GA/T 681-2018Information security technology--Security technical requirements for gateway (English PDF)

Foreword

This standard was drafted in accordance with the rules given in GB/T 1.1-2009.

This standard replaces GA/T 681-2007 "Information Security Technology Gateway Security Technical Requirements", compared with GA/T 681-2007 the technical changes are as follows.

--- Revised the leveling requirements, the level is divided into two levels. basic level and enhanced level (see Chapter 9, 2007, 9.2, 9.3 and A.2);

---Modified the "Access Control" function (see 7.3.4, 2007 version 7.3.4);

---Modified the "safety assurance requirements" (see Chapter 8, Chapter 8 of the 2007 edition);

--- Removed the "communication non-repudiation" function (see 7.4.1.6 of the 2007 version);

--- Removed the "Remaining Information Protection" function (see 7.4.1.7 of the 2007 version);

--- Removed the "hidden channel analysis" function (see 7.4.1.9 of the 2007 version);

--- Removed the "Trusted Path" function (see 7.4.1.10 of the 2007 version);

--- Added "address translation" function (see 7.3.1);

--- Added "route control" function (see 7.3.2);

--- Added "IP/MAC address binding" function (see 7.3.3);

--- Added "Connection Control" function (see 7.3.5);

--- Added "attack protection" feature (see 7.4).

This standard was proposed by the Network Security Bureau of the Ministry of Public Security.

This standard is under the jurisdiction of the Information System Security Standardization Technical Committee of the Ministry of Public Security.

This standard was drafted. Ministry of Public Security Computer Information System Security Product Quality Supervision and Inspection Center, the Third Institute of the Ministry of Public Security.

1 Scope

This standard specifies the security functional requirements, security requirements and classification requirements for gateway products.

This standard applies to the design, development and testing of gateway products. This standard does not apply to other gateways with well-defined and corresponding standards.

Type products (such as firewalls).

2 Normative references

The following documents are indispensable for the application of this document. For dated references, only dated versions apply to this article.

Pieces. For undated references, the latest edition (including all amendments) applies to this document.

GB/T 18336.3-2015 Information technology security technology information technology security assessment criteria GB/T 25069-2010 Information Security Technology Terminology

3 Terms and definitions

The following terms and definitions as defined in GB/T 18336.3-2015 and GB/T 25069-2010 apply to this document.

Gateway

Between a network or subnets, or between software applications in different security domains, one designed to protect against a given security policy Protect the network's products.

4 Abbreviations

The following abbreviations apply to this document.

NAT. Address Translation (NetworkAddressTransiation) SNAT. Source Address Translation (SourceNetworkAddressTransiation) DNAT. Destination Address Translation (DestinationNetworkAddressTransiation)

5 Gateway Description

A gateway is a networked device whose security purpose is to establish security control points between different network areas, according to predefined Access control policies and security protection policies, parsing and filtering data flows through the gateway to provide access control to protected network areas Service request.

Gateway-protected assets are network services and resources protected by security policies. In addition, the gateway itself and its internal important data are also Protected assets. The gateway generally divides the network into several network areas, and implements services between different network areas through security policies.

Audit and control of access.

Gateways are usually deployed between different network areas, acting as a level. All incoming and outgoing data needs to pass through the gateway.

Has a very important position. Figure 1 is a typical operating environment for a gateway. It divides the network into multiple network areas.