Idtech Securehead User manual

USER MANUAL

SecureHead™

Encrypted Magnetic Read Head

USB and UART Interface

80101505-001-K

19 November 2020

Page 2 of 76

User Manual, SecureHead USB and UARTInterface

Agency Approved

Specifications for subpart B of part 15 of FCC rule for a Class A computing device.

Limited Warranty

ID TECH warrants to the original purchaser for a period of 12 months from the date of invoice that this

product is in good working order and free from defects in material and workmanship under normal use

and service. ID TECH’s obligation under this warranty is limited to, at its option, replacing, repairing,

or giving credit for any product which has, within the warranty period, been returned to the factory of

origin, transportation charges and insurance prepaid, and which is, after examination, disclosed to ID

TECH’s satisfaction to be thus defective. The expense of removal and reinstallation of any item or

items of equipment is not included in this warranty. No person, firm, or corporation is authorized to

assume for ID TECH any other liabilities in connection with the sales of any product. In no event shall

ID TECH be liable for any special, incidental or consequential damages to Purchaser or any third party

caused by any defective item of equipment, whether that defect is warranted against or not. Purchaser’s

sole and exclusive remedy for defective equipment, which does not conform to the requirements of

sales, is to have such equipment replaced or repaired by ID TECH. For limited warranty service during

the warranty period, please contact ID TECH to obtain a Return Material Authorization (RMA)

number & instructions for returning the product.

THIS WARRANTY IS IN LIEU OF ALL OTHER WARRANTIES OF MERCHANTABILITY OR

FITNESS FOR PARTICULAR PURPOSE. THERE ARE NO OTHER WARRANTIES OR

GUARANTEES, EXPRESS OR IMPLIED, OTHER THAN THOSE HEREIN STATED. THIS

PRODUCTIS SOLD AS IS. IN NO EVENT SHALL ID TECH BE LIABLE FOR CLAIMS BASED

UPON BREACH OF EXPRESS OR IMPLIED WARRANTY OF NEGLIGENCE OF ANY OTHER

DAMAGES WHETHER DIRECT, IMMEDIATE, FORESEEABLE, CONSEQUENTIALOR

SPECIAL OR FOR ANY EXPENSE INCURREDBY REASON OF THE USE OR MISUSE, SALE

OR FABRICATIONS OF PRODUCTS WHICH DO NOT CONFORM TO THE TERMS AND

CONDITIONS OF THE CONTRACT.

provided to the user as a convenience. While every effort has been made to ensure accuracy, ID TECH

is not responsible for damages that might occur because of errors or omissions, including any loss of

profit or other commercial damage. The specifications described herein were current at the time of

publication, but are subject to change at any time without prior notice.

ID TECH is a registered trademark of International Technologies & Systems Corporation. SecureHead

and Value through Innovation are trademarks of International Technologies & Systems Corporation.

Page 3 of 76

User Manual, SecureHead USB and UARTInterface

Revision History

Revision

Date

Description of Changes

10/20/2010

Initial Draft

Jenny W

10/25/2010

Revised read status command

Added decryption examples

Jenny W

11/12/2010

Added UART interface cable pinout

Jenny W

05/09/2011

-Added SecureHead mounting option with drawing

to indicate track 1 location

-Edited original and enhanced encryption output

format

-Changed device serial number length from 8 byte

to 10 byte

Jenny W

06/21/2011

Added design guidelines for head installation

Jenny W

09/20/2011

- Updated USB interface Cable Pin Out

- Updated power information

Yvonne Y

03/23/2012

-Added design guidelines on preloading the spring

-Added cable length tolerance

Jenny W

02/04/2013

Added the new mask feature in SecureHead

firmware v5.00 for UART interface and v 5.03 for

USB interface

Candy H

06/05/2013

Update appendix I magnetic heads mechanical

design guidelines

Remove key loading command

Candy H

7/13/2015

Included bit to indicate status flag of service code if

ICC is present. Section 4.5.4 Note 3

Example data: Appendix J

Jason H

8/31/2015

Remove former section 3.12 Encrypt External Data

Command

Jason H

10/11/2016

Section 2: Update USB voltage to 7ma

Jason H

11/19/2020

Revised Appendix K

Page 4 of 76

User Manual, SecureHead USB and UARTInterface

Table of Contents

1. INTRODUCTION........................................................................................................................ 5

2. SPECIFICATIONS ..................................................................................................................... 6

3. CONFIGURATION ...................................................................................................................10

3.1. Setup Commands Structure ............................................................................................10

3.2. Communication Timing ..................................................................................................11

3.3. Default Settings ..............................................................................................................11

3.4. General Selections ..........................................................................................................11

3.5. Review Settings ..............................................................................................................12

3.6. Review Serial Number....................................................................................................13

3.7. Message Formatting Selections(Only for Security Level 1 & 2) ...................................13

3.8. Magnetic Track Selections .............................................................................................14

3.9. Security Settings.............................................................................................................15

3.10. Review KSN (DUKPT Key management only).............................................................17

3.11. Review Security Level....................................................................................................17

3.12. Encrypted Output for Decoded Data ..............................................................................17

4. Data Format ..............................................................................................................................22

4.1. Level 1 and level 2 Standard Mode Data Output Format...............................................22

4.2. Level 1 and level 2 POS Mode Data Output Format......................................................28

4.3. DUKPT Key Management Level 3 Data Output Format ...............................................31

4.4. Fixed Key Management Encrypted Output Format........................................................32

4.5. DUKPT Enhanced Level 3 Data Output Format............................................................32

4.6. Fix Key Management Enhanced Output Data Format ...................................................35

4.7. DUKPT Level 4 Data Output Format.............................................................................35

4.8. Level 4 Activate Authentication Sequence.....................................................................37

4.9. Other Command Protocol Settings .................................................................................41

Appendix A Setting Parameters and Values...............................................................................43

Appendix B Key Code Table in USB Keyboard Interface .........................................................48

Appendix C Default Setting Table .................................................................................................55

Appendix D Magnetic Stripe Standard Formats..........................................................................56

Appendix E Other Mode Card Data Output................................................................................59

Appendix F Guide to Encrypting and Decrypting Data.............................................................60

Appendix G Key Management Flow Chart...............................................................................61

Appendix H Example of Decoded Data Decryption...................................................................63

Appendix I Example of IDTECH Raw Data Decryption .........................................................70

Appendix J Example of Data with ICC Status Flag ..................................................................72

Appendix K Installation and Use Guide for Magnetic Heads........................................................73

Page 5 of 76

User Manual, SecureHead USB and UART Interface

1. INTRODUCTION

ID TECH SecureHead reader delivers superior reading performance with the ability to encrypt

sensitive card data. The data encryption process prevents card holder information from being accessed

when the data is stored or in transit, so the data remains secure from end to end. The reader fully

supports TDES and AES data encryption using DUKPT key management method. The SecureHead

supports SPI, UART and USB interface. The information about SPI SecureHead can be found in a

separate document, 80101502-001 SecureHead SPI user manual.

Page 6 of 76

User Manual, SecureHead USB and UART Interface

2. SPECIFICATIONS

General

Card Speed 3 to 75 ips (7.6 to 190.5 cm/s)

Electrical

•UART

Power 3.0 to 3.6 VDC

I/O Voltage Range 2.7 to 3.6 VDC

Current

Active Power Supply Current 5 mA

Standby Power supply Current 2 mA

•USB

Power 5.0 VDC +/- 10%

I/O Voltage Range 2.7 to 3.6 VDC

Current

Active Power Supply Current 7 mA

Standby Power supply Current 5 mA

ESD +4kV discharge to head can

Communication interface

•UART

oBaud Rate – 9,600 bits/second as default

oData bits – 8

oStop bits – 1

oParity – None

oSupports Xon-Xoff software handshaking

•USB

oComplies with USB 2.0 specification

Environment

Operating Temperature -40 °C to 70 °C

Storage Temperature -40 °C to 70 °C

Humidity -10% to 90% non-condensing

Mechanical

Weight 5.67 grams

Page 7 of 76

User Manual, SecureHead USB and UART Interface

Interface cable and connector

•USB

oCable connector: Molex 51021-0500 or equivalent

oStandard cable length is 125mm +/- 6.4mm

oPin Out Table

Color

Signal

Red

VBUS

White

-DATA

Green

+DATA

Black

GND

Violet

HEAD_CASE

•UART

oCable connector: Molex 51021-0500 or equivalent

oStandard cable length is 125mm +/- 6.4mm

oPin Out Table

Color

Signal

Violet

HEAD_CASE

White

Yellow

Red

Black

GND

Page 8 of 76

User Manual, SecureHead USB and UART Interface

Dimension:

Mounting Options:

1. Wing spring mounting: this is the standard mounting option and can be used on most

swipe readers. The protrusion of the head for the surface of the spring is 3.50 mm.

Page 9 of 76

User Manual, SecureHead USB and UART Interface

2. Head assembly only: This option is provided for special applications.

The mechanical interface is an eight pin male Molex Connector 51021-0800 for option 1 and 2.

Page 10 of 76

User Manual, SecureHead USB and UART Interface

3. CONFIGURATION

The SecureHead reader must be appropriately configured to your application. Configuration settings

enable the reader to work with the host system. Once programmed, these configuration settings are

stored in the reader’s non-volatile memory (so they are not affected by the cycling of power).

3.1. Setup Commands Structure

Commands sent to SecureHead

a. Setting Command:

b. Read Status Command:

c. Function Command:

Response from SecureHead

a. Setting Command

Host

SecureHead

Setting Command





<ACK> if OK



<NAK> if Error

b. Read Status Command

Host

SecureHead

Read Status Command





<ACK> and <Response> if



<NAK> if Error

c. Other Command

Host

SecureHead

Other Command





<ACK> and <Response> if



<NAK> if Error

Page 11 of 76

User Manual, SecureHead USB and UART Interface

Where:

<STX>

02h

<S>

Indicates setting commands. 53h

<R>

Indicates read status commands. 52h

One byte Function ID identifies the

particular function or settings affected.

<Len>

One byte length count for the following data

block<FuncData>

data block for the function

<ETX>

03h

Check Sum: The overall Modulo 2

(Exclusive OR) sum (from <STX> to

<CheckSum>) should be zero.

<ACK>

06h

<NAK>

15h

3.2.Communication Timing

The SecureHead takes time to process a command. During that processing time, it will not respond to a

new command.

The typical delay for the reader to respond to a command is 20ms, the maximum delay for the reader to

respond can be as much as 40ms. Caution must therefore be taken to maintain a minimum delay

between two commands.

3.3.Default Settings

The SecureHead reader is shipped from the factory with the default settings already programmed. In

the following sections, the default settings are shown in boldface.

For a table of default settings, see Appendix A.

3.4.General Selections

This group of configuration settings defines the basic operating parameters of SecureHead.

3.4.1. Change to Default Settings

This command does not have any <FuncData>. It returns all settings for all groups to their default

values.

3.4.2. MSR Reading Settings

Enable or Disable the SecureHead. If the reader is disabled, no data will be sent out to the host.

Page 12 of 76

User Manual, SecureHead USB and UART Interface

<STX><S><1Ah><01h><MSR Reading

Settings><ETX><CheckSum>

MSR Reading Settings:

“0” MSR Reading Disabled

“1” MSR Reading Enabled

3.4.3. Decoding Method Settings

The SecureHead can support four kinds of decoded directions.

<STX><S><1Dh><01h><Decoding Method

Settings><ETX><CheckSum>

Decoding Method Settings:

“0” Raw Data Decoding in Both Directions, send out in ID TECH mode

“1” Decoding in Both Directions. If the encryption feature is enabled, the key management

method used is DUKPT.

“2” Moving stripe along head in direction of encoding. If the encryption feature is enabled, the key

management method used is DUKPT.

“3” Moving stripe along head against direction of encoding. If the encryption feature is enabled, the

key management method used is DUKPT.

“4” Raw Data Decoding in Both Directions, send out in other mode. If the encryption feature is

enabled, the key management method used is fixed key.

With the bi-directional method, the user can swipe the card in either direction and still read the data

encoded on the magnetic stripe. Otherwise, the card can only be swiped in one specified direction to

read the card. Raw Decoding just sends the card’s magnetic data in groups of 4 bits per character. The

head reads from the first byte of each track, starting from the most significant bit. The data starts to being

collected when the first 1 bit is detected. No checking is done except to verify track has or does not have

magnetic data.

3.5.Review Settings

This command does not have any <FuncData>. It activates the review settings command. SecureHead

sends back an <ACK> and <Response>.

<Response> format:

The current setting data block is a collection of many function-setting blocks <FuncSETBLOCK> as

follows:

Each function-setting block <FuncSETBLOCK> has the following format:

Where:

<FuncID> is one byte identifying the setting(s) for the function.

<Len> is a one byte length count for the following function-setting block <FuncData>

Page 13 of 76

User Manual, SecureHead USB and UART Interface

<FuncData> is the current setting for this function. It has the same format as in the sending command

for this function.

<FuncSETBLOCK> are in the order of their Function ID<FuncID>

3.6.Review Serial Number

This command is to get device serial number.

3.7.Message Formatting Selections(Only for Security Level 1 & 2)

3.7.1. Terminator Setting

Terminator characters are used to end a string of data in some applications.

<Terminator Settings>: Any one character, 00h is none; default is CR (0Dh).

3.7.2. Preamble Setting

Characters can be added to the beginning of a string of data. These can be special characters for

identifying a specific reading station, to format a message header expected by the receiving host, or

any other character string. Up to fifteen ASCII characters can be defined.

Where:

<Len>= the number of bytes of preamble string

<Preamble> = {string length}{string}

NOTE: String length is one byte, maximum fifteen <0Fh>.

3.7.3. Postamble Setting

The postamble serves the same purpose as the preamble, except it is added to the end of the data string,

after any terminator characters.

Where:

<Len> = the number of bytes of postamble string

<Postamble> = {string length}{string}

NOTE: String length is one byte, maximum fifteen <0Fh>.

Page 14 of 76

User Manual, SecureHead USB and UART Interface

3.7.4. Track n Prefix Setting

Characters can be added to the beginning of a track data. These can be special characters to identify the

specific track to the receiving host, or any other character string. Up to six ASCII characters can be

defined.

Where:

<n> = 34h for track 1; 35h for track 2 and 36h for track 3

<Len> = the number of bytes of prefix string

<Prefix> = {string length}{string}

NOTE: String length is one byte, maximum six.

3.7.5. Track n Suffix Setting

Characters can be added to the end of track data. These can be special characters to identify the

specific track to the receiving host, or any other character string. Up to six ASCII characters can be

defined.

Where:

<n> = 37h for track 1; 38h for track 2 and 39h for track 3

<Len> = the number of bytes of suffix string

<Suffix> = {string length}{string}

NOTE: String length is one byte, maximum six.

3.8.Magnetic Track Selections

3.8.1. Track Selection

There are up to three tracks of encoded data on a magnetic stripe.

This option selects the tracks that will be read and decoded.

Track_Selection Settings:

“0” Any Track

“1” Require Track 1 Only

“2” Require Track 2 Only

“3” Require Track 1 & Track 2

“4” Require Track 3 Only

“5” Require Track 1 & Track 3

Page 15 of 76

User Manual, SecureHead USB and UART Interface

“6” Require Track 2 & Track 3

“7” Require All Three Tracks

“8” Any Track 1 & 2

“9” Any Track 2 & 3

Note: If any of the required multiple tracks fail to read for any reason, no data for any track will be

sent.

3.8.2. Track Separator Selection

This option allows the user to select the character to be used to separate data decoded by a multiple-

track reader.

<Track_Separator> is one ASCII Character. The default value is CR, 0h means no track separator.

3.8.3. Start/End Sentinel and Track 2 Account Number Only

The SecureHead can be set to either send, or not send, the Start/End sentinel, and to send either the

Track 2 account number only, or all the encoded data on Track 2. (The Track 2 account number setting

doesn’t affect the output of Track 1 and Track 3.)

SendOption:

“0” Don’t send start/end sentinel and send all data on Track 2

“1” Send start/end sentinel and send all data on Track 2

“2” Don’t send start/end sentinel and send account # on Track 2

“3” Send start/end sentinel and send account number on Track 2

3.9.Security Settings

3.9.1. Select Key Management Type

Key Management Type:

“0” Fix key management

“1” DUKPT Key management

3.9.2. External Authenticate Command (Fixed Key Only)

Before a security related command is executed, an authentication process is required to make sure the

device key used is correct. For example, authentication is needed whenever the encryption is enabled/

Page 16 of 76

User Manual, SecureHead USB and UART Interface

disabled or the device key is changed. Once the authentication process is finished successfully, the

same process would not be needed again until the device is restarted.

•First, the host would get a data block which is generated by encrypting a random 8-byte data

using TDES algorithm.

•The host then decrypts the data block using TDES algorithm using the current device key.

•The host initiates an External Authenticate Command to verify the decrypted 8 bytes of random

data

•The d evice checks to see if the data matches the random data generated. If the data are the

same, authentication process is successful. If it fails, the host must start the authentication

process again until it’s succeed, before any security related featured can be changed.

Commands:

1) Retrieve Encrypted Challenge Command

Host -> Device:

Device -> Host:

<ACK><STX><8 bytes of TDES-encrypted random data><ETX><CheckSum> (success)

<NAK> (fail)

2) Send External Authenticate Command

Host -> Device:

Device -> Host:

<ACK> (success)

<NAK> (fail)

3.9.3. Encryption Settings

Enable or disable the SecureHead Encryption output in ID TECH protocol. If encryption is disabled,

original data will be sent out to the host. If it enabled, encrypted data will be send out to the host.

Encryption Settings:

“0” Encryption Disabled

“1” Enable TDES Encryption

“2” Enable AES Encryption (Not for Raw Data Decoding in Both Directions, send out in other

mode.)

Page 17 of 76

User Manual, SecureHead USB and UART Interface

3.10. Review KSN (DUKPT Key management only)

This command is to get DUKPT key serial number and counter.

3.11. Review Security Level

This command is to get the current security level.

3.12. Encrypted Output for Decoded Data

3.12.1.Encrypt Functions

When a card is swiped through the Reader, the track data will be TDEA (Triple Data

Encryption Algorithm, aka, Triple DES) or AES (Advanced Encryption Standard)

encrypted using Fixed key management or DUKPT (Derived Unique Key Per Transaction)

key management. DUKPT key management uses a base derivation key to encrypt a key

serial number that produces an initial encryption key which is injected into the Reader prior

to deployment. After each transaction, the encryption key is modified per the DUKPT

algorithm so that each transaction uses a unique key. Thus, the data will be encrypted with a

different encryption key for each transaction.

3.12.2.Security Related Function ID

Security Related Function IDs are listed below. Their functions are described in other

sections.

Characters

Hex Value

Description

PrePANID

First N Digits in PAN which can be

clear data

PostPANID

Last M Digits in PAN which can be

clear data

MaskCharID

Character used to mask PAN

EncryptionID

Security Algorithm

SecurityLevelID

Security Level (Read Only)

Device Serial Number ID

Device Serial Number (Can be write

once. After that, can only be read)

DisplayExpirationDataID

Display expiration data as mask

data or clear data

KSN and Counter ID

Review the Key Serial Number and

Page 18 of 76

User Manual, SecureHead USB and UART Interface

Encryption Counter

Session ID

Set current Session ID

Key Management Type

Select Key Management Type

Feasible settings of these new functions are listed below.

Characters

Default Setting

Description

PrePANID

04h

00h ~ 06h

Allowed clear text from start of

PAN

Command format:

02 53 49 01 04 03 LRC

PostPANID

04h

00h ~ 04h

Allowed clear text from end of PAN

Command format:

02 53 4A 01 04 03 LRC

MaskCharID

‘*’

20h ~ 7Eh

Command format:

02 53 4B 01 3A 03 LRC

DisplayExpirationDataID

‘0’

‘0’ Display expiration data as mask

data

‘1’ Display expiration data as clear

data

EncryptionID

‘0’

‘0’ Clear Text

‘1’ Triple DES

‘2’ AES

Command format:

02 53 4C 01 31 03 LRC

SecurityLevelID

‘1’

‘0’ ~ ‘3’

Command format:

02 52 7E 03 LRC

Device Serial Number ID

00, 00, 00, 00, 00,

00, 00, 00, 00, 00

10 bytes number:

Command format:

Set Serial Number:

02 53 01 4E 09 08 37 36 35 34 33

32 31 30 03 LRC

Get Serial Number:

02 52 4E 03 LRC

KSN and Counter ID

00, 00, 00, 00, 00,

00, 00, 00, 00, 00

This field includes the Initial Key

Serial Number in the leftmost 59

bits and a value for the Encryption

Counter in the right most 21 bits.

Get DUKPTKSN and Counter:

02 52 51 03 LRC

Page 19 of 76

User Manual, SecureHead USB and UART Interface

Session ID

00, 00, 00, 00, 00,

00, 00, 00

This Session ID is an eight bytes

string which contains any hex data.

This filed is used by the host to

uniquely identify the present

transaction. Its primary purpose is to

prevent replays. It is only be used at

Security Level 4. After a card is read,

the Session ID will be encrypted,

along with the card data, a supplied as

part of the transaction message. The

clear text version of this will never be

transmitted.

New Session ID stays in effect until

one of the following ocurrs:

1. Another Set Session ID command

is received.

2. The reader is powered down.

3. The reader is put into Suspend

mode.

Key Management Type

‘1’

Fixed key management by default.

‘0’: Fixed Key

‘1’: DUKPT Key

3.12.3.Security Management

This reader is intended to be a secure reader. Security features include:

•Can include Device Serial Number

•Can encrypt track 1 and track 2 data for all bank cards

•Provides clear text confirmation data including card holder’s name and a portion of

the PAN as part of the Masked Track Data

•Optional display expiration data

•Security Level is settable

The reader features configurable security settings. Before encryption can be enabled, Key

Serial Number (KSN) and Base Derivation Key (BDK) must be loaded before encrypted

transactions can take place. The keys are to be injected by certified key injection facility.

There are five security levels available when using the DUKPT key management:

•Level 0

Security Level 0 is a special case where all DUKPT keys have been used and is set

automatically when it runs out of DUKPT keys. The lifetime of DUKPT keys is 1

million. Once the key’s end of life time is reached, user should inject DUKPT keys

again before doing any more transactions.

Page 20 of 76

User Manual, SecureHead USB and UART Interface

•Level 1

By default, readers from the factory are configured to have this security level. There is

no encryption process, no key serial number transmitted with decoded data. The reader

functions as a non-encrypting reader and the decoded track data is sent out in default

mode.

•Level 2

Key Serial Number and Base Derivation Key have been injected but the encryption

process is not yet activated. The reader will send out decoded track data in default

format. Setting the encryption type to TDES and AES will change the reader to security

level 3.

•Level 3

Both Key Serial Number and Base Derivation Keys are injected and encryption mode is

turned on. For payment cards, both encrypted data and masked clear text data are sent

out. Users can select the data masking of the PAN area; the encrypted data format

cannot be modified. Users can choose whether to send hashed data and whether to

reveal the card expiration date. When the encryption is turned on, level 3 is the default

security level.

•Level 4

When the reader is at Security Level 4, a correctly executed Authentication Sequence is

required before the reader sends out data for each card swipe.

3.12.4.Encryption Management

The Encrypted swipe read supports TDES and AES encryption standards for data encryption.

Encryption can be turned on via a command. TDES is the default.

If the reader is in security level 3, for the encrypted fields, the original data is encrypted using

the TDES/AES CBC mode with an Initialization Vector starting at all binary zeroes and the

Encryption Key associated with the current DUKPT KSN.

3.12.5.Check Card Format

•ISO/ABA (American Banking Association) Card

Encoding method

Track1 is 7 bits encoding.

Track1 is 7 bits encoding. Track2 is 5 bits encoding. Track3 is 5 bits encoding.

Track1 is 7 bits encoding. Track2 is 5 bits encoding.

Track2 is 5 bits encoding.

Additional check

Other manuals for SecureHead

Table of contents

IDTECH SecureHead User manual

Popular Card Reader manuals by other brands