GA/T 1545-2019Information security technology - Security technical requirements for smart tokens (English PDF)

5.1 Classification of safety technical requirements

This standard divides the security technical requirements for network and security equipment configuration inspection products into two categories. security functions and security assurance requirements. its , Security function requirements are specific requirements for the security functions that network and security device configuration inspection products should have, including configuration acquisition, Configuration checks, check results, device support, identification and authentication, security management, data security, and audit logs; security assurance requirements are specific to the network Network and safety equipment configuration inspection product life cycle process put forward specific requirements, including development, guidance documents, life cycle support, Testing and vulnerability assessment.

5.2 Classification of security levels

Network and security equipment configuration check The product's security level is divided into basic according to the strength of its security function requirements and security assurance requirements.

Level and enhanced level, in which the security requirements refer to GB/T 18336.3-2015.

6.1 Configure collection

6.1.1 Information Collection

The product should be able to collect the following configuration information for network and security devices.

a) System information such as the brand, model and operating system version of the device;

b) Configuration and related parameters of device authentication, remote login, audit, access control and other policies.

6.1.2 Collection method

The product should be able to collect configuration information for network and security devices in the following ways.

a) Collect online through login device;

b) Offline import by manually importing the device configuration file.

6.1.3 Collection impact

When obtaining configuration information of network and security devices through online collection, the product should meet the following requirements.

a) Do not change the configuration of the acquisition target;

b) Does not affect the normal operation of the acquisition target function.

6.2 Configuration check

6.2.1 Identification Strategy Check

The product should be able to check the configuration and related parameters of network and security device authentication policies, including at least password complexity and other configurations.

6.2.2 Locking Policy Check

The product should be able to check the configuration and related parameters of network and security device lockout policies, including at least login failure lockout and timeout lockout Fixed configuration.

6.2.3 Remote login policy check

The product should be able to check the configuration and related parameters of the network and security device remote login policies, including at least login IP restrictions, login Configuration, etc.

6.2.4 SNMP Policy Check

The product should be able to check the configuration of SNMP policies and related parameters of network and security devices, including at least the SNMP community name and SNMP version and other configurations.

6.2.5 Audit Strategy Check

The product should be able to check the configuration of the network and security device audit policy and related parameters, including at least the audit content and log server and other configurations.

6.2.6 Access Control Policy Check

The product should be able to check the configuration and related parameters of network and security device access control policies.

6.2.7 Enable service check

The product should be able to check the status and related parameters of the services enabled by the network and security equipment.

6.3 Inspection results

6.3.1 Checking the baseline

The product should provide a baseline for configuration checks and be able to customize the baseline.

6.3.2 Discrimination of results

The product should be able to determine whether the configuration of the network and security equipment meets the baseline requirements.

6.3.3 Statistics

The product should be able to generate statistical reports of the discrimination results.

6.3.4 Suggestions for repair

The product should be able to recommend fixes for configurations that do not meet the baseline.

6.4 Device support

The product should support at least two different types or brands of network and security equipment.

6.5 Identification and identification

6.5.1 User Identification

The product should provide the user with a unique identification and be able to associate the identification with all auditable events for that user.

6.5.2 Identity authentication

The product shall ensure that any user is authenticated before performing the security functions of the product.

6.5.3 Authentication Failure Handling

When the user has failed a predetermined number of consecutive authentication failures, the product shall block the user from further authentication requests.

6.5.4 Timeout lock or logout

When the user does nothing for more than a predefined time, the product should terminate the management session and the user needs to authenticate again in order to restart the management operation.

6.6 Security Management

6.6.1 Management functions

The product shall provide authorized users with the following features.

a) View and modify security attributes;

b) activate and deactivate safety functions;

c) Develop and modify security policies.

6.6.2 Management Role

The product should be able to distinguish the roles of users and separate administrative, operational, and auditing permissions.

6.6.3 Remote Management

If the product supports remote management, the following requirements should be met.

a) Ensure non-plaintext transmission of remote management data;

b) Limit the IP address of the remote management host.

6.7 Data security

6.7.1 Authentication data protection

The product shall ensure that the authentication data is not unauthorized access or modification.

6.7.2 Equipment Information Protection

The product shall protect the stored network and security device configuration information, including at least the following functions.

a) Ensure that device information is accessible only to authorized users;

b) Provide equipment information deletion function.

6.8 Audit Log

6.8.1 Log Generation

The product should generate audit logs for the following events.

a) user authentication success and failure;

b) user authentication failure handling event;

c) user's modification of security policy;

d) Other important operations of the user.

Each audit log should contain at least the date, time, user ID, and event description of the event.

6.8.2 Log storage

The product shall store the audit log in a non-volatile storage medium that is powered off.

6.8.3 Log Management

The product shall provide the following audit log management functions.

a) allow only authorized users to access the audit log;

b) Provide access to audit logs.

7.1 Development

7.1.1 Security Architecture

The developer should provide a description of the security architecture of the product's security functions. The description of the security architecture should meet the following requirements.

a) Consistent with the level of abstract description of security functions implemented in the product design document;

b) describe the security domain of the product security function consistent with the requirements of the security function;

c) describe why the product safety function initialization process is safe;

d) confirm that product safety functions can be prevented from being compromised;

e) Verify that product safety functions prevent safety features from being bypassed.

7.1.2 Functional Specifications

Developers should provide complete functional specifications, which should meet the following requirements.

a) fully describe the safety functions of the product;

b) describe the purpose and use of all safety function interfaces;

c) identify and describe all parameters related to each safety function interface;

d) describe the safety function implementation behavior related to the safety function interface;

e) describe direct error messages caused by the behavioral processing of safety functions;

f) confirm that the safety function requires traceability to the safety function interface;

g) describe all actions related to the safety function interface during the implementation of the safety function;

h) Describe all direct error messages that may be caused by the call of the safety function interface.

7.1.3 Implementation Representation

Developers should provide implementation representations for all security functions. Implementation representations should meet the following requirements.

a) Provide a mapping between product design descriptions and implementation representation examples and prove their consistency;

b) Define product safety functions according to the level of detail, to a level of detail that can be generated without further design;

c) Provided in the form used by developers.

7.1.4 Product Design

Developers should provide product design documents, which should meet the following requirements.

a) describe the product structure in terms of subsystems;

b) identify and describe all subsystems of product safety functions;

c) describe the interaction between all subsystems of the safety function;

d) the mapping relationship provided can verify that all the behaviors described in the design can be mapped to the security function interface that calls it;

e) describe safety functions according to the module;

f) Provide the mapping relationship between the safety function subsystem and the module;

g) describe all safety function implementation modules, including their purpose and interaction with other modules;

h) Describe the relevant interfaces required by all modules to implement the security functions, return values from other interfaces, interactions with other modules, and Called interface

i) Describe the supporting or related modules of all safety functions, including their purpose and interaction with other modules.

7.2 Guidance documents

7.2.1 Operation User Guide

Developers should provide clear and reasonable operating user guides, which are kept in line with all other documents provided for evaluation Sincerely, the description of each user role should meet the following requirements.

a) describe the functions and privileges accessible to users controlled in a secure processing environment, including appropriate alert information;

b) describe how to use the available interfaces provided by the product in a secure manner;

c) describe available functions and interfaces, especially all safety parameters controlled by the user, and indicate safety values where appropriate;

d) clearly state each security-related event related to the user-accessible function that needs to be performed, including changes to the control of the security function Security features of the entity;

e) identify all possible states of operation of the product (including failures or operational errors caused by operations), and their relevance to maintaining safety Causality and connection between operations;

f) Security policies implemented to fully achieve security purposes.

7.2.2 Preparation procedures

The developer shall provide the product and its preparation procedures. The preparation procedure description shall meet the following requirements.

a) describe all steps necessary to securely receive the delivered product in accordance with the developer delivery process;

b) Describe all steps necessary to safely install the product and its operating environment.

7.3 Life cycle support

7.3.1 Configuration Management Capability

Developer configuration management capabilities should meet the following requirements.

a) provide unique identification for different versions of the product;

b) use a configuration management system to maintain all configuration items that make up the product and uniquely identify configuration items;

c) Provide configuration management documents, which describe the method used to uniquely identify configuration items;

d) The configuration management system provides an automatic way to support the generation of products, by which it is ensured that only the implementation of the products can be expressed Authorized changes;

e) The configuration management document includes a configuration management plan, which describes how to develop products using a configuration management system. real the implementation of the configuration management is consistent with the configuration management plan;

f) The configuration management plan describes the procedures used to accept modified or newly created configuration items as part of the product.

7.3.2 Configuration Management Scope

The developer should provide a list of product configuration items and describe the developer of the configuration item. The configuration item list should include the following.

a) Evaluation evidence of products, safety assurance requirements and components of products;

b) Implementation indication, security defect report and resolution status.

7.3.3 Delivery Procedure

Developers should use a certain delivery procedure to deliver the product and document the delivery process. When delivering versions of the product to the user, the delivery documentation should describe all procedures necessary to maintain security.

7.3.4 Development Security

Developers should provide development security documentation. The development security documentation should describe the design and implementation all physical, procedural, personal and other security measures necessary for confidentiality and integrity.

7.3.5 Life Cycle Definition

The developer should establish a life cycle model to control the development and maintenance of the product, and provide a description of the life cycle definition document.

Describe the models used to develop and maintain products.

7.3.6 Tools and Techniques

Developers should clearly define the tools used to develop the product, and provide development tool documentation to unambiguously define the meaning of each statement in the implementation and the meaning of all implementation-dependent options.

7.4 Test

7.4.1 Test coverage

The developer should provide a test coverage document, and the test coverage description should meet the following requirements.

a) indicate the correspondence between the tests identified in the test documentation and the safety functions of the product described in the functional specification;

b) Show that the above correspondence is complete and confirm that all safety function interfaces in the functional specification have been tested.

7.4.2 Test depth

Developers should provide test depth analysis. The test in-depth analysis description should meet the following requirements.

a) confirm the consistency between the tests in the test documentation and the safety function subsystem and implementation modules in the product design;

b) Verify that all safety function subsystems and implementation modules in the product design have been tested.

7.4.3 Functional test

Developers should test product security features, document results and provide test documentation. The test documentation should include the following.

a) A test plan that identifies the tests to be performed and describes the scenarios for each test, including those for other test results any order dependency;

b) the expected test results, indicating the expected output after a successful test;

c) Consistency of actual test results and expectations.

7.4.4 Independent testing

Developers should provide a set of resources equivalent to those used for self-testing security features for sample testing of security features.

7.5 Vulnerability assessment

Based on the identified potential vulnerabilities, the product is resistant to the following attacks.

a) attacks by attackers with basic attack potential;

b) Attacks by attackers with enhanced basic attack potential.

8.1 Safety function requirements

Table 1 shows the requirements for the security functions of the network and security device configuration products of different security levels.

Table 1 Network and security equipment configuration of different security levels

Security functions require basic level enhanced level Configure acquisition Information Collection 6.1.1 6.1.1 Collection method 6.1.2 a) 6.1.2 Collection impact 6.1.3 6.1.3 Configuration check Discrimination Strategy Check 6.2.1 ~ 6.2.7 Meet at least 3 items 6.2.1 Locking Policy Check 6.2.2 Remote login policy check 6.2.3 SNMP Policy Check 6.2.4 Audit policy check 6.2.5 Access Control Policy Check 6.2.6 Open service check 6.2.7 test result Check Baseline 6.3.1 6.3.1 Discrimination of results 6.3.2 6.3.2 Statistics-6.3.3 Suggested Fixes-6.3.4 Device support 6.4 6.4 Identification and authentication User ID 6.5.1 6.5.1 Identity 6.5.2 6.5.2 Authentication failure handling-6.5.3 Lockout or logout over time-6.5.4

Table 1 (continued)

Security functions require basic level enhanced level Safety management Management functions 6.6.1 6.6.1 Management roles-6.6.2 Remote management 6.6.3 6.6.3 Data Security Authentication data protection 6.7.1 6.7.1 Equipment Information Protection 6.7.2 6.7.2 Audit log Log generation 6.8.1 6.8.1 Log storage 6.8.2 6.8.2 Log management-6.8.3

8.2 Security requirements

Table 2 lists the security assurance requirements of the network and security equipment configuration inspection products with different security levels.

Table 2 Security requirements for network and security equipment configuration inspection products with different security levels

Security Assurance Requirements Basic Level Enhanced Level Develop Security Architecture 7.1.1 7.1.1 Functional specifications 7.1.2 a) to f) 7.1.2 Implementation representation-7.1.3 Product design 7.1.4 a) to d) 7.1.4 Guidance Document Operation User Guide 7.2.1 7.2.1 Preparation procedures 7.2.2 7.2.2 Life cycle support Configuration management capabilities 7.3.1 a) to c) 7.3.1 Configuration management scope 7.3.2 a) 7.3.2 Delivery procedures 7.3.3 7.3.3 Development Security-7.3.4 Life cycle definition-7.3.5 Tools and techniques-7.3.6 test Test coverage 7.4.1 a) 7.4.1 Test depth-7.4.2 Functional test 7.4.3 7.4.3 Independent test 7.4.4 7.4.4 Vulnerability assessment 7.5 a) 7.5 b)