GB/T 21078.1-2007 Banking—Personal Identification Number management and security—Part 1:Basic principles and requirements for online PIN handling in ATM and POS systems

Scope

This part specifies the basic principles and technologies for the minimum security measures required for effective PIN management. These measures apply to institutions responsible for implementing PIN management and protection technologies.
This part also specifies the PIN protection technologies applied to financial transaction cards in online environments and the standard methods for PIN data exchange. These technologies apply to institutions responsible for implementing PIN management and protection technologies in ATM and POS terminals.
The provisions of this part do not include:
a) PIN management and security in offline PIN environments, which are covered in ISO 95643:2003;
b) PIN management and security in e-commerce environments, which will be covered in subsequent parts of ISO 9564;
c) Preventing customers or authorized employees of card issuers from losing or intentionally misusing PINs;
d) The confidentiality of non-PIN transaction data;
e) Protecting transaction messages against modification or substitution, such as authorization responses for PIN verification;
f) Preventing the replay of PINs or transactions;
g) Specific key management technologies.

Development Information

Superseded by the following standards

Referenced Standards

Adopt standards

Related Standards