Success Stories

Arroweye Saves 75% and Expedites Entry into the Open Loop Market Using BCSS

Company says BCSS was critical factor in passing Visa® and Mastercard® audits

When Arroweye Solutions, Inc. decided to introduce a revolutionary card manufacturing process to the open loop payment card market, it faced the challenge of passing Visa security audits. Several requirements were especially daunting: key management and the ability to generate security codes (CVVs) using a host security module (HSM).

Brian Huse, Arroweye's chief information officer and vice president of research and development, led the Visa certification project. He found that the traditional path of in-house custom programming was not only expensive, but it would not allow Arroweye to get to market fast enough. After exhaustive research and assessment, Huse determined that if Arroweye implemented the Bank Card Security System (BCSS) by Prime Factors, it could meet its market strategy and bring the project in at merely 25 percent of the cost of developing the software internally.

Huse said buying BCSS was the obvious choice, especially when he discovered that Prime Factors offered the only off-the-shelf solution for the open loop market. "Not only did BCSS save us money," Huse said, "it also turned a six month, in-house development project into a six-week project."

BCSS includes a configuration program, a database and an API with more than 100 subroutines. It is the lower cost alternative to custom programming ordinarily required to implement key management, and to create security codes. BCSS is designed to work with Thales HSMs, and reduces programming necessary to facilitate use of the HSM in a secure card manufacturing environment.

"We chose BCSS because it gave us a complete product," Huse said. "Frankly, without it, we would only have the bare essentials to manage the keys and do the CVV calculations, and we would still be facing the cost of additional development down the road."

The Arroweye Assessment
Arroweye is the first company to manufacture and print the Visa® logo on-demand while simultaneously personalizing the payment card. Its unique just-in-time production process eliminates pre-manufactured card inventory, giving issuers and program managers the freedom to produce cards as needed, when needed, each with fully customized design. Arroweye's process reduces traditional card delivery cycles for national brands from weeks to days.

One of Huse's first challenges was to figure out how to incorporate an HSM into Arroweye's card manufacturing process. He quickly realized it would require significant programming to make an HSM work in Arroweye's environment . BCSS eliminated all of that programming. Its library of subroutines includes functions to process Thales HSM host commands. BCSS will also minimize the impact of Thales firmware changes in the future. For example, BCSS supports the latest Thales HSM, the payShield 9000.

The BCSS Advantage
BCSS includes subroutines that work with Thales HSMs to create a variety of security codes including the ones Huse needed - CVV1 and CVV2.

"The algorithm for calculating the CVV values can be intimidating," Huse said. "We sought to find a partner that could recreate that code and ensure 100 percent flawlessness."

While programming the algorithm to create security codes is complex, Huse said developing a key management system is even more challenging.

"We wanted to be able to produce the CVV values on the fly," Huse said. "The more we learned about the complexity of the software integration with the HSM and the key management requirements, we realized the need for a fully integrated and proven solution."

BCSS is used by the leading secure personalization bureaus world-wide. It provides complete key management and secure storage of all keys required for secure issuing and verification processes. BCSS and the Thales HSM work together to deliver key management functionality including key generation, key distribution, key loading, key storage and key usage.

"I really like the fact that BCSS does not store any of the keys in the HSM," Huse said. "They are all 'out-of-the-box' - stored in the local BCSS database, encrypted by a "Local Master Key" that is unique to the specific HSM, making them very secure. Unlike many HSM applications, this allows BCSS to operate with only one key in the HSM. This gave Arroweye a manageable process to maintain a significant number of active BIN records online as required by our variable one-off card production."

Recently, Arroweye completed the Mastercard audits, and expects to be producing Mastercard brand payment cards in Q1 2010. Huse described BCSS as a critical part of the solution for key management during the MasterCard inspection as well.

The Arroweye Implementation
By using digital imagery, Arroweye can design and produce customized debit, credit and prepaid cards from one to tens of thousands in 24 hours. In one production run, Arroweye can securely create Visa payment cards for many different financial institutions and card programs.

"BCSS allows us to print a sheet with 21 cards on it for 21 different banks and calculate 21 different CVV values for the 21 different BINs, all on the same sheet," Huse said. "We can run them all together, and calculate values on the fly as we manufacture sheets."

With help from BCSS, Arroweye brings this responsiveness to the open loop payment market.

"The standards set to receive Visa certification are thorough to say the least," Huse said. "Working with Prime Factors to implement BCSS made the certification process go much more smoothly."

FREE 30-Day Trial
Download a fully-functional version of BCSS. During your 30-day free trial, experience personalized support and advice that separates Prime Factors from the competition. More information about BCSS.