| 词条 | ISO 9564 |
| 释义 |
ISO 9564 is an international standard for personal identification number (PIN) management and security in financial services. The PIN is used to verify the identity of a customer (the user of a bank card) within an electronic funds transfer system, and (typically) to authorize the transfer or withdrawal of funds. Therefore, it is important to protect PINs against unauthorized disclosure or misuse. Modern banking systems require interoperability between a variety of PIN entry devices, smart cards, card readers, card issuers, acquiring banks and retailers – including transmission of PINs between those entities – so a common set of rules for handling and securing PINs is required, both to ensure technical compatibility and a mutually agreed level of security. ISO 9564 provides principles and techniques to meet these requirements. ISO 9564 comprises three parts,[1] under the general title of Financial services — Personal Identification Number (PIN) management and security. Part 1: Basic principles and requirements for PINs in card-based systemsISO 9564-1:2011[2] specifies the basic principles and techniques of secure PIN management. It includes both general principles and specific requirements. Basic principlesThe basic principles of PIN management include:
PIN entry devicesThe standard specifies some characteristics required or recommended of PIN entry devices (also known as PIN pads), i.e. the device into which the customer enters the PIN, including:
Smart card readersA PIN may be stored in a secure smart card, and verified offline by that card. The PIN entry device and the reader used for the card that will verify the PIN may be integrated into a single physically secure unit, but they do not need to be. Additional requirements that apply to smart card readers include:
Other specific PIN control requirementsOther specific requirements include:
PIN lengthThe standard specifies that PINs shall be from four to twelve digits long, noting that longer PINs are more secure but harder to use. It also suggests that the issuer should not assign PINs longer than six digits. PIN selectionThere are three accepted methods of selecting or generating a PIN:
PIN issuance and deliveryThe standard includes requirements for keeping the PIN secret while transmitting it, after generation, from the issuer to the customer. These include:
PIN encryptionTo protect the PIN during transmission from the PIN entry device to the verifier, the standard requires that the PIN be encrypted, and specifies several formats that may be used. In each case, the PIN is encoded into a PIN block, which is then encrypted by an "approved algorithm", according to part 2 of the standard). The PIN block formats are: Format 0The PIN block is constructed by XOR-ing two 64-bit fields: the plain text PIN field and the account number field, both of which comprise 16 four-bit nibbles. The plain text PIN field is:
The account number field is:
Format 1This format should be used where no PAN is available. The PIN block is constructed by concatenating the PIN with a transaction number thus:
Format 2Format 2 is for local use with off-line systems only, e.g. smart cards. The PIN block is constructed by concatenating the PIN with a filler value thus:
(Except for the format value in the first nibble, this is identical to the plain text PIN field of format 0.) Format 3Format 3 is the same as format 0, except that the "fill" digits are random values from 10 to 15, and the first nibble (which identifies the block format) has the value 3. Extended PIN blocksFormats 0 to 3 are all suitable for use with the Triple Data Encryption Algorithm, as they correspond to its 64-bit block size. However the standard allows for other encryption algorithms with larger block sizes, e.g. the Advanced Encryption Standard has a block size of 128 bits. In such cases the PIN must be encoding into an extended PIN block, the format of which is defined in a 2015 amendment to ISO 9564-1.[3] Part 2: Approved algorithms for PIN enciphermentISO 9564-2:2014[4] specifies which encryption algorithms may be used for encrypting PINs. The approved algorithms are:
Part 3 (withdrawn)ISO 9564-3 Part 3: Requirements for offline PIN handling in ATM and POS systems,[5] most recently published in 2003, was withdrawn in 2011 and its contents merged into part 1. Part 4: Requirements for PIN handling in eCommerce for Payment Transactions{{Expand section|date=October 2016}}ISO 9564-4:2016[6] defines minimum security requirements and practices for the use of PINs and PIN entry devices in electronic commerce. Notes1. ^Parts 1, 2 and 4. Part 3 was withdrawn in 2011. 2. ^ISO 9564-1:2011 Financial services — Personal Identification Number (PIN) management and security — Part 1: Basic principles and requirements for PINs in card-based systems 3. ^ISO 9564-1:2011/Amd 1:2015 Financial services — Personal Identification Number (PIN) management and security — Part 1: Basic principles and requirements for PINs in card-based systems AMENDMENT 1 4. ^ISO 9564-2:2014 Financial services — Personal Identification Number (PIN) management and security — Part 2: Approved algorithms for PIN encipherment 5. ^ISO 9564-3:2003 Banking — Personal Identification Number management and security — Part 3: Requirements for offline PIN handling in ATM and POS systems 6. ^ISO 9564-4:2016 Financial services — Personal Identification Number (PIN) management and security — Part 4: Requirements for PIN handling in eCommerce for Payment Transactions References{{Reflist}}{{ISO standards}}{{DEFAULTSORT:Iso 9564}} 2 : ISO standards|Financial technology |
| 随便看 |
|
开放百科全书收录14589846条英语、德语、日语等多语种百科知识，基本涵盖了大多数领域的百科知识，是一部内容自由、开放的电子版国际百科全书。