GB/T 21078.2-2011 Management and security of personal identification numbers for banking services Part 2: Requirements for offline PIN processing in ATM and POS systems GB/T21078.2-2011 |tt||Standard compression package decompression password: www.bzxz.net
This part specifies the minimum security requirements for offline PIN processing and the standard method for exchanging PIN data in an offline environment. This part applies to card-initiated financial transactions that require offline PIN verification, and also applies to those responsible for implementing PIN management and protection technology in ATMs and acquirer-deployed POS terminals. This standard does not apply to the following situations: a) PIN management and security in an online PIN environment, which is covered by GB/T 21078.1; b) Approved PIN encryption algorithms; c) Use of PIN in an open network environment, which is covered by GB/T 21078.3; d) PIN protection to prevent loss or intentional misuse by users or authorized employees of issuers and their agents; e) Privacy of non-PIN transaction data; f) Protection of transaction messages to prevent modification or replacement, such as online authorization responses; g) Prevention of PIN or transaction replay; h) Specific key management techniques; i) Decision on whether an IC card accepts an encrypted PIN; j) Contactless IC cards. The basic principles of PIN management described in Chapter 4 of GB/T 21078.1-2007 also apply to this part. Requirements related to multi-application IC cards are the responsibility of the card issuer and are not included in this part. This part applies to IC card technology, but is not limited to IC card technology.

ICS35.240,40
National Standard of the People's Republic of China
GB/T 21078.2—2011
Banking
Personal identification number management and security-Part 2:Requirements for offline PIN handling in ATM and POS systems(IS0 9564-3:2003.M0D)
Published on December 30, 2011
General Administration of Quality Supervision, Inspection and Quarantine of the People's Republic of China Administration of Standardization of the People's Republic of China
Implementation on February 1, 2012
Normative references
Terms and definitions
A PIN during transmission between a PIN entry device (PED) and an IC card reader Protection 5
Physical security
6 PIV BLOCK format
6.1 Overview
6. 2 Format 2 PIN BLOCK
References
TKNYKACA
GB/T 21078,2—2011
TTTKAONTKACA
GB/T21078 "Management and security of personal identification codes for banking services" is divided into the following three parts: Part 1: Basic principles and requirements for online PIN processing in ATM and POS systems; Part 2. Requirements for offline PIN processing in ATM and POS systems; Part 3: Guidelines for PIN processing in open networks. This part is Part 2 of GB/T21078. This part was drafted in accordance with the rules given in GB/T1.1—2009. GB/T 21078.2—2011
This part amends ISO 9564-3:2003 Management and security of personal identification numbers for banking services Part 3 Requirements for offline PIN processing in ATM and POS systems (English version). The technical difference between this part and ISO 9564-3:2003 is that, based on the actual application in China, the requirement in 6.1 "a unique password should be used for each transaction" is expanded to "a quasi-unique key should be used for each transaction or the encryption password should be changed regularly". The relevant technical differences have been compiled into the text and marked with a vertical single line in the margin of the clauses involved. The ISO foreword has been deleted from this part.
This part was proposed by the People's Bank of China.
This part is under the jurisdiction of the National Financial Standardization Technical Committee SAC/TC180: The responsible drafting unit of this part is China Financial Electronicization Company, and the participating drafting units of this part are Industrial and Commercial Bank of China, Bank of China, Bank of Communications, Xinghua City Branch of the People's Bank of China, and China UnionPay Co., Ltd.
The main drafters of this part are: Wang Pingwa, Lu Shuchun, Li Shuguang, Jia Shuhui, Zhao Zhilan, Zhong Zhihui, Wang Zhigang, Zaiping, Zhou Yanmei, Zhang Fan, Fei Jing, Liu Yun, Zui Yun, Zhang Yan.
TTTKANTKACA
GB/T 21078.2—2011
Financial transaction cards with built-in integrated circuits can technically use IC cards for offline PIN verification. Currently, the card issuer can choose to perform PIV verification offline or online. This part of GB/T2107B sets out clear requirements for offline PIN processing. Offline PIN verification does not require the cardholder's PIN to be sent to the card issuer's host for verification, so the relevant security requirements for PIN protection over the network do not apply. However, although PINs can be verified offline, many common PIN protection principles and technologies still apply. This part of GB/T21078 gives specific requirements for offline PIN processing. Unless otherwise specified, the basic principles of PIN management given in GB/T21078, 1-2007 apply to this part. Part 6 of ISO10202 defines the security requirements for cardholder verification using IC cards. It should be noted that ISO10202 defines requirements for IC cards themselves, not for acquirer IC card acceptance equipment, and can therefore be seen as a supplement to GB/T 21078. TT KANYKAcA
1Fan Yi
Management and security of personal identification numbers for banking services GB/T 21078.2—2011
Part 2: Requirements for offline PIN processing in ATM and POS systems
This part specifies the minimum security requirements for offline PIV processing and the standard method for exchanging PIN data in an offline environment. This part applies to card-initiated financial transactions requiring offline PIN verification, and also to those responsible for implementing PIN management and protection technology in ATM and POS terminals deployed by acquirers. This part does not apply to the following:
a) PIN management and security in an online PIN environment, which is covered by GB/T 21078.1; approved PIN encryption algorithms
use of PINs in an open network environment, which is covered by GB/T 21078.3; d) PIN protection to prevent loss or intentional misuse by users or authorized employees of the issuer and its agents; privacy of non-PIN transaction data
protecting transaction messages from modification or replacement, such as online authorization responses; preventing PIN or transaction replay;
h) specific PIN management techniques;
decision of whether the IC·F accepts encrypted PINs: i
j) contactless I cards.
the basic principles of PIN management described in Chapter 4 of GB/T 21078.1-2007 also apply to this part. Requirements related to multi-application I cards are the responsibility of the issuer and are not included in this part. This part applies to IC card technology, but is not limited to IC card technology. 2 Normative references
The following documents are essential for the application of this document. For all dated references, only the dated version applies to this document. For all undated references, the latest version (including all amendments) applies to this document. GB/T16649 (all parts) Identification of integrated circuit cards with contacts (ISQ/IEC7816-1:1998, MOD) CB/T21078.1-2007 Management and security of personal identification codes for banking services Part 1: Basic principles and requirements for online PIN processing in ATM and POS systems (ISQ9564-1.2002, MOD) EMV2000 Integrated Circuit Card Specification for Payment Systems, Book 2: Security and Key Management (Version 4.0) 2000.12 (EMV2000, Integrated Circuit Card Specification for Payment Systems, Book 2-Security and Key Management, Version4, 0, December, 2000)
3 Terms and definitions
The terms and definitions defined in GB/T21078.1-2007 and column F apply to this document. 3.1
Integrated Circuit (IC) integrated circnit (IC) According to the provisions of GB/T16649, (typically) a microprocessor embedded in an IC card, TTTKONYKAA
GB/T 21078.2-2011
4 Protection of PIN during transmission between PIN Entry Device (PED) and IC Card Reader The IC card reader and PIN entry device (PD) can be either two separate devices or integrated into one device, see Table 1 When the IC card reader and PEI are integrated into a device that meets the requirements of 6.3 of GB/T21078.1-2007, and the PED does not need to encrypt the PIV when the PIN is submitted to the IC card in plain text. When the PIN is transmitted to the IC card reader in plain text through an unprotected environment and submitted to the IC card, the PIV should be encrypted in accordance with the requirements of GB/T 21078.1-2007. The IC card reader shall decrypt the FIN and submit it to the IC card in plain text. When the PIN is submitted to the IC card in encrypted form, whether it is an integrated or non-integrated device, the PIN shall be encrypted using the IC card encryption key in a device that complies with the requirements of 6.3 of GB/T21078.1-2007. If the PIN is transmitted to a device that complies with 6.3 of GB/T21078.1-2007,3 If the device is required to be on the outside, it should be encrypted in accordance with the requirements of GB/T21078.1-2007 or encrypted using the IC card encryption key. 5 Physical security
This document gives requirements and recommendations for the physical security of PEDs and IC card readers. The requirements for PEDs used for offline PIN verification are the same as those given in GB/T 21078.1-2007, except for the following. The PED should be a "physical security device" as defined in 6.3 of GB/T 21078.1-2007. Otherwise, it should at least meet the requirements for PEDs in 6.3 of GB/T21078.1-2007. In order for the acquirer to be able to detect attacks on the PED, the FED itself should be able to authenticate itself to the acquirer, i.e., if it is attacked, it will no longer be able to authenticate itself to the acquirer.
In addition, if the PED is used to process online PIN transactions (and complies with the requirements of GB/T 21078.1-2007), the acquirer should regularly verify its integrity.
Equipment equipped with an IC card reader should meet the requirements of GB/T 21078.1-2007, 6.3 for PED. The card slot of the IC card reader:
a) When the card is in the IC card reader, it should have space to accommodate a malicious device that leaks the PIN; b) It should not be enlarged to provide space for a malicious device that leaks the full PIN; c) It should be placed in a way that allows users to promptly detect that a malicious device is connected to it. Necessary electronic protection circuits should be provided to prevent the installation of eavesdropping devices in the IC card reader. Table 1 summarizes the requirements for PIN protection for different terminal configurations and PI submission methods based on the requirements of this document and Chapter 4. Table 1 FIN protection requirements
IC card reader and PED follow
PIN submission method
The encrypted PIN BLOCK is submitted
to the card
The plain text PIVBLOCK is submitted
to the IC card
Note: See EMV2000.
GB/T 21078.1-2007
6.3 requirements integrated into one device
IC card reader and PED are equipped with a push-button
GB/T 21078. 1--2007
6.3 requirements integrated into one device
PINBLOCK is between FED and IC card reader and should be encrypted according to the requirements of GB/T 21078,1-2007. FIN BLEXCK should be encrypted with an IC card encryption key and then submitted to the IC card
No encryption required
Or an IC card encryption key
PLV BLUOCK should be encrypted with an IC card encryption key and then submitted to the IC card
FLV The PIN BLOCK between the PED and the IC card reader shall be encrypted in accordance with the requirements of GB/T 21078.1-2007. 6 PIN BLOCK format
6.1 Overview
GB/T 21078.2—2011
The PIN submitted by the IC card reader to the IC card is contained in a PIN BIL.OCK, which complies with the requirements of 6.2. This applies to the PIN submitted in plain text or using an IC card encryption key such as the encrypted PIN submitted after encryption. The encrypted PIN transmitted between the PED and the IC card reader shall use the PIN BLOCK format specified in GB/T 21078.1-2007. When using \Format 2 PIN BLOCK\, a unique key shall be used for each transaction or the encryption key shall be changed regularly. 6.2 Format 2 PNBLOCK
PINRI.OCK consists of two parts connected: the clear PIN part and the padding part: Format 2 PINBI.OC should use the following format: Bits:
Where:
C=Control field
NPIN length
P=PIN digit
P/F-PIN digit or padding
F-Padding bit
P/FP/FF/FP/FP/FF/F
4-bit field, value is 0010(2)
P/FF/F
4-bit binary number, allowed values ​​are 0100(4) to 1100(12); 4-bit field, allowed values ​​are 0000(0) to 1001<9); these fields are determined by the length field;
4-bit field, value is 1111(15).
GB/T21078.2-2011
[1GB/T16790(all parts】
References
Financial transaction cards Security system for financial transaction systems using integrated circuit cardsOC should use the following format: bits:
Where:
C=control field
NPIN length
P=PIN digit
P/F-PIN digit or fill bit
F-fill bit
P/FP/FF/FP/FP/FF/F
4-bit field, value is 0010(2)
P/FF/F
4-bit binary number, allowed values ​​are 0100(4) to 1100(12); 4-bit field, allowed values ​​are 0000(0) to 1001<9); these fields are determined by the length field;
4-bit field, value is 1111(15).
GB/T21078.2-2011
[1GB/T16790(all parts】
References
Financial transaction cards Security system for financial transaction systems using integrated circuit cardsOC should use the following format: bits:
Where:
C=control field
NPIN length
P=PIN digit
P/F-PIN digit or fill bit
F-fill bit
P/FP/FF/FP/FP/FF/FbzxZ.net
4-bit field, value is 0010(2)
P/FF/F
4-bit binary number, allowed values ​​are 0100(4) to 1100(12); 4-bit field, allowed values ​​are 0000(0) to 1001<9); these fields are determined by the length field;
4-bit field, value is 1111(15).
GB/T21078.2-2011
[1GB/T16790(all parts】
References
Financial transaction cards Security system for financial transaction systems using integrated circuit cards
Tip: This standard content only shows part of the intercepted content of the complete standard. If you need the complete standard, please go to the top to download the complete standard document for free.