GA/T 1561-2019Mobile police information system - General technical requirements (English PDF)

3.1 Terms and definitions

The following terms and definitions apply to this document.

3.1.1

Mobile police information system A system for processing police information through a wireless network using a mobile terminal.

3.1.2

Mobile police serviceplatform Provide a supporting environment for mobile police applications to run services.

3.1.3

Mobile police terminal A wireless terminal device that processes police information in a mobile police system.

3.1.4

Advanced controlled mobile police terminal Mobile police terminal for security control from hardware and operating system.

3.1.5

General controlled mobile police terminal Mobile police terminal for security control from the application layer of the operating system.

3.1.6

Personal common mobile police terminal Mobile police terminal without special security control.

3.1.7

Service bus for mobile police application Middleware that provides resource services for mobile police applications and performs unified management and control of resources.

3.1.8

Centralized management and control center an information system for unified management, centralized monitoring, and security management of mobile police systems.

3.1.9

Security management and control system an information system that comprehensively controls and controls the security of users, terminals, networks, applications, and data in mobile police systems.

3.1.10

Mobile terminal security monitoring software Software that runs on mobile police terminals and has security monitoring functions such as monitoring information reporting, security policy configuration, and execution of control instructions.

3.2 Acronyms

The following abbreviations apply to this document.

IPSec. Internet Protocol Security PKI. Public Key Infrastructure VPN. Virtual Private Network

4.1 System composition

The mobile police system consists of mobile police terminals, wireless access networks, mobile police service platforms, mobile police applications, and security and centralized management.

Control composition, as shown in Figure 1.

Mobile police system Mobile police service terminal Mobile police service platform Mobile police application wireless access network Security and centralized management Personal ordinary terminal General controlled terminal Enhanced controlled terminal Mobile internet transport chain Wireless dedicated transmission link Mobile Internet Service Sub-platform (Class I area) Network service sub-platform (Class II area) Public Security Information Network Service Sub-platform (Type III area) Mobile Internet Service Sub-platform Application (Class I application) Network service sub-platform Application (Type II application) Public Security Information Network Service Sub-platform Application (type III application)

Figure 1 Composition of mobile police system

among them.

a) Mobile police terminal can be divided into personal ordinary terminal, general controlled terminal and enhanced controlled terminal;

b) The wireless access network can be divided into mobile Internet transmission links and wireless dedicated transmission links;

c) The mobile police service platform can be divided into mobile Internet service sub-platforms (type I area) and network service sub-platforms (type II area) and public security information network service sub-platform (type III area);

d) Mobile police applications can be divided into mobile police applications (type I applications) based on mobile Internet service sub-platforms, and network-based services Sub-platform mobile police application (type II application) and public security information network service sub-platform-based mobile police application (type III application);

e) Security and centralized management and control include password usage, cross-regional security protection, data security, management and control systems, and centralized management and control centers.

4.2 System Classification

4.2.1 Class I systems

Class I systems are controlled by personal ordinary terminals, mobile Internet transmission links, Class I areas, Class I applications and corresponding security and centralized management 组合。 Shi composition.

4.2.2 Type II system

Type II system consists of general controlled terminal/enhanced controlled terminal, wireless dedicated transmission link, type II area, type II application and corresponding security Composed of centralized control measures.

4.2.3 Type III system

Class III systems consist of enhanced controlled terminals, wireless dedicated transmission links, access control in class II areas, class III areas, class III applications, and corresponding Security and centralized control measures.

5.1 Mobile Police Terminal

5.1.1 Personal ordinary terminal

Personal ordinary terminals shall meet the following requirements.

a) Access to Class I areas and prohibit access to Class II and III areas;

b) The terminal operating system, application software, and application data have security protection capabilities.

5.1.2 General controlled terminal

General controlled terminals meet the following requirements.

a) Access to Class II areas and access to Class I and III areas is prohibited;

b) Security enhancements should be made to the terminal operating system, applications, network connections, peripheral interfaces, and user data;

c) Security software such as terminal security monitoring components should be installed;

d) cryptographic modules for soft/hard media should be installed;

e) Personnel and used certificates should be automatically associated through human-machine authentication and other methods.

5.1.3 Enhanced Controlled Terminal

Enhanced controlled terminals meet the following requirements.

a) Can be used in type II area or type III area, and prohibited to use in type I area;

b) Security enhancements should be made to terminal hardware, operating systems, applications, network connections, peripheral interfaces, and user data;

c) Security software such as terminal security monitoring components should be pre-installed;

d) cryptographic modules for hard media should be installed;

e) Personnel and used certificates should be automatically associated through human-machine authentication and other methods;

f) The terminal hardware and operating system should have a trusted computing environment.

5.2 Wireless access network

5.2.1 Mobile Internet Transmission Link

Mobile Internet transmission links should meet the following requirements.

a) Provide network channels for personal ordinary terminals to access Class I areas;

b) Provide network channels for obtaining Internet resources in Class I areas.

5.2.2 Wireless dedicated transmission link

The wireless dedicated transmission link should meet the following requirements.

a) Provide network channels for general controlled terminals to access type II areas;

b) provide network channels for enhanced controlled terminal access to type III areas;

c) Use virtual private network or physical private network for network isolation.

5.3 Mobile Police Service Platform

5.3.1 General requirements

The mobile police service platform meets the following requirements.

a) Provide access, security protection and security management and control services for mobile police terminals;

b) Have basic information identification functions, including but not limited to development resources, applications, users, institutions, terminals, services, etc.

c) Have application management release, including but not limited to registration, release, update, download, installation, uninstallation, etc .;

d) It has a mobile service bus, which provides functions such as registration, release, offline, and scheduling of resources and services.

Data should be exchanged between different areas of the same mobile police platform through the mobile service bus.

Certification or equivalent measures;

e) With authentication services, providing authentication functions for users, institutions, equipment, and applications, and the authentication technology adopted by Class I regional authentication services it can include, but is not limited to, digital identity certificates, passwords, biometric authentication, etc .; authentication techniques used by Type II and III regional authentication services the technique should be based on mobile police PKI digital identity certificates, supplemented by passwords, biometric authentication, etc .;

f) With authorization service, it provides authorization management and authentication functions for users, applications and resources;

g) With application monitoring services, it provides application behavior monitoring and usage evaluation functions for mobile applications.

5.3.2 Mobile Internet Service Sub-platform

Mobile Internet service sub-platform (Class I area) shall provide terminal access, Internet boundary protection, Class I regional application support, Class I Area security management and control functions.

5.3.3 Networked Services Sub-platform

The network service sub-platform (type II area) shall meet the following requirements.

a) Provide terminal access control, password basic services, type II regional application support, and type II regional security management and control;

b) The Internet service sub-platforms are interconnected based on the national e-government extranet or dedicated line using IPsecVPN technology, using identity recognition Authentication, access control, channel encryption and other measures to protect security and meet the relevant technical requirements of GB/T 21061;

c) It is forbidden to provide access channels of type II area and type III area for the same terminal at the same time;

d) Adopt protection measures such as access control and isolation exchange when sharing with other network resources.

5.3.4 Public Security Information Network Service Sub-platform

Public security information network service sub-platform (type III area) should provide mobile security access, password basic services, type III regional application support, and type III Functions such as regional security management and centralized management, mobile security access provides terminal access control, channel encryption, access control, and isolation exchange and other functions.

5.4 Mobile Police Application

Mobile police applications meet the following requirements.

a) The same application belongs to only one of the categories I, II, and III;

b) Cross-system deployment is prohibited. Class I applications should be deployed on Class I systems; Class II applications should be deployed on Class II systems; Class III applications should be deployed in class III systems;

c) The unified identification defined by the mobile police service platform shall be used, including but not limited to resources, applications, users, institutions, terminals, services Business, etc.

d) authentication and authorization services should be used to implement user identity authentication, single sign-on and application authentication;

e) that cross-platform and cross-region resources should be accessed through the mobile service bus;

f) Access to resources in this area should be through the mobile service bus.

5.5 Security and Centralized Control

5.5.1 Basic requirements

Meet the following requirements.

a) Class I and II systems shall meet the technical requirements of level two in GB/T 25070, and Class III systems shall meet the requirements of level 3 in GB/T 25070 Claim;

b) Security protection should meet the technical requirements of GB/T 29828 trusted computing;

c) Various systems should have the security protection functions shown in Table 1;

d) The centralized management and control center shall support hierarchical management and cascading;

e) The security management and control system should be deployed in Class I, II, and III areas, and the centralized control center should be deployed in Class III areas;

f) The regional security management and control system and the centralized management center at this level shall be connected through the mobile service bus.

Table 1 Security protection functions

No. Safety function I system II system III system Mobile policing terminal Computing environment Trusted defense - - -

2 Password

Module

Soft medium - * -

3 Hard media - * -

4 Brush protector - - -

5 Anti-cracking - - -