GA/T 1143-2014Information security technology. Security technical requirements for data destruction software products (English PDF)

Foreword

This standard was drafted in accordance with GB/T 1.1-2009 given rules.

This standard was proposed by the Ministry of Public Security Network Security Protection Agency.

This standard is under the jurisdiction of the Ministry of Public Security Information System Standardization Technical Committee.

This standard was drafted. Ministry of Public Security of Computer Information System Security Product Quality Supervision and Inspection Center, Institute of High Energy Physics Network Security Laboratory, Beijing Jinyuan Long Pulse Information Technology Co., Ltd. Xiamen City Meiah Pico Information, Ministry of Public Security the third RESEARCH the study.

Introduction

This standard is described in detail and data destruction software product safety environment-related assumptions, threats and organizational security policies, defines the data pin Ruined safety purpose software products and supporting environment, demonstrated safety and functional requirements can be traced back cover product safety purposes, safety purposes can Retroactive and cover enough security environment related assumptions, threats and organizational security policies.

The standard base-level reference to GB/T 18336.3-2008 prescribed level EAL2 security assurance requirements, and enhance the level at EAL4 level Security assurance requirements based on the vulnerability analysis requires upgrade to an attacker can withstand moderate attack potential attack.

This standard only shows the data destruction software products should meet the technical requirements of safety, but for data destruction software product specific technical implementation Now way, way, etc. is not required.

Information Security Technology Data destruction software product safety technical requirements

1 Scope

This standard specifies the security features of software products for data destruction requirements, security assurance requirements and grading requirements.

This standard applies to the use of computer information systems, magnetic storage media data destruction software for product design, development and Testing.

2 Normative references

The following documents for the application of this document is essential. For dated references, only the dated version suitable for use herein Member. For undated references, the latest edition (including any amendments) applies to this document.

GB 17859-1999 computer information system security protection classification criterion GB/T 18336-2008 (all parts), Information technology - Security techniques - Information Technology Security Evaluation Guidelines GB/T 25069-2010 Information security technology terms

3 Terms and Definitions

GB 17859-1999, GB/T 18336-2008 (all parts) and GB/T 25069-2010 defined and the following terms and definitions Meaning applicable to this document.

Data overwrite dataoverwriting the non-sensitive data before writing the data stored there sensitive position, to clear the data object.

3 data destruction method 3timesdatadestructionmethod Targeting data on the disk to overwrite rewritable manner, after each section head overwritten three times, the first time through a fixed character, the first 2nd fixed characters complement 3rd be overwritten by random characters.

7 Data destruction method 7timesdatadestructionmethod

Targeting data on the disk to overwrite rewritable manner, after each section head overwritten seven times, 1st and 2nd fixed Override character and its complement, respectively, followed by a single character, random characters, and then were fixed character and its complement overwritten with the last used Machine characters overwritten.

4 Data Destruction Software Product Description Data destruction software products in the form of software installed on the host to destroy data will cover non-sensitive data is written before there Min A sense of where data is stored, the purpose of clearing data.

Data destruction software products to protect assets, but is still sensitive information users no longer need this information for the user, although no longer