GA/T 1484-2018Information security technology - Security technical requirements and testing and evaluation methods for switch (English PDF)

Foreword

This standard was drafted in accordance with the rules given in GB/T 1.1-2009.

This standard replaces GA/T 684-2007 "Information Security Technology Switch Security Technical Requirements" and GA/T 685-2007 "Information Security the main technology switch safety assessment guidelines, compared with GA/T 684-2007 and GA/T 685-2007, the main technical changes are as follows.

--- Modified the leveling requirements, the level is divided into basic level and enhanced level (see Chapter 8, Chapter 4 of GA/T 684-2007~ Chapters 6 and A.1, Chapters 4 through 6 of GA/T 685-2007);

--- Removed acronyms such as "IDS", "IPSec", "MPLS", "VPN", and added "TOS" abbreviations (see Chapter 4, GA/T 684-Chapter 3 of 2007);

--- Added "Switch Description" (see Chapter 5);

--- Added "Overall Description" (see 6.1);

---Modified the "autonomous access control" function and test evaluation method (see 6.2.1, 7.1.1, 6.1.1 of GA/T 684-2007, 6.1.1) of GA/T 685-2007;

---Modified the "divide virtual LAN" function and test evaluation method (see 6.2.2, 7.1.2, 6.1.5 of GA/T 684-2007, 6.1.5) of GA/T 685-2007;

--- Modified the "identity identification" function and test evaluation method (see 6.2.3, 7.1.3, 6.12 of GA/T 684-2007, GA/T 685-6.1.2 of 2007);

---Modified the "safety audit" function and test evaluation method (see 6.2.4, 7.1.4, 6.14 of GA/T 684-2007, GA/T 685-6.1.4 of 2007);

---Modified the "safety management" function and test evaluation method (see 6.2.5, 7.1.5, 6.13 of GA/T 684-2007, GA/T 685-6.1.3 of 2007);

---Modified security requirements and test evaluation methods (see 6.3, 7.2, GA/T 684-2007, 4.2, 5.2, 6.2, GA/T 685-4.2, 5.2, 6.2) of 2007;

--- Removed additional security features and evaluation criteria (see Chapter 7 of GA/T 684-2007, GA/T 685-2007) Chapter 7).

This standard was proposed by the Network Security Bureau of the Ministry of Public Security.

This standard is under the jurisdiction of the Information System Security Standardization Technical Committee of the Ministry of Public Security.

This standard was drafted. Ministry of Public Security Computer Information System Security Product Quality Supervision and Inspection Center, the Third Institute of the Ministry of Public Security.

1 Scope

This standard specifies the safety technical requirements, test evaluation methods and safety level division of the switch.

This standard applies to the design, development and testing of switches.

2 Normative references

The following documents are indispensable for the application of this document. For dated references, only the dated version applies to this article.

Pieces. For undated references, the latest edition (including all amendments) applies to this document.

GB/T 18336.3-2015 Information technology security technology - Information technology - Safety assessment criteria - Part 3. Security components GB/T 25069-2010 Information Security Technology Terminology

3 Terms and definitions

The following terms and definitions as defined in GB/T 18336.3-2015 and GB/T 25069-2010 apply to this document.

Switch

Working on the second layer of the open system interconnection model, it can forward data packets based on data link layer information, and provide information flow control and division.

Network equipment for security functions such as virtual local area network, identity authentication, and security auditing.

4 Abbreviations

The following abbreviations apply to this document.

ACL. Access Control List (AccessControlList) MAC. Media Access Control (MediaAccessControl) VLAN. Virtual Local Area Network (VirtualLocal AreaNetwork) TOS. Service Type (TypeofService)

5 Switch Description

In addition to the functions of connecting multiple small networks or subnets and providing data exchange platforms, the switch also has the function of defending against network security threats.

Standby access control, partitioning of virtual local area networks, identity authentication, security auditing, and security management.

The switch filters and forwards packets sent from different subnets to prevent security threats such as broadcast storms and network congestion.

The assets protected by the switch are different subnet data to which they are connected. In addition, the switch itself and its internal important data are also insured.

Protected assets.