Regulations Governing the Standards for Information System and Security Management of Electronic Payment Institutions Article 14

The confidentiality of e-payment platform's sensitive data and key management shall meet the following requirements:1. A data confidentiality mechanism should be established in any of the following situations:(1) Sensitive data are stored in users' operating environment.(2) Sensitive data are transferred on Internet.(3) User Identity (such as password, personalized information) are stored in the System; the process involving any biometric characteristics (such as fingerprints, face, iris, voice, palm print, veins, and signature) shall be subject to the relevant self-disciplinary regulations specified by the Bankers Association.2. Where a fixed password is used for user identity verification, undergo non-invertible algorithm (e.g. hash algorithm) before storing such data. In addition, to prevent password cracking using pre-generated hash value, encrypt users' passwords or add inaccessible data computing. If encryption algorithm is used, the keys should be stored in the hardware security module with export function restricted.3. Use hardware security module to protect the keys, which should be separately generated by two or more units other than the system development and maintenance unit (e.g. customer service, accounting, business administration) with the list of clear-text keys under dual control. In addition, the keys under dual control may be encrypted and exported to a secure device (e.g. IC card) or copied to a location under access control for emergency use by the maintenance unit.4. Keep the locations of key storage at the minimum and allow only necessary administrators to access the keys to facilitate management and reduce the possibility of key leakage.5. Replace the key when the duration of key is about to expire or when there is leakage concern.