--- title: In the Age of DUKPT, It Makes Sense to Own Your Device Keys description: DUKPT key management has revolutionized online data security. But if you don’t own your device keys, any change can be costly and time-consuming. image: https://resources.worldnetpayments.com/hubfs/Blog/Owning-Your-Own-Key.jpg --- [![Worldnet Payments | Powered by Payroc](https://resources.worldnetpayments.com/hs-fs/hubfs/Logos/WNP-powered-by-PR-FINAL.png?width=598&height=150&name=WNP-powered-by-PR-FINAL.png "Worldnet Payments | Powered by Payroc")](https://www.worldnetpayments.com/) - Solutions - - - - [Unattended](https://www.worldnetpayments.com/solutions/unattended/) - Start processing self-service payments - - [In-Store](https://www.worldnetpayments.com/solutions/point-of-sale/) - Transform your card-present checkout - - - [Ecommerce](https://www.worldnetpayments.com/solutions/online/) - Start accepting online payments - - [Hardware](https://www.worldnetpayments.com/solutions/devices-processors/) - View all pre-certified POS terminals - - - [Mobile](https://www.worldnetpayments.com/solutions/mobile/) - mPOS for frictionless checkouts on the go - Developers - - - - [Mobile](https://developers.worldnetpayments.com/gochip:mobile_pos:devices) - - [POS | In-Store](https://developers.worldnetpayments.com/gochip:introduction) - - - [Plugins](https://developers.worldnetpayments.com/doku.php?id=plugins:introduction) - - [Merchant API](https://developers.worldnetpayments.com/apis/merchant/) - - - [Boarding API](https://developers.worldnetpayments.com/apis/boarding/) - About - - - - Company - [About Us](https://www.worldnetpayments.com/about-us/) - [The Team](https://www.worldnetpayments.com/about-us/#team) - [Our Partners](https://www.worldnetpayments.com/partnership-programs) - - Contact - [Support](https://www.worldnetpayments.com/contact) - [Sales](https://www.worldnetpayments.com/contact) - - Case Studies - [Parking](https://www.worldnetpayments.com/case-studies/parking-boxx-unattended-parking/) - [Laundry](https://www.worldnetpayments.com/case-studies/laundry-card-self-service-laundry/) - [Kiosks & Vending](https://www.worldnetpayments.com/case-studies/minutekey-kiosk-vending-solutions/) - [Car Wash](https://www.worldnetpayments.com/case-studies/dencar-unattended-car-wash/) - [View All](https://www.worldnetpayments.com/case-studies/) - [Blog](https://resources.worldnetpayments.com/) - [Login](https://payments.worldnettps.com/merchant/selfcare/?__hstc=56175604.ba93a84d3cdf4e2170e7d4442f91c6e0.1646712625581.1646712625581.1646715221609.2&__hssc=56175604.1.1646715221609&__hsfp=1045883597) - [Get Started](https://www.worldnetpayments.com/contact/) - Solutions - - - - [Unattended](https://www.worldnetpayments.com/solutions/unattended/) - Start processing self-service payments - - [In-Store](https://www.worldnetpayments.com/solutions/point-of-sale/) - Transform your card-present checkout - - - [Ecommerce](https://www.worldnetpayments.com/solutions/online/) - Start accepting online payments - - [Hardware](https://www.worldnetpayments.com/solutions/devices-processors/) - View all pre-certified POS terminals - - - [Mobile](https://www.worldnetpayments.com/solutions/mobile/) - mPOS for frictionless checkouts on the go - Developers - - - - [Mobile](https://developers.worldnetpayments.com/gochip:mobile_pos:devices) - - [POS | In-Store](https://developers.worldnetpayments.com/gochip:introduction) - - - [Plugins](https://developers.worldnetpayments.com/doku.php?id=plugins:introduction) - - [Merchant API](https://developers.worldnetpayments.com/apis/merchant/) - - - [Boarding API](https://developers.worldnetpayments.com/apis/boarding/) - About - - - - Company - [About Us](https://www.worldnetpayments.com/about-us/) - [The Team](https://www.worldnetpayments.com/about-us/#team) - [Our Partners](https://www.worldnetpayments.com/partnership-programs) - - Contact - [Support](https://www.worldnetpayments.com/contact) - [Sales](https://www.worldnetpayments.com/contact) - - Case Studies - [Parking](https://www.worldnetpayments.com/case-studies/parking-boxx-unattended-parking/) - [Laundry](https://www.worldnetpayments.com/case-studies/laundry-card-self-service-laundry/) - [Kiosks & Vending](https://www.worldnetpayments.com/case-studies/minutekey-kiosk-vending-solutions/) - [Car Wash](https://www.worldnetpayments.com/case-studies/dencar-unattended-car-wash/) - [View All](https://www.worldnetpayments.com/case-studies/) - [Blog](https://resources.worldnetpayments.com/) - [Login](https://payments.worldnettps.com/merchant/selfcare/?__hstc=56175604.ba93a84d3cdf4e2170e7d4442f91c6e0.1646712625581.1646712625581.1646715221609.2&__hssc=56175604.1.1646715221609&__hsfp=1045883597) - [Get Started](https://www.worldnetpayments.com/contact/) ![](https://resources.worldnetpayments.com/hubfs/Blog/Owning-Your-Own-Key.jpg) *As of April 2022, Worldnet Payments is now part of the Payroc family, helping ISVs worldwide solve complex payments problems and unify their payment channels in a single, powerful platform. [Payroc](https://payroc.com/), a global payments leader, serves more than 125,000 merchants in over 45 markets.* # In the Age of DUKPT, It Makes Sense to Own Your Device Keys Published by [Ross Cullen](https://resources.worldnetpayments.com/author/ross-cullen) on Feb 24, 2022 11:05:04 AM Every time your customers swipe, dip, tap, or connect to one of your unattended POS devices, they depend on you to protect their data. They trust that your [security measures are protecting them from fraud](https://resources.worldnetpayments.com/fraud-improve-security-unattended-payments-self-serve). This is vital especially now that e-commerce fraud is on the increase. Data security has come a long way. We started with basic end-to-end encryption (E2EE) and then expanded to tokenization — and now the industry has taken another giant leap forward. The most secure encryption technology available today is Derived Unique Key Per Transaction (DUKPT). ## What Is DUKPT? **DUKPT is a key management scheme that sends a unique encryption key with each transaction.** So, if one transaction is compromised, the rest of the transactions are safe. Originally created by Visa in the late 1980s, DUKPT is addressed in [Part 3 of the ANSI X9.24 guidelines](https://webstore.ansi.org/standards/ascx9/ansix9242017) for Retail Financial Services Symmetric Key Management. ### How Does DUKPT Work? The DUKPT process can be broken down into two parts: what happens during the manufacturing of each device, and what happens during each transaction. #### **Manufacturing Process** The DUKPT process starts in manufacturing with a base derivation key (BDK), which is used to create an initial key. Both the initial key and a key serial number (KSN) are injected into the POS device. The initial key is used to create a series of unique encryption keys for future transactions. Then the initial key is erased. Once the POS device is deployed in your business location, the DUKPT process continues. #### **Transaction Process** For every POS device transaction, one of those unique keys is used for encryption. A transaction counter is incremented forward, and that encryption key is combined with the KSN to derive more keys, and the encryption key is erased. When the encrypted transaction reaches its destination, the receiving KSN matches with the BDK to derive encryption keys using the same process but in the inverse. By recycling keys after they’re used, DUKPT is efficient *and* secure. Even if a fraudster intercepted an encrypted payload and reverse engineered the data, they’d have access to only a single transaction. The process works flawlessly and is easy to implement … except if a company decides to change platforms or processors. Why? Because certain base derivation keys can’t be transferred. ## BDKs Are Often Owned by Suppliers The base derivation key used during the manufacturing process is often a proprietary key owned by the supplier or payment processor. Every key derived from that BDK is proprietary as well. So, when companies make the decision to change payment processors, they find themselves in a bit of a situation. For example, companies are pondering the decision to migrate from MSR to EMV before Visa and Mastercard processing fees increase. For some, that means looking for another payment processor – one that has all the bells and whistles to adapt to whatever comes next on the payments horizon. The problem is their POS devices are using keys that will have to be transferred or replaced. And, it should come as no surprise that payment processors aren’t terribly keen on transferring their proprietary keys to competitors. So that leaves companies with one option: changing, or reinjecting, device keys. ## The Problem With Key Reinjection Device keys can be reinjected manually or remotely. Neither option is ideal. ### Manual Reinjection Manual reinjection involves shipping your POS devices to a key injection facility, where they are plugged into a computer, injected with a new key, and sent back. For instance, a taxi company has hundreds or thousands of cars, each with a separate device that would have to be removed, shipped to and from the facility for reinjection, and reinstalled. Not only is this costly, transactions are essentially on hold until the cabs have their devices back. ### Remote Key Injection Remote Key Injection (RKI) allows you to update keys on unlimited POS devices via a network. It saves time, but the price tag is enough to give anyone sticker shock. RKI costs range from $20 to $50 per device. When your business has 10,000 devices, that’s a cost of $200,000 to $500,000 *just* to change the keys. Fortunately, there’s another option. You can own your BDK. ## Why Owning Your Base Derivation Key Makes Sense Owning the BDK for your POS devices is a smart move for several reasons — and they all come down to flexibility: - It eliminates the need for costly RKI. - Your business can shift from platform to platform, partner to partner, and gateway to gateway without having to change keys. - You maintain control of the key and can even delete it, should your company choose. Keep in mind that some payment processors don’t allow clients to own their keys and require them to use proprietary keys, which impacts changes to devices and platforms. That’s not how we do things. ## Owned Key or Not, We Can Handle It We’ve seen how difficult it is for companies to find out their previous payment processor won’t transfer device keys. It forces those businesses to spend money they don’t have in their budget for RKI. Even worse, some have to choose between the cost of extended downtime or investing in new devices if their keys have to be injected manually. At Worldnet Payments, we can accommodate any scenario our clients bring to us: - Owned BDK and need POS devices - Owned BDK and have existing POS devices - Need to reinject BDK on existing POS devices We’re happy to use our proprietary keys or use yours. And we’ll work with hardware providers to ensure both the test and live devices are set up correctly before they’re shipped. That way, you’re ready to go live as soon as they arrive. Our goal is to get your business migrated and up and running as quickly and efficiently as possible. [Contact us](https://www.worldnetpayments.com/contact/) today to talk about the fastest and most cost-effective way to take advantage of our platform. Let’s get your business ready for the future of payments.   [![Self serve payment preferences](https://no-cache.hubspot.com/cta/default/3390300/e893c871-250b-423c-a135-3299db0f78e8.png)](https://cta-redirect.hubspot.com/cta/redirect/3390300/e893c871-250b-423c-a135-3299db0f78e8)     Tags: [Blog](https://resources.worldnetpayments.com/tag/blog) [Back to Blog](https://resources.worldnetpayments.com) - [Tweet](https://twitter.com/share) ## Related Articles ## [Embedded Payments: What ISVs and SaaS Need to Know](https://resources.worldnetpayments.com/embedded-payments-what-isvs-saas-need-to-know) Independent Software Vendors (ISVs), Software as a Service (SaaS), and platforms everywhere are... [Read More](https://resources.worldnetpayments.com/embedded-payments-what-isvs-saas-need-to-know) ## [How Better Payments Reporting Leads to Smarter Business Decisions](https://resources.worldnetpayments.com/how-payments-reporting-leads-to-smarter-business-decisions) Reporting is a key pillar for business success, regardless of industry. In the payments space,... [Read More](https://resources.worldnetpayments.com/how-payments-reporting-leads-to-smarter-business-decisions) ## [Your choice: E-commerce Payment Gateway or E-commerce Payment Processor?](https://resources.worldnetpayments.com/ecommerce-payment-gateway-ecommerce-payment-processor-which-is-best) Whether you’re an ISV creating an e-commerce solution for merchants or a merchant determining your ... [Read More](https://resources.worldnetpayments.com/ecommerce-payment-gateway-ecommerce-payment-processor-which-is-best) ### CONTACT Worldnet Payments 11555 Medlock Bridge Rd, Johns Creek, GA 30097 [(470) 372-1601](tel:4703721601) [ussales@worldnettps.com](mailto:ussales@worldnettps.com) ### CONNECT WITH US ### Blog - SOLUTIONS - [Unattended Payments](https://www.worldnetpayments.com/solutions/unattended/) - [Mobile Payments](https://www.worldnetpayments.com/solutions/mobile/) - [In-Store Payments](https://www.worldnetpayments.com/solutions/point-of-sale/) - [E-Commerce Payments](https://www.worldnetpayments.com/solutions/online/) - [POS Terminals](https://www.worldnetpayments.com/solutions/devices-processors/) - COMPANY - [Case Studies](https://www.worldnetpayments.com/case-studies/) - [Contact Sales](https://www.worldnetpayments.com/contact/) - [Contact Support](https://www.worldnetpayments.com/contact/) - [Become a Partner](https://www.worldnetpayments.com/partnership-programs/) - [About Us](https://www.worldnetpayments.com/about-us) ![worldnet-logo-1](https://resources.worldnetpayments.com/hubfs/worldnet-logo-1.png) Made with love by [Nettl of Dublin](https://www.nettl.com/ie/web-design-dublin) [Privacy Policy](https://testwebsite.worldnetpayments.com/privacy-policy) Terms and Conditions © Copyright 2022 [![pci-security](https://resources.worldnetpayments.com/hubfs/pci-security.png)](https://www.pcisecuritystandards.org/)