GA/T 1557-2019Information security technology - Security technical requirements for IPv6-based high-performance network audit system products (English PDF)

5.1 Classification of safety technical requirements

This standard divides the security technical requirements of IPv6 network audit products into two categories. security functions and security assurance requirements. Among them, the safety function should Qiushi put forward specific requirements for the security functions that IPv6 network audit products should have, including access methods, information collection, data restoration, and auditing.

Record statistics, audit record analysis, management control requirements, etc .; security assurance requirements are proposed for the life cycle process of IPv6 network audit products Specific requirements, such as development, instructional documentation, lifecycle support, and testing.

5.2 Classification of security levels

The security level of IPv6 network audit products is divided into basic and enhanced levels according to the strength of their security function requirements and security assurance requirements.

Among them, security requirements refer to GB/T 18336.3-2015.

6.1 Information Collection

IPv6 network audit products should be able to set network data collection policies based on audit objectives, and should include at least one of the following items.

a) The type of IP address of the collection target;

b) the IP address or IP address segment policy of the collection target;

c) collection network protocol application strategy;

d) collection transmission protocol strategy;

e) collection and application protocol strategy;

f) acquisition time period strategy;

g) other.

6.2 Data restoration

6.2.1 Restore basic network information

IPv6 network audit products should be able to restore network information within the target network, which should include.

a) source port, source IP address, source MAC address;

b) destination IP address and destination port;

c) network layer protocol type;

d) transport layer protocol type;

e) application layer protocol type;

f) support IPv6 address collection;

g) Support IP address acquisition based on IPv6 transition technology, including tunnel technology, dual protocol stack technology, network address translation technology.

6.2.2 Restore of Session Content

IPv6 network audit products should be able to restore sessions. The basic items of information content should include. session start time, source address, and destination address.

6.2.3 Basic requirements for service information restoration

IPv6 network audit products should be able to restore network information and events, including at least the following five.

a) In addition to the basic items, the FTP protocol should include. the account used and input commands;

b) TELNET protocol, in addition to the basic items, should include. the account used, input commands;

c) HTTP protocol, in addition to basic items, should include. target URL;

d) In addition to the basic items, the E-mail agreement should include. the sender address and the recipient address.

e) RLOGIN protocol, in addition to basic items, should include. using users, entering commands;

f) The DNS protocol, in addition to the basic items, shall include. the content of the message protocol;

g) IM information, in addition to basic items, should include. IM software name and account information;

h) remote management and operation of the database, in addition to the basic items, it should include. the account used, input operation commands;

i) Stock software communication information, in addition to the basic items, shall include. the name of the stock software;

j) Internet download communication information, in addition to the basic items, should include. the name of the downloaded software or agreement and the name of the downloaded file;

k) communication information for online games, in addition to the basic items, it should include. the name of the online game;

l) Forum, blog and Weibo communication information, the name and account of the forum, blog or Weibo;

m) search engine communication information, search engine name and search keywords;

n) other network communication information.

6.2.4 Extended requirements for service information restoration

IPv6 network audit products should be able to restore network information and events, including at least the following two.

a) FTP communication information, in addition to meeting the basic requirements, should also include. the name and content of the file being transmitted;

b) TELNET communication information, in addition to meeting basic requirements, shall include. feedback information;

c) HTTP communication information, in addition to meeting the basic requirements, should also include. the files required to restore the webpage and the content of the transmitted files;

d) E-mail communication information, in addition to meeting the basic items, should include. the subject.

6.2.5 Network Attack Identification

IPv6 network audit products should be able to identify cyber attack events, including at least one of the following.

a) DoS attack;

b) password brute force guessing attacks;

c) port scanning attacks;

d) other cyber attacks.

The restoration content should include. date, event, source IP address, destination IP address, source port, destination port, and attack type.

6.2.6 Restore based on application type

IPv6 network audit products should be able to restore non-standard port events or dynamic port network communication events based on application type characteristics.

6.3 Audit record statistics

6.3.1 Event Statistics

IPv6 network audit products should be able to collect statistics on network events and should include at least one of the following.

a) the total number of network communication events;

b) statistics on the number of one or more specific types of network communication events;

c) other event statistics.

6.3.2 Traffic Statistics

IPv6 network audit products should be able to collect statistics on network traffic and should include at least one of the following.

a) TCP protocol traffic;

b) UDP protocol traffic;

c) network application traffic;

d) other network traffic.

6.4 Audit record analysis and processing

6.4.1 Analysis

6.4.1.1 Association analysis

IPv6 network audit products should be able to correlate and analyze related events, and support at least one of the following;

a) Basic information association, including time, event, source IP address, source port address, destination IP address, service type, network Protocol, etc. to collect information;

b) Statistical correlation, using data mining algorithms and other methods to analyze the correlation between different network events.

6.4.1.2 Anomaly analysis

IPv6 network audit products should be able to provide anomaly analysis functions and trigger warnings when abnormal events occur. Its functions include the following.

a) Able to pre-define anomalous events, which can reach a threshold for the number of times or frequency domains that occur within a certain period of time or a certain traffic to reach a threshold when the value is triggered, an alarm is triggered;

b) Able to define abnormal behavior based on the results of the correlation analysis function and trigger an alarm on the abnormal behavior of the system;

c) other abnormal conditions.

6.4.1.3 Classification

IPv6 network audit products should be able to provide event classification and grading functions, users can divide different categories according to policies, and users can it is enough to classify audit events according to their importance. The classification strategy should include at least one of the following.

a) in accordance with audit objectives;

b) according to time frame;

c) according to the type of audit event;

d) based on network traffic;

e) in accordance with communication protocols;

f) Based on the results of audit analysis, including at least one of correlation analysis or abnormal analysis;

g) Custom.

6.4.2 Processing

6.4.2.1 Respond to alarms

IPv6 network audit products can set policies to define alarm events and trigger a warning when an alarm event occurs. The alarm function meets the following requirements.

begging.

a) The product shall support policy settings to trigger alarms;

b) The alarm should be able to record, the content should include. date, time, event subject, event subject, event level, event description, report Number of alarms and event results;

c) The alarm method should support at least one of mail alarm, SNMP trap alarm, sound and light alarm, and SMS alarm.

6.4.2.2 Treatment measures

IPv6 network audit products should be able to take measures to deal with network events to ensure the security of the network and itself. The measures should include at least one of the following.

a) Support setting policies to block network events. The policy should include at least one of the following. event level, event analysis results, and customize;

b) Support for calling predefined operations or applications by authorized administrators;

c) Link with other network products.

6.4.2.3 Fragmented Packet Processing

IPv6 network audit products should be able to audit communication methods used to evade monitoring (such as fragmented packet communication methods).

6.4.3 Audit results

6.4.3.1 Audit records

IPv6 network audit products should be able to generate audit records from the audit results of collected and restored information.

6.4.3.2 Audit review

IPv6 network audit products can provide audit result review functions to meet the following requirements.

a) Only authorized users have access to audit results;

b) tools for reviewing audit results should be provided;

c) queries should be provided based on time frames;

d) inquiry based on application type should be provided;

e) Auditing shall be provided based on conditions such as recording time, source IP address, source port, destination IP address, destination port or protocol type.

Tools for querying and sorting records;

f) The audit log should be provided based on conditions such as date and time, subject identity, event type, and related event success or failure.

Query and sorting tools.

6.4.3.3 Statistical report

IPv6 network audit products can generate statistical reports. The reports should include the following functions.

a) Should support the generation of statistical reports based on conditions, the generation conditions should include. keywords, module functions, event levels, custom formats and other generation methods;

b) Two description methods. text and graphic information should be supported;

c) Support report export, support at least one of HTML, PDF, WORD, EXCEL format.

6.5 Management control requirements

6.5.1 Graphical interface

IPv6 network audit products should provide a graphical interface to manage the configuration.

6.5.2 Development Interface

IPv6 network audit products should provide at least one standard, open interface, which can be used for other information security products according to the specifications of the interface.

Write appropriate program modules to share information or standardize linkages.

6.6 Identification and identification

6.6.1 User Identification

6.6.1.1 Unique identification

IPv6 network audit products should ensure that any user has a globally unique identity.

6.6.1.2 Attribute Definition

IPv6 network audit products should specify the security attributes associated with each role.

6.6.1.3 Property Initialization

IPv6 network audit products should provide the ability to initialize the attributes of each role created with default values.

6.6.2 Identity authentication

6.6.2.1 Basic authentication

IPv6 network audit products should authenticate users before performing any functions related to authorized users.

6.6.2.2 Authentication data protection

IPv6 network audit products should ensure that the authentication data is not unauthorized access or modification.

6.6.2.3 Basic treatment of authentication failure

IPv6 network audit products should be able to terminate the user's session establishment process after the maximum number of failed authentication attempts.

6.6.2.4 Timeout lock or logout

The product should have a login timeout lock or logout function, which can lock or terminate the conference without any operation within a set period of time.

Then, you need to perform identity authentication again to restart the operation. The maximum timeout period is only set by the authorized administrator.

6.7 Audit logs

6.7.1 Audit log generation

IPv6 network audit products generate audit logs for the following events.

a) Administrator login events, including success and failure;

b) changes to security policies;

c) backup and deletion of log records;

d) add, delete and modify the security role;

e) other actions of the administrator;

f) The date, time, user identification, event description and result of each event shall be recorded in each audit log. If IPv6 network the network audit product provides remote management functions. It should also record the address of the remote login host.

6.7.2 Log Management

IPv6 network audit products can provide log management functions to meet the following requirements.

a) Only authorized users are allowed to access the log;

b) The condition query function should be provided. The query conditions should include date, time, and event subject.

6.8 Security Management

6.8.1 Time consistency

IPv6 network audit products should maintain the consistency of the recording time between various components.

6.8.2 Central Management

If IPv6 network audit products are deployed in a distributed manner, they should be able to centrally customize collection policies and distribute them to the corresponding collection probes.

6.8.3 Condition monitoring

IPv6 network audit products should be able to detect their own operating status, including. CPU, memory, storage space, etc. If the product consists of multiple components the composition should be able to detect the operating status of each component.

6.8.4 Confidential transmission

IPv6 network audit products can ensure the confidentiality of data during transmission and meet the following requirements.

a) If the product adopts remote management method, it should ensure the encrypted transmission of remote management data;

b) If the product consists of multiple components, the network audit records transmitted between the components and their own audit logs should be encrypted for transmission;

c) If the product consists of multiple components, it shall be ensured that the identity authentication function is added between each component.

6.9 Data storage

6.9.1 Storage media

IPv6 network audit products should store audit records in non-volatile storage media during power failure.

6.9.2 Data deletion

IPv6 network audit products should be able to provide the deletion of audit information based on user rights and meet the following requirements.

a) It should be able to record the basic information of the deletion, including the date and time, the operator, and the description of the deletion;

b) Ability to set policies to automatically delete data that exceeds the storage time limit.

6.9.3 Backup and recovery

IPv6 network audit products should provide audit record backup and recovery functions.

6.9.4 Storage space exhaustion

IPv6 network audit products provide data storage space exhaustion processing functions to meet the following requirements.

a) It should be possible to develop a strategy that specifically addresses the situation when audit storage approaches the maximum storage space. (E.g. Provide at least a threshold Value alarm information to notify the user);

b) should be able to provide hardware support and develop a strategy to ensure that data is stored for at least 6 months

c) It should be possible to take certain measures (such as. rollback, dump, delete oldest records, etc.) to prevent updated audit records before space is exhausted Recording is lost.

6.9.5 Database Support

IPv6 network audit products should store audit records and their own audit logs in databases.

6.9.6 Data Integrity Authentication

IPv6 network audit products should be able to provide stored data integrity protection functions to prevent stored audit records from being tampered with.

6.9.7 Secure storage

IPv6 network products should store audit logs confidentially.

7.1 Access method

IPv6 network audit products should be able to support multiple deployments, including access to the network in series or parallel.

7.2 IPv6 protocol consistency

IPv6 network audit products should design and develop network protocol stacks based on IPv6 standards.

7.3 IPv6 Application Environment Adaptability

IPv6 network audit products should support at least one of multiple IPv6 application environments such as pure IPv6, IPv6/IPv4 dual stack, and IPv6/IPv4 transition.

surroundings.

7.4 IPv6 Management Environment Adaptability

IPv6 network audit products should be able to be used in at least one kind of environment in multiple IPv6 environments such as pure IPv6, IPv6/IPv4 dual stack, IPv6/IPv4 transition, etc.

Environment management.

8.1 Processing capacity

IPv6 network audit products should support 10 Gigabit network environment and support no less than 20Gbps load.

8.2 Network Impact

IPv6 network audit products should not have a significant impact on normal network communication during operation.

9.1 Development

9.1.1 Security Architecture

The developer should provide a description of the security architecture of the product's security functions. The description of the security architecture should meet the following requirements.

a) Consistent with the level of abstract description of security functions implemented in the product design document;

b) describe the security domain of the product security function consistent with the requirements of the security function;

c) describe why the product safety function initialization process is safe;

d) confirm that product safety functions can be prevented from being compromised;

e) Verify that product safety functions prevent safety features from being bypassed.

9.1.2 Functional Specifications

Developers should provide complete functional specifications, which should meet the following requirements.

a) fully describe the safety functions of the product;

b) describe the purpose and use of all safety function interfaces;

c) identify and describe all ...