金融服务.个人识别号(PIN)管理与安全.第1部分:以卡为基础的系统中个人识别码的基本原则和要求

[中文适用范围]： 本文件规定了提供有效国际 PIN 管理所需的最低安全措施的基本原则和技术。 这些措施适用于负责在 PIN 的创建、发行、使用和停用过程中实施 PIN 管理和保护技术的机构。 本文件适用于持卡人 PIN 的管理，用作零售银行系统中持卡人验证的手段，特别是自动柜员机 (ATM) 系统、销售点 (POS) 终端、自动加油机、自动售货机、银行信息亭和 PIN 选择/更改系统。 它适用于发行者和交换环境。 本文件的规定无意涵盖： a) 交易发起设备和收单方之间不存在持久加密关系的环境中的 PIN 管理和安全，例如使用浏览器进行在线购物（对于这些环境，请参阅 ISO 9564-4); b) 防止 PIN 丢失或被客户故意滥用； c) 非 PIN 交易数据的隐私； e) 防止重放 PIN 或交易； d) 保护交易消息不被更改或替换； f) 特定的密钥管理技术； g) 非接触式设备中使用的离线 PIN 验证； h) 与 PIN 管理特别相关的要求，因为它与 ICC 中的多应用功能相关。 [外文原描述]： ISO 9564-1:2017 specifies the basic principles and techniques which provide the minimum security measures required for effective international PIN management. These measures are applicable to those institutions responsible for implementing techniques for the management and protection of PINs during their creation, issuance, usage and deactivation. ISO 9564-1:2017 is applicable to the management of cardholder PINs for use as a means of cardholder verification in retail banking systems in, notably, automated teller machine (ATM) systems, point-of-sale (POS) terminals, automated fuel dispensers, vending machines, banking kiosks and PIN selection/change systems. It is applicable to issuer and interchange environments. The provisions of ISO 9564-1:2017 are not intended to cover: a) PIN management and security in environments where no persistent cryptographic relationship exists between the transaction-origination device and the acquirer, e.g. use of a browser for online shopping (for these environments, see ISO 9564-4); b) protection of the PIN against loss or intentional misuse by the customer; c) privacy of non-PIN transaction data; d) protection of transaction messages against alteration or substitution; e) protection against replay of the PIN or transaction; f) specific key management techniques; g) offline PIN verification used in contactless devices; h) requirements specifically associated with PIN management as it relates to multi-application functionality in an ICC.