GA 1277.6-2023Security management requirements for internet interactive service - Part 6: Mobile application distribution service (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules for Standardization Documents" drafting:

This document is part 6 of GA 1277 "Internet Interactive Service Security Management Requirements", GA 1277 has released the following parts:

--- Part 1: Basic requirements;

--- Part 2: Microblog service;

--- Part 3: Audio and video chat room services;

--- Part 4: Instant messaging service;

--- Part 5: Forum services;

--- Part 6: Mobile application software distribution service;

--- Part 7: Cloud services;

--- Part 8: E-commerce services;

--- Part 9: Search service:

Please note that some contents of this document may refer to patents: The issuing agency of this document assumes no responsibility for identifying patents:

This document was proposed by the Cyber Security Bureau of the Ministry of Public Security:

This document is under the jurisdiction of the Information System Security Standardization Technical Committee of the Ministry of Public Security:

Introduction

GA 1277 aims to regulate and guide Internet interactive service providers to implement the "Network Security Law of the People's Republic of China" and "Chinese People's According to laws and regulations such as the Data Security Law of the People's Republic of China and the Personal Information Protection Law of the People's Republic of China, the security management system and security Technical measures, etc:, are proposed to be composed of 11 parts:

--- Part 1: Basic requirements: The purpose is to specify the basic requirements for the security management of Internet interactive services:

--- Part 2: Microblogging service: The purpose is to standardize and clarify the microblog service security management requirements:

--- Part 3: Audio and video chat room services: The purpose is to standardize and clarify the security management requirements for audio and video chat room services:

--- Part 4: Instant Messaging Services: The purpose is to standardize and clarify the security management requirements of instant messaging services:

--- Part 5: Forum services: The purpose is to standardize and clarify the safety management requirements of forum services:

--- Part 6: Mobile application software distribution services: The purpose is to standardize and clarify the security management requirements of mobile application software distribution services:

--- Part 7: Cloud services: The purpose is to standardize and clarify cloud computing platform service security management requirements:

--- Part 8: E-commerce services: The purpose is to standardize and clarify e-commerce service security management requirements:

--- Part 9: Search service: The purpose is to standardize and clarify the search service security management requirements:

--- Part 10: Internet car-hailing service: The purpose is to standardize and clarify the safety management requirements for Internet car-hailing services:

--- Part 11: Internet short-term rental housing information services: The purpose is to standardize and clarify the security management of Internet short-term rental housing information services Require:

In order to strengthen the security management of mobile application software distribution services and strengthen the implementation of the responsibility of mobile application software distribution service security subjects, this document concludes Combined with the characteristics of mobile application software distribution services, put forward the specific requirements for implementing the security protection management system and security protection technical measures:

Internet interactive service security management requirements Part 6: Mobile application software distribution services

1 Scope

This document specifies the security management requirements for mobile application software distribution services:

This document is applicable to Internet interactive service providers implementing the security protection management system and security protection of mobile application software distribution services:

technical measures:

2 Normative references

The contents of the following documents constitute the essential provisions of this document through normative references in the text: Among them, dated references for documents, only the version corresponding to the date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to this document:

GA 1277.1-2020 Internet Interactive Service Security Management Requirements Part 1: Basic Requirements

3 Terms and definitions, abbreviations

3.1 Terms and Definitions GA 1277.1-2020 and the following terms and definitions apply to this document:

3.1.1

mobile application software mobile application Applications installed and run on smart mobile terminals such as smartphones and tablets:

3.1.2

Internet interactive services that provide distribution services such as mobile applications, releases, downloads, installations, and upgrades for smart terminals:

3.1.3

Institutions or individuals who upload and share mobile application software through mobile application software distribution services:

3.1.4

Institutions or individuals that provide Internet services to users through mobile applications:

3.1.5

code signing Digitally sign the mobile application software to confirm the mobile application software provider and guarantee that the software has not been modified or damaged after signing measure:

3.2 Abbreviations

The following abbreviations apply to this document: