PaymentLink is a secure payment processing solution developed by NewlandNPT to assist partners in building a higher-security payment acceptance environment, fully compliant with the international P2PE (Point-to-Point Encryption) security standard.
Built upon enhanced iterations of existing technical frameworks including NSDK, EMVL3, and PaymentService, PaymentLink retains full compatibility with original interfaces and functional integrity. It employs end-to-end encryption technology to real-time encrypt cardholder sensitive data (e.g., card numbers, track information) at the point of capture. This ensures all data is transmitted in ciphertext format from terminal devices to backend payment systems, fundamentally eliminating risks of sensitive information exposure throughout the entire transaction lifecycle.
When using PaymentLink to implement a P2PE solution, it is essential to Set the Encryption Mode before Each Transaction or ensure Whitelist Loading is completed, so that PaymentLink has the appropriate keys to encrypt payment data.
For manual entry transactions, always use PaymentLink’s dedicated input interface — never use native input methods — to ensure sensitive card information is securely captured and encrypted end-to-end.
Secures data transmission from terminals to backends by encrypting sensitive information (e.g., card numbers, PINs) at the source. Intercepted data remains indecipherable, providing fundamental protection against breaches.
Enables seamless migration from NSDK/EMVL3/PaymentService frameworks. Clients can upgrade to P2PE-compliant transaction applications through component replacement and permission adjustments, with zero business logic modifications.
The pre-validated application meet PCI P2PE standards, significantly reducing certification costs for end-user solutions by eliminating redundant testing efforts and resource expenditure.
Application Classified as Non-Payment Application
Domain 2 (Payment Application Security) assessment can be fully excluded, significantly simplifying the certification process and reducing compliance cost and time.
Application Remains a Payment Application
The scope of Domain 2 assessment is significantly reduced, focusing only on application-level workflow security, not core data protection.
Overview of the payment application developed based on PaymentLink:
Core Function: Secure terminal-to-acquirer communication
Technical Implementation
Packet building per acquirer specs (ISO8583/JSON)
Encrypted transaction message transmission
Online transaction state management
Protocol Support: Compatible with CUP/International card schemes
Components
NSDK base package
Native Android APIs
PaymentLink security interfaces
Critical Functions
Payment terminal management
Business operations: Receipt printing, UI display, manual card entry, encrypted PIN input
Compliance: All sensitive operations comply with PCI-certified interfaces
Core Capabilities: Full transaction flows (sale/void/refund)
Technical Implementation
Invoke EMVL3 or PaymentService modules in PaymentLink SDK
Reuse existing payment framework expertise
NSDK Security Module
Delivers foundational security interfaces including key management, data encryption, and PIN entry, ensuring mandatory compliance for payment application development.
P2PE Compliance Module
Implements end-to-end PCI P2PE requirements with critical functions: whitelist loading, encryption mode configuration, card data acquisition (ciphertext/masked), and manual card entry encryption.
EMVL3 Transaction Module
Integrates sensitive data filtering into native EMVL3 interfaces, achieving dual compliance with EMVL3 standards and P2PE security. Enables seamless transition from legacy EMVL3 applications with minimal code changes.
PaymentService Extension Module
Provides plug-and-play add-ons for PaymentService framework, allowing rapid development of PCI P2PE-compliant transaction applications within existing PaymentService applications.
| Module | Functionality |
|---|---|
| P2PE | Provides P2PE-specific functionalities, including whitelist loading, encryption mode configuration, get pan(Encrypted/Mask), and manual input function. |
| CardReader | Provides card detection and reading capabilities, supporting both contact and contactless card recognition. |
| Card | Manages card operations, including power-on, activation, and APDU communication for both contact and contactless cards. |
| KeyManager | Provides full lifecycle key management, supporting key installation, updates, and deletion. |
| Crypto | Provides encryption services based on device keys, supporting data encryption, MAC generation, digital signature, and verification. |
| PinEntry | Provides online/offline PIN entry functionality, supporting PIN input via hardware keypad or screen. |
| EMVL3 | Integrates EMVL2 kernel APIs, encapsulates EMV transaction workflows, and provides a unified interface. |
| PaymentService | A core payment component based on the PaymentService framework, encapsulating transaction routing and callback logic. |
| Component | Type | Description | Integration Method |
|---|---|---|---|
| Newland-NSDK-x.xx.x.aar | AAR | Core NSDK interface package. PaymentLink reuses parameter definitions and type declarations from the NSDK core package. | Must be integrated into the payment application. |
| Component | Type | Description | Integration Method |
|---|---|---|---|
| paymentlink-x.x.xx.apk | APK | PaymentLink service application. | Pre-install on terminal devices. |
| newland-paymentlink-x.x.xx.aar | AAR | PaymentLink base package containing P2PE, EMVL3, CardReader, Card, KeyManager, Crypto, and PinEntry modules. | Integrate into payment app. |
| newland-paymentlink-paymentservice-x.x.xx.aar | AAR | PaymentLink extension package for the PaymentService framework, including the PaymentServi | Integrate this AAR when PaymentService functionality is needed (depends on the PaymentLink base package). |
Integrate the existing EMVL3 interface, without providing the L2 interface.
Integrate the existing NSDK Security and CardReader interfaces.
Add the P2PE module, including whitelist function, etc.
Restrict the APDU interaction interface to accept the bank cards (in combination with Whitelist).
Add an interface to obtain encrypted sensitive data based on EMVL3 interface, and restrict the original interface from returning plaintext sensitive data.
See specific interface: PaymentLink API Document
Integrate the existing PaymentService interface and maintain interface consistency.
Interfaces containing sensitive data must return encrypted ciphertext.
See specific interface: PaymentLink PaymentService API Document
| POS Model | Status |
|---|---|
| X800 | ✔ |
| N950K | ✔ |
| N950S | ✔ |
| N910 pro | ✔ |
| N910 | ✔ |
| P300 | ✔ |
| N750P | ✔ |
| N750 | ✔ |
| U2000 | ✔ |
| N950 | ✔ |
Overview and implementation of an application built on PaymentLink.
Configure encryption keys and per-card-range encryption policies.
Answers on the PaymentLink security requirements and testing procedures.
