User's Manual

FILE AUTHENTICATION
Introduction to File Authentication
86 VX 675 REFERENCE GUIDE
A development set of higher-level certificates is downloaded into each
VX 680 terminal upon manufacture. When you take a new VX 680 terminal out of
its shipping carton, certificate data is already stored in the terminal’s certificate
tree. In this just-out-of-the-box condition, the VX 675 terminal is called a
development terminal.
A sponsor requests a set of digital certificates from the VeriFone CA to establish
sponsor and signer privileges. This set of certificates is then downloaded onto the
VX 680 when the device is being prepared for deployment. When this procedure
is complete, the VX 675 is called a deployment terminal.
Adding New Certificates
When you add a new certificate file to a VX 675 terminal, the file authentication
module detects it by filename extension (*.crt). On restart, the terminal then
attempts to authenticate the certificate under the authority of the resident higher-
level certificate stored in the terminal’s certificate tree or one being downloaded
with the new certificate.
In a batch download containing multiple certificates, each lower-level certificate
must be authenticated under an already-authenticated, higher-level certificate.
Whether or not the data a new certificate contains is added to the terminal’s
certificate tree depends on whether it is successfully authenticated. The following
points explain how certificates are processed:
• If a new certificate is successfully authenticated, the information it contains is
automatically stored in the terminal’s certificate tree. The corresponding
certificate file (*.crt) is then deleted from that file group’s memory.
• If the relationship between the new certificate and an existing higher-level
certificate cannot be verified, the authentication procedure for the new
certificate fails. In this case, the certificate information is not added to the
certificate tree and the failed certificate file (usually ~400 bytes) is retained in
the application memory.
Development Terminals
A development terminal is a VX 675 with a Sponsor and Signer certificate issued
to someone who intends to use the terminal for application development. An
application developer must apply for a Sponsor/Signer certificate to allow loading
an application. See Figure 27.
In the development device, the level of logical security provided by the file
authentication module is the same as a deployment application.
NOTE
With the factory set of certificates stored in the terminal memory, anyone who
has the VX 675 SDK and VeriShield File Signing Tool can generate valid
signature files for downloading and authenticating files on the VX 675 platform.