GA/T 1542-2019Information security technology - Security technical requirements for IPv6-based high-performance network intrusion prevention system products (English PDF)

6.1 Classification of safety technical requirements

This standard divides the security technical requirements of high-performance IPv6 based network intrusion prevention system products into security function requirements and own security functions Requirements, environmental adaptability, performance requirements, and security requirements. Among them, the safety function requirement is to propose the safety function that the product should have.

Requirements, including intrusion event analysis function requirements, intrusion event response function requirements, intrusion event audit function requirements, and management control functions Requirements; own security requirements include identification and authentication, security management, and audit logs; security assurance requirements for high-performance IPv6-based networks the life cycle process of intrusion prevention system products puts forward specific requirements, such as configuration management, delivery and operation, development and guidance documents.

6.2 Classification of security levels

The security level of IPv6-based high-performance network intrusion prevention system products is based on their security function requirements, their own security function requirements, and the strength of security assurance requirements is divided into basic and enhanced levels, of which security assurance requirements refer to GB/T 18336.3-2015.

7.1 Functional requirements for intrusion event analysis

7.1.1 Data collection

The product should have the ability to collect all packets flowing into the target network in real time.

7.1.2 Protocol analysis

The product shall analyze at least, but not limited to, events based on the following protocols. IP, ICMP, ARP, RIP, TCP, UDP, RPC, HTTP, FTP, TFTP, IMAP, SNMP, TELNET, DNS, SMTP, POP3, NETBIOS, NFS, NNTP, etc.

7.1.3 Intrusion Discovery

The product should be able to detect intrusions in the protocol.

7.1.4 Invasion Evasion Discovery

The product should be able to detect evasion or spoofing detection, such as IP fragment reassembly, TCP stream reassembly, protocol port relocation, URL characters String deformation, shell code deformation, etc.

7.1.5 Flow monitoring

The product should monitor application traffic in the target environment.

7.2 Intrusion incident response function requirements

7.2.1 Intercepting capabilities

The product shall intercept the found intrusion behaviors in advance to prevent entry into the target network.

7.2.2 Security Alarm

Products should provide security warnings when intrusions are detected and blocked.

7.2.3 Alarm mode

The product's alarm methods include one or more of real-time screen prompts, E-mail alarms, sound alarms, and short messages.

7.2.4 Exception

To reduce the impact on specific intranet terminals, the product should support host isolation; at the same time, for the continuity of key business systems, the product should support Add exception rules.

7.2.5 Event Merge

The product should have the ability to consolidate the same security events that occur at high frequencies to avoid alarm storms. The frequency can be set.

7.2.6 Event localization

The product should support event location, which can locate the geographic location (country, city) of the attack source for easy traceability.

7.3 Intrusion event audit function requirements

7.3.1 Event Generation

The product should be able to generate an audit record of the interception in a timely manner.

7.3.2 Event Log

The product shall record and save the intercepted intrusion events, and the intrusion event information shall contain at least the following contents. event name, event occurrence date Time, source IP address, source port, source IP geographic information, destination IP address, destination port, hazard level, if it is an intranet user Abuse, and also need to record username information and so on.

7.3.3 Report generation

The product should be able to generate reports on intrusion events or actions.

7.3.4 Report output

The product should support administrators to modify and customize report content according to their own requirements, and output it into a file format that is easy to read. At least One or more of DOC, PDF, HTML, XLS, etc.

7.3.5 Customization of report templates

The product should provide customization of results report templates.

7.4 Management control function requirements

7.4.1 Management Interface

The product shall provide a management interface for managing and configuring the intrusion prevention product. The management interface shall include all functions required to configure and manage the product.

can.

7.4.2 Intrusion event library

The product should provide an intrusion event library. The event library should include the event name, detailed description definition, and so on.

7.4.3 Event Classification

Products should rank incidents by severity so that authorized administrators can capture dangerous incidents from a wealth of information.

7.4.4 Functional failure handling

The product should provide a functional failure handling mechanism. When software and hardware problems occur on the device and the intrusion prevention function fails, the user can Choose to block or allow network traffic.

7.4.5 Policy Configuration

The product should provide the ability to configure intrusion prevention policies and response measures.

7.4.6 Event Library Update

The product should have the ability to update and upgrade the product event library, and ensure the security when the event library is upgraded.

7.4.7 Independent Management Interface

Products should have independent management interfaces.

7.4.8 Protocol definition

In addition to supporting the default network protocol set, the product should also allow authorized administrators to define new protocols or re-determine the protocol ports Bit.

7.4.9 Flow control

The product has the function of controlling application traffic, for example. limiting P2P download traffic.

7.4.10 Dual-System Hot Backup

The product should be capable of dual-system hot backup.

7.4.11 Self-hiding

The product should provide at least a transparent or bridge access method, take measures such as hiding the service port IP address to make itself invisible on the network to reduce the possibility of being attacked.

8.1 Identification and authentication

8.1.1 Attribute Definition

The product should specify the security attributes associated with each administrator, such as identification, authentication information, membership groups, permissions, and so on.

8.1.2 Property Initialization

The product should provide the ability to initialize the attributes of each administrator created with default values.

8.1.3 Unique identification

The product should provide the administrator with a unique identity and be able to associate the identity with all auditable events for that user.

8.1.4 Basic authentication

The product shall authenticate the user before performing any operations related to the security function.

8.1.5 Authentication data protection

The product shall ensure that the authentication data is not unauthorized access or modification.

8.1.6 Authentication Failure Handling

When the number of user authentication failures reaches the specified number of times, the product should be able to terminate the user's access.

8.1.7 Timeout lock or logout

The product should have a login timeout lockout or logout function. To terminate the session without any operation for a set period of time Re-authentication can be performed again. The maximum timeout period is set only by the authorized administrator.

8.2 Security management

8.2.1 Security Function Management

Authorized administrators should be able to perform the following management operations on the product.

a) View and modify related security attributes;

b) enable or disable all or part of the safety functions;

c) Develop and modify various security policies.

8.2.2 Security Role Management

The product should be able to distinguish between administrator roles.

a) an administrator role with at least two different permissions;

b) Define different authority roles according to different function modules.

8.2.3 Remote Security Management

If the product supports remote management through the network, the following technical requirements should be met.

a) protection of remote session information;

b) Limit the address of the remote management host.

8.3 Audit logs

8.3.1 Audit log generation

The product should generate audit logs for the following events related to its own security.

a) User login success and failure;

b) changes to security policies;

c) Add, delete and modify attributes to the administrator;

d) The session connection was terminated because the number of authentication failures exceeded the set value;

e) Other actions of the administrator.

Each audit log should include at least the date, time, user ID, event description, and result of the event. If using remote login in order to manage the product, the address of the management host should also be recorded.

8.3.2 Audit log storage

The audit log should be stored in a non-volatile storage medium at power failure.

8.3.3 Audit log management

The product shall provide the following audit log management functions.

a) Only authorized administrators are allowed to access the audit log;

b) query function for audit logs;

c) Save and export audit logs.

9.1 Support Pure IPv6 Network Environment

The product should support pure IPv6 network environment and be able to work normally in pure IPv6 network environment.

9.2 Self-management in IPv6 network environment

The product should support its own management in an IPv6 network environment.

9.3 Supporting IPv6 Transition Network Environment (optional)

9.3.1 Dual Protocol Stack

The product should support IPv4/IPv6 dual-stack network environment and be able to work normally under IPv4/IPv6 dual-stack network environment.

9.3.2 Tunnel

9.3.2.1 6over4

The product should support 6over4 network environment and be able to work normally in 6over4 network environment.

9.3.2.2 6to4

The product should support 6to4 network environment and be able to work normally in 6to4 network environment.

9.3.2.3 ISATAP

The product should support the ISATAP network environment to ensure normal work in the ISATAP network environment.

10.1 Throughput

The throughput of the product varies depending on the product at different rates. The specific requirements are as follows.

a) For 64-byte short packets, 100M products should not be less than 20% of the line speed, and Gigabit and 10G products should not be less than 35% of the line speed;

a) For 512-byte medium and long packets, 100M products should not be less than 70% of the line speed, and Gigabit and 10G products should not be less than 80% of the line speed;

b) For 1518-byte long packets, 100M products should not be less than 90% of line speed, and Gigabit and 10G products should not be less than 95% of line speed;

c) High-performance intrusion prevention system products should be capable of supporting 1518-byte long packets without packet loss.

20Gbps.

10.2 Delay

The delay of the product varies depending on the product at different rates. The specific requirements are as follows.

a) For 64-byte short packets, 512-byte medium-long packets, and 1518-byte long packets, the maximum delay for 100M products should not exceed 500us;

b) For 64-byte short packets, 512-byte medium-long packets, 1518-byte long packets, Gigabit, 10 Gigabit, and high-performance intrusion prevention system products the maximum delay should not exceed 90us.

10.3 Maximum concurrent connections

The maximum number of concurrent connections depends on the product at different rates. The specific requirements are as follows.

a) The maximum number of concurrent connections for 100M products should be no less than 10,000;

b) The maximum number of concurrent connections for the whole machine of the Gigabit product shall not be less than 100,000;

c) The maximum number of concurrent connections for the whole machine of the 10 Gigabit product should not be less than 1,000,000;

d) The maximum concurrent connections of the high-performance intrusion prevention system products should be no less than 8 million.

10.4 Maximum connection rate

The maximum number of connections depends on the product at different rates. The specific requirements are as follows.

a) The maximum connection rate of 100M products should not be less than 1500 per second;

b) The maximum connection rate of the whole machine of the Gigabit product shall not be less than 5000 per second;

c) The maximum connection rate of the whole machine of the 10 Gigabit product should not be less than 50,000 per second;

d) The maximum connection rate of the high-performance intrusion prevention system product should be no less than 500,000 per second.

10.5 Missing and Missing

10.5.1 Misinterpretation

Under normal background flow conditions, the error interception rate of the product cannot exceed 2%.

10.5.2 Missing

Under the mixed conditions of normal background traffic and intrusion traffic, the leakage rate of the product cannot exceed 15%.

11.1 Development

11.1.1 Security Architecture

The developer should provide a description of the security architecture of the product's security functions. The description of the security architecture should meet the following requirements.

a) Consistent with the level of abstract description of security functions implemented in the product design document;

b) describe the security domain of the product security function consistent with the requirements of the security function;

c) describe why the product safety function initialization process is safe;

d) confirm that product safety functions can be prevented from being compromised;

e) Verify that product safety functions prevent safety features from being bypassed.

11.1.2 Functional Specifications

Developers should provide complete functional specifications, which should meet the following requirements.

a) fully describe the safety functions of the product;

b) describe the purpose and use of all safety function interfaces;

c) identify and describe all parameters related to each safety function interface;

d) describe the safety function implementation behavior related to the safety function interface;

e) describe direct error messages caused by the behavioral processing of safety functions;

f) confirm that the safety function requires traceability to the safety function interface;

g) describe all actions related to the safety function interface during the implementation of the safety function;

h) Describe all direct error messages that may be caused by the call of the safety function interface.

11.1.3 Implementation Representation

Developers should provide implementation representations for all security functions. Implementation representations should meet the following requirements.

a) Provide a mapping between product design descriptions and implementation representation examples and prove their consistency;

b) Define product safety functions according to the level of detail, to a level of detail that can be generated without further design;

c) Provided in the form used by developers.

11.1.4 Product Design

Developers should provide product design documents, which should meet the following requirements.

a) describe the product structure in terms of subsystems;

b) identify and describe all subsystems of product safety functions;

c) describe the interaction between all subsystems of the safety function;

d) the mapping relationship provided can verify that all the behaviors described in the design can be mapped to the security function interface that calls it;

e) describe safety functions according to the module;

f) Provide the mapping relationship between the safety function subsystem and the module;

g) describe all safety function implementation modules, including their purpose and interaction with other modules;

h) Describe the relevant interfaces required by all modules to implement the security functions, return values from other interfaces, interactions with other modules, and Called interface

i) Describe the supporting or related modules of all safety functions, including their purpose and interaction with other modules.

11.2 Guidance Documents

11.2.1 Operation User Guide

Developers should provide clear and reasonable operating user guides, which are kept in line with all other documents provided for evaluation Sincerely, the description of each user role should meet the following requirements.

a) describe the functions and privileges accessible to users controlled in a secure processing environment, including appropriate alert information;

b) describe how to use the available interfaces provided by the product in a secure manner;

c) describe available functions and interfaces, especially all safety parameters controlled by the user, and indicate safe...