GB/T 25068.6-2025Information technology - Security techniques - Network security - Part 6: Securing wireless IP network access (English PDF)

Foreword

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part 1: Structure and Drafting Rules of Standardization Documents".

Drafting.

This document is Part 6 of GB/T 25068 "Information Technology Security Technology - Network Security". GB/T 25068 has been published.

The following section.

---Part 1: Overview and Concepts;

---Part 2: Guidelines for Cybersecurity Design and Implementation;

---Part 3: Threats, Design Techniques, and Controls for Network Access Scenarios;

---Part 4: Security Protection for Internet Communication Using Security Gateways;

---Part 5: Security Protection for Cross-Network Communication Using Virtual Private Networks;

---Part 6: Wireless Network Access Security;

---Part 7: Network Virtualization Security.

This document is modified to adopt ISO/IEC 27033-6:2016 "Information technology security techniques - Network security - Part 6: Wireless networks" Access security.

This document has undergone the following structural adjustments compared to ISO/IEC 27033-6:2016.

---Chapter 5 of ISO/IEC 27033-6:2016 has been deleted;

---Chapter 5 corresponds to Chapter 6 of ISO/IEC 27033-6:2016, where 5.1 and 5.2 are derived from ISO/IEC 27033-6:2016.

The content of Chapter 6 was broken down and organized;

Annex A of ISO/IEC 27033-6:2016 has been deleted.

The technical differences between this document and ISO/IEC 27033-6:2016, and the reasons therefor, are as follows.

---Added normative reference to GB/T 25069 (see Chapter 3), and removed the terms "wireless access point," "wireless base station," and "Bluetooth." "Home base station", "machine-to-machine", "power ratio", "wireless access network", "wireless network controller", "wireless network", "wireless ad hoc" "Wireless networks" and "wireless hotspots" (see ISO/IEC 27033-6:2016, 3.1-3.3, 3.5, 3.7-3.12) should be used to adapt to my country's national conditions and...

Chinese context;

---The description of wireless communication networks has been revised (see 5.1) to conform to the current state of technological development in my country and the needs of practical application scenarios;

---Changes were made to the WLAN-related technical aspects of the security design, including the addition of a WAPI security mechanism and modifications to the confidentiality and integrity protocols.

The document also outlines the security configuration of WLAN devices (see 9.2) to adapt to the published mandatory national standards and my country's national conditions;

---The Bluetooth-related technical content in the security design has been modified (see 9.4) to conform to the standardized document writing specifications in the Chinese context, adding...

Highly readable.

The following editorial changes have been made to this document;

---The abbreviations "AES", "BYOD", "3GPP", "CCM", "PEAP-GTC", "SIG", "TTLS", and "UEA1" have been removed.

The terms "WRAN" and "WWAN" have been expanded to include "2FA", "4G", "5G", "Ad-hoc", "RAP", and "WAP3" (see Chapter 4) to better suit various needs.

my country's national conditions;

---Packet sniffing (see 7.3 of ISO/IEC 27033-6:2016) and authentication (see ISO/IEC 27033-6:2016) have been removed.

The examples in section 8.5) are used to enhance the document's conciseness and readability;

---The headings of clauses 9.1, 9.5.1, and 10.1 in ISO/IEC 27033-6:2016 have been changed to conform to the standardization document formatting requirements in the Chinese context.

Write guidelines to enhance readability.

Please note that some content in this document may involve patents. The issuing organization of this document assumes no responsibility for identifying patents.

This document was proposed and is under the jurisdiction of the National Cybersecurity Standardization Technical Committee (SAC/TC260).

Introduction

The purpose of GB/T 25068 is to provide detailed guidance on security aspects for the management, operation, use, and interconnection of information system networks.

This standard is designed to facilitate the adoption of security-related personnel (e.g., cybersecurity personnel) within an organization to meet their specific needs. It consists of seven parts, each...

The main objectives are as follows.

---Part 1: Overview and Concepts. Defines and describes concepts related to cybersecurity and provides management guidance.

---Part 2: Guidelines for Cybersecurity Design and Implementation. Provides organizations with guidance on how to plan, design, and implement high-quality cybersecurity architectures.

Provide guidance.

---Part 3: Threats, Design Techniques, and Controls for Network Access Scenarios. This section lists specific threats, design techniques, and controls relevant to typical network access scenarios.

Body risk, design technology and control.

---Part 4: Security Protection for Internet Communication Using Security Gateways. Provides guidance on implementing, operating, monitoring, and auditing networks using security gateways.

Guidelines on safety control related issues.

---Part 5: Security Protection for Cross-Network Communication Using Virtual Private Networks. Defines the procedures for establishing secure connections using Virtual Private Networks.

Specific risks, design technologies, and control elements.

---Part 6: Wireless Network Access Security. Defines the specific risks, design techniques, and controls for secure communication using wireless networks.

Control elements provide guidance for selecting, implementing, and monitoring the technical controls necessary for secure communications using wireless networks, applicable to all personnel involved in the detailed planning, design, and implementation of wireless network security.

---Part 7: Network Virtualization Security. Identifying network virtualization security risks and providing solutions for the secure implementation of network virtualization.

Guidelines.

It should be emphasized that GB/T 25068 provides more detailed implementation guidelines for network security controls, while GB/T 22081 addresses the aforementioned network...

The network security control has been described in a basic standardized manner.

Unless otherwise stated, this document applies to current or planned networks, but will be referred to only as "network" or "this network".

Information technology security technology network security Part 6: Wireless Network Access Security

1 Scope

This document describes the security threats, security requirements, security controls, and security design related to wireless network access security.

This document applies to the review or selection of technical security architectures involving wireless networks, and, based on compliance with GB/T 25068.2, provides for the protection of...

Provide technical selection, implementation, and oversight guidance to users responsible for implementing and maintaining wireless network security.

2 Normative references

The contents of the following documents, through normative references within the text, constitute essential provisions of this document. Dated citations are not included.

For references to documents, only the version corresponding to that date applies to this document; for undated references, the latest version (including all amendments) applies.

This document.

GB/T 25068.1 Information technology security technology - Cybersecurity - Part 1: Overview and concepts (ISO/IEC 27033-1.

2015, IDT)

GB/T 25068.2 Information Technology Security Technology - Cybersecurity - Part 2: Guidelines for the Design and Implementation of Cybersecurity (ISO/IEC) 27033-2.2012, IDT) GB/T 25069 Information Security Technical Terminology GB/T 29246 Information Security Technology. Overview and Glossary of Information Security Management Systems (ISO/IEC 27000:2018, IDT)

3 Terms and Definitions

The terms and definitions defined in GB/T 25068.1, GB/T 25069, and GB/T 29246, as well as the following terms and definitions, apply to this document.

core network

A component of a mobile communication network used to connect an access network to a wide area communication network.

hardening

The process of improving security by reducing the system's exposed surface.

Note. Hardening typically involves removing unnecessary software, usernames, or login permissions, as well as disabling or removing non-essential services.

4 Abbreviations

The following abbreviations apply to this document.

AAA. Authentication, Authorization, and Accounting