GA/T 686-2018Information security technology--Security technical requirements for virtual private network products (English PDF)

Foreword

This standard was drafted in accordance with the rules given in GB/T 1.1-2009.

This standard replaces GA/T 686-2007 "Information Security Technology Virtual Private Network Security Technical Requirements", and GA/T 686-2007 the main changes are as follows.

--- Removed the requirement for marking (see 5.4 of the 2007 edition);

--- Removed the requirement for residual information protection (see 5.10 of the 2007 edition);

--- Removed the requirements for covert channel analysis (see 5.11 of the 2007 edition);

--- Removed the requirement for a trusted path (see 5.12 of the 2007 version);

---Modified standard name;

---Modified the definition of virtual private network (see 3.1, 3.1.1 of 2007 edition);

---Modified security requirements (see Chapter 8, Chapter 6 of the 2007 edition);

--- Increased access control requirements (see 7.3);

--- Increased tunnel establishment requirements (see 7.5);

--- Increased NAT traversal requirements (see 7.6);

--- Increased the adaptability requirements of the IPv6 environment (see 7.8);

--- Increased user definition (see 3.4);

--- Revised the leveling requirements, the level is divided into two levels. basic level and enhanced level (see 9.2, 9.3, 2007 version of A.2).

This standard was proposed by the Network Security Bureau of the Ministry of Public Security.

This standard is under the jurisdiction of the Information System Security Standardization Technical Committee of the Ministry of Public Security.

This standard was drafted. Ministry of Public Security Computer Information System Security Product Quality Supervision and Inspection Center, the Third Institute of the Ministry of Public Security.

1 Scope

This standard specifies the security functional requirements, security requirements and classification requirements for virtual private network products.

This standard applies to the design, development and testing of virtual private network products.

2 Normative references

The following documents are indispensable for the application of this document. For dated references, only dated versions apply to this article.

Pieces. For undated references, the latest edition (including all amendments) applies to this document.

GB/T 18336.3-2015 Information technology security technology information technology security assessment criteria GB/T 25069-2010 Information Security Technology Terminology

3 Terms and definitions

The following terms and definitions as defined in GB/T 18336.3-2015 and GB/T 25069-2010 apply to this document.

Virtual private network A technique for establishing a private network on a public network. VPN is established between devices on a public, untrusted communication infrastructure A secure communication channel to protect the security of data transmitted between two communicating entities. Secure communication channel by using encryption, digital signature, and reference Security mechanisms such as authentication,, and access control are established.

Tunnel

Encapsulation for the transport protocol, embedding the original information to be transmitted at the beginning of the tunnel into the packet of the target protocol after encapsulation processing Internally, thus transmitting normally in a network that supports the target protocol. At the end of the tunnel, extract the original information from the encapsulated packet and complete Normal communication at both ends of the tunnel.

Internet protocol security A set of standards proposed by the IETF's IPSec working group to introduce security mechanisms into TCP/IP networks is a set of open networks.

A general term for security protocols. IPSec provides security services such as integrity, authentication, and confidentiality. There are two main ways of working. tunnel mode and Transfer mode.

4 Abbreviations

The following abbreviations apply to this document.

IETF. Internet Engineering Task Force (InternetEngineeringTaskForce) IPSec. Internet Protocol Security (InternetProtocolSecurity) IPv6. Internet Protocol Version 6 (InternetProtocolVersion6)