Valid

GB/T 20270-2006Information security technology Basis security techniques requirement for network (English PDF)

信息安全技术网络基础安全技术要求

Preview PDF

This is a limited preview

Buy now to download the full PDF (67 pages)

Need quotation for your management?

Get a formal quotation for GB/T 20270-2006 in 30 minutes.

Issued by

SAMR; SAC

Level / Type

National · Recommended

Issue date

May 31, 2006

Implementation date

December 1, 2006

Scope

GB/T 20270-2006 is the English-translated version of 信息安全技术网络基础安全技术要求.

This standard sets the basic security technique requirements that a network system must meet at each security grade, taking the division into five security protection grades of GB 17859-1999 and the role of the network system within an information system as its starting point.

Clause 1 applies it to the hierarchical design and realization of network systems and offers it for reference in the testing and management of network system security.

Clause 3 holds the terms, definitions and abbreviations, among the latter SSON for the security subsystem of a network and SSP for the SSON security policy.

Clause 4, Composition and Interrelationship of Network Security, sets that composition out in Table 1 according to the OSI reference model and to the security protection grades and security elements prescribed in GB 17859-1999.

Clause 5 states the basic requirements for the network security functions one by one: identity authentication, with user identification, user authentication and user-subject binding; discretionary access control, with its policy, its coverage and its granularity; the tag, including the subject tag and the output of information with a tag; mandatory access control; data flow control, which is to keep data of a high security grade from flowing to an area of low security grade; security audit, with the response to audit events and the generation of audit data; user data confidentiality, including the confidentiality of stored data; and the trusted path between the user and the security functions.

Clause 6 restates those functions as requirements at each grade and each layer, ending with a network security monitoring function in which distributed detectors set at the critical parts of the network environment collect security-related information for a network security monitoring center to gather and analyze.

Clause 7, Grading Requirements for Network Security Technology, works through the grades, naming grade 1 the user's discretionary protection grade, grade 2 the system audit protection grade and grade 3 the security tag protection grade, and splits each into security function requirements and security assurance requirements, the latter referring the self-protection, the design and realization and the security management of the security subsystem to the matching subclauses of GB/T 20271-2006.

Clause 2 cites GB 17859-1999 and GB/T 20271-2006, and the standard closes with an Appendix A and a Bibliography. The page shows no earlier edition; it was issued on May 31, 2006 and has applied since December 1, 2006.

Found what you need?

Document preview — GB/T 20270-2006

National Standard of the People's Republic of China

ICS: 35.040
Classification: L 80

Issued by: State Administration for Market Regulation; Standardization Administration of the PRC

Foreword5
Introduction6
1 Scope8
2 Normative References8
3 Terms, Definitions and Abbreviations8
4 Composition and Interrelationship of Network Security10
5 Basic Requirements for Network Security Function12
6 Requirements for Network Security Function at Each Grade and Layer21
7 Grading Requirements for Network Security Technology33
Appendix A62
Bibliography67

1 Scope

This Standard specifies basis security techniques requirements necessary for network system of every security grade according to the division of five security protection grades in GB 17859-1999 and the roles of network system in information system.

This Standard is applicable to design and realization of network system according to the requirements of hierarchy and for reference for testing and management of network system security as required.

2 Normative References

The provisions in the following documents, through reference in this Standard, constitute the provisions of this Standard. For dated reference, the subsequent amendments, excluding corrigendum, or revisions of these publications do not apply.

However, all parties who enter into an agreement according to this Standard are encouraged to study whether the latest editions of these documents are applicable.

For undated references, the latest edition of the normative document referred to applies.

GB 17859-1999 Classified Criteria for Security Protection of Computer Information System

GB/T 20271-2006 Information Security Technology Common Security Techniques Requirement for Information System

3 Terms, Definitions and Abbreviations

3.1 Terms and definitions

For the purpose of this Standard, the terms and definitions given in GB/T 17859-1999 AND the following ones apply.

3.2 Abbreviation

For the purpose of this Standard, the following abbreviations apply to this Standard.

SFP security function policy

SSC SSF scope of control

SSFSSON SSON security function

SSP SSON security policy

SSON security subsystem of network

4 Composition and Interrelationship of Network Security

According to OSI reference model and security protection grades and security element prescribed in GB 17859-1999, the composition and interrelationship of network security are detailed in Table 1.

5 Basic Requirements for Network Security Function

5.1 Identity Authentication

5.1.1 User Identification

5.1.2 User Authentication

5.1.3 User-Subject Binding

When another subject (such as progress) shall be activated for one identified and authenticated user so that SSF can complete a certain task under the SSON security function control range, the users shall be related to the subject by user - subject binding to correlate the user's identity to its all the auditable actions.

5.2 Discretionary Access Control

5.2.1 Access Control Policy

SSF shall design according to established discretionary access control security policy to control the operation between subject and object.

5.2.3 Scope of Access Control

Discretionary access control coverage in network system includes.

5.2.4 Granularity of Access Control

Granularity of discretionary access control in network system includes.

5.3 Tag

5.3.1 Subject Tag

Mandatory access control subject shall be designated with a sensitive tag which is a reference to execute mandatory access control. For example, sensitive tag for combination of grade classification and non-grade classification is a basis to execute multi-layer security model.

5.3.4 Output of Information with Tag

SSON shall indicate single stage or multiple stages for each communication channel and I/O equipment and any change of tag shall be realized by authorized users and permissibly audited by SSON. SSON shall maintain and be able to audit any change of security protection grades or make security audit for security protection grades involved with communication channel or I/O equipment.

5.4 Mandatory Access Control

5.5 Data Flow Control

In the network to realize data flow by way of data flow, the data flow control mechanism shall be adopted to realize the data flow control, in order to prevent data information with high security grade flowing to the area with low security grade.

5.6 Security Audit

5.6.1 Response of Security Audit

Security audit SSF shall respond to audit event in accordance with the following requirements. […]

5.6.2 Generation of Security Audit Data

SSF shall generate audit data in accordance with the following requirements. […]

5.8 User Data Confidentiality

5.8.1 Confidentiality of Storage Data

The user data stored in SSC shall be subjected to confidentiality protection.

5.9 Trusted Path

Trusted path between the users and SSF shall be as follows. […]

6 Requirements for Network Security Function at Each Grade and Layer

6.1 Identity Authentication Function

The identity authentication security mechanism shall be designed in accordance with the requirements of user identification and user authentication.

6.2 Discretionary Access Control Function

The required access control policy shall be selected in accordance with the requirements for access control policy and the required discretionary access control function shall be designed and achieved in accordance with the requirements for access control function.

6.3 Tag Function

The tag shall be designed in accordance with the requirements for subject tag and object tag.

6.11 Network Security Monitoring Function

Security monitoring function shall be provided for network system operation. Network security monitoring mechanism collect security-related information by setting distributed detector at each critical part of the network environment, and then network security monitoring center collect and analyze to find various violation behavior timely.

7 Grading Requirements for Network Security Technology

7.1 Grade 1.the User's Discretionary Protection Grade

7.1.1 Grade 1 Security Function Requirements

7.1.2.3 SSON security management

SSON security management of the user's discretionary protection grade of network system is realized according to the requirements of 6.1.6 in GB/T 20271-2006.

7.2 Grade 2.System Audit Protection Grade

7.2.1 Grade 2 Security Function Requirements

7.2.1.5 Session layer

7.2.1.6 Presentation layer

7.3 Grade 3.Security Tag Protection Grade

7.3.1 Grade 3 Security Function Requirements

7.5.2 Grade 5 Security Assurance Requirements

7.5.2.1 SSON self-security protection

a) SSF physical security protection. the physical security protection for SSF of access verification protection grade of network system shall be realized according to the requirements of 6.5.4.1 in GB/T 20271-2006;

b) SSF operation security protection. the operation security protection for SSF of access verification protection grade of network system shall be realized according to 6.5.4.2 in GB/T 20271-2006;

c) SSF data security protection. the data security protection for SSF of access verification protection grade of network system shall be realized according to the requirements of 6.5.4.3 in GB/T 20271-2006;

d) Resource utilization. the resource utilization of access verification protection grade of network system shall be realized according to the requirements of 6.5.4.4 in GB/T 20271-2006;

e) SSON access control. the SSON access control of access verification protection grade of network system shall be realized according to the requirements of 6.5.4.5 in GB/T 20271-2006.

7.5.2.2 SSON design and realization

7.5.2.3 SSON security management

SSON security management of access verification protection grade of network system shall be realized according to the requirements of 6.5.6 in GB/T 20271-2006. […]

......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 67 pages — is available in the English PDF.

Referenced standards

Normative references

Cited by

Similar standards

GB/T 18805-2026|GB/T 32915-2026|GB/T 42382.2-2026|GB/T 42382.3-2026|GB/T 47277-2026|GB/T 47312-2026

How to Download GB/T 20270-2006

1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.