GA/T 1788.2-2021Security technical requirements for video and image information system for public security - Part 2: Front-end device (English PDF)

3.1 Terms and definitions

The terms and definitions defined in GB/T 28181-2016, GB/T 20271, GB 35114-2017,

GA/T 1788.1-2021 apply to this document.

3.2 Abbreviations

The following abbreviations apply to this document.

HTTP: Hyper Text Transfer Protocol

IP: Internet Protocol

MAC: Media Access Control

OTA: Over the Air

SIM: Subscriber Identify Module

SSH: Secure Shell

SSID: Service Set Identifier

TLS: Transport Layer Security

WEP: Wired Equivalent Privacy

WIFI: Wireless Fidelity

WLAN: Wireless Local Area Network

WPA: Wi-Fi Protected Access)

WPS: Wi-Fi Protect Setup

WSSE: Web Service Security

5.3.2 Authentication failure processing

5.3.2.1 After the front-end device fails to authenticate 5 times in a row, it shall lock the account for no less than 5min. It can support the setting of consecutive authentication failure times and lock time.

5.3.2.2 After the account of the front-end device is locked, it can be unlocked through at least one or more methods, such as unlocking by a user with higher authority.

5.3.3 Timeout processing

5.3.3.1 The communication session shall support setting the maximum timeout period.

If the timeout period can be modified, it shall only be set by authorized users.

5.3.3.2 If the communication session does not perform any operations within the

maximum timeout period, the session shall be terminated. Identity verification shall be performed when operating again.

5.4 Access control

5.4.1 The default account shall be renamed or deleted on first login. For default accounts that cannot be deleted, their default passwords shall be modified.

5.4.2 Collection devices shall support the use of special tools to set management account passwords centrally and uniformly.

5.4.3 It shall support deletion or deactivation of redundant, expired accounts. Sharing accounts is prohibited.

5.4.4 It shall support granting the minimum permissions required by management users, so as to realize the separation of permissions for management users.

5.4.5 The granularity of access control shall at least include attributes such as IP/MAC.

5.4.6 It shall support setting the maximum number of sessions.

5.4.7 Unauthorized users shall be prohibited from accessing system files of the operating system.

5.4.8 Unauthorized users shall be prohibited from configuring or changing the software on the front-end device.

5.4.9 When the user accesses the front-end device through the public security video and image information system, the front-end device only receives protocol access based on

GB/T 28181-2016, GA/T 1400-2017 or GB 35114-2017.

5.4.10 When a user directly accesses the front-end device, the front-end device only

receives access from a specific IP address or based on peripheral equipment.

5.5 Intrusion prevention

5.5.1 It shall support following minimum installation requirements. Only necessary components and applications can be installed.

5.5.2 It shall support closing unnecessary system services, default shares, and high-risk ports.

5.5.3 Vulnerability patching by means of version upgrades shall be supported.

5.5.4 It shall support the use of SSH, TLS and other security protocols for business access and remote management.

5.5.5 It shall support upgrades through upgrade packages verified by digital signatures.

5.5.6 It shall have the ability to detect events such as signaling verification failures and record logs or alarm prompts.

5.5.7 It shall support monitoring of system files. Conduct virus detection for newly added or modified files. It can scan and kill malicious virus files.

5.5.8 The wireless front-end device shall support access authentication function. Do not use WEP for authentication.

5.5.9 The wireless front-end device shall disable the WPA function by default.

5.5.10 The wireless front-end device shall be able to detect the open status of high-risk functions such as SSID broadcast and WPS. SSID broadcast is disabled by default.

5.6 Data security

5.6.1 The front-end device shall ensure that user data cannot be queried, modified and deleted by unauthorized users.

......