ticket validation, and communication with the back office.
  3. Mobile App (Optional): If offering mobile ticketing, you’ll need an app for iOS and Android that allows users to purchase and store tickets.
  4. Payment Gateway Integration: Connect your back-office system to a payment gateway to process EMV transactions securely.

4. Security Considerations

  1. PCI DSS Compliance: If handling card data directly, you *must* comply with the Payment Card Industry Data Security Standard (PCI DSS). This is complex and expensive. Using a certified payment provider reduces this burden.
  2. Data Encryption: All communication between validators, ticket machines, and the back office must be encrypted using TLS/SSL.
  3. Key Management: Securely manage encryption keys used for EMV transactions.
  4. Physical Security: Protect hardware from tampering and theft.
  5. cyber security Assessments: Regular penetration testing and vulnerability scans are crucial to identify and address potential weaknesses.

5. Implementing cEMV

  1. Card Scheme Certification: You’ll need to be certified by the card schemes (Visa, Mastercard) to use cEMV. This involves testing your system against their requirements.
  2. Offline Processing: cEMV allows for offline ticket validation when a network connection is unavailable. Configure appropriate fallback mechanisms and transaction limits.
  3. Tokenisation: Consider using tokenisation to replace sensitive card data with unique tokens, further enhancing security.

6. Testing & Deployment

  1. End-to-End Testing: Thoroughly test the entire system, including ticket purchase, validation, refund processing, and reporting.
  2. Pilot Scheme: Start with a small pilot scheme on a limited number of buses to identify any issues before full deployment.
  3. User Training: Provide training for bus drivers and staff on how to use the new system.
  4. Monitoring & Maintenance: Continuously monitor system performance and provide ongoing maintenance and support.

7. Example Code Snippet (Validator Communication)

This is a simplified example of how a validator might communicate with the back office to validate a ticket.

import requests

url = 'https://your-backoffice-api.com/validate_ticket'
data = {
    'ticket_id': '1234567890',
    'bus_id': 'BusA123',
    'timestamp': '2024-01-27T10:00:00Z'
}

response = requests.post(url, json=data)

if response.status_code == 200:
    validation_result = response.json()
    print('Ticket validation result:', validation_result)
else:
    print('Error validating ticket:', response.status_code, response.text)

8. Choosing a Vendor

Exit mobile version