GB/T 30290.3-2025BeiDou satellite positioning vehicle information service system (VISS) - Part 3: Information security specification (English PDF)

1 Scope

GB/T 30290.3-2025 is the Chinese national standard covering securing a fleet tracking system - the authentication of terminal and centre, the encryption of the link and of the stored track history, the key management across thousands of vehicles, the access control, and the protection of what is personal location data. Part 3 of the series. It replaces GB/T 30290.3-2013, in force from 1 February 2026. Issued on 5 October 2025, it has been in force since 1 February 2026, replacing GB/T 30290.3-2013.

This document provides a reference model for the information security system in the BeiDou satellite positioning vehicle information service system, and specifies the corresponding security mechanisms. Safety procedures and safety technical requirements. This document applies to applications using BeiDou satellite positioning technology, employing public or dedicated mobile communication networks, and possessing vehicle information. The information security design, construction, and application of communication services in the service center's information processing system. This involves using other positioning technologies and other communication methods. This reference is used for the information security design, construction, and application of communication services in networks and information processing systems with vehicle information service centers.

2 Normative references

The contents of the following documents, through normative references within the text, constitute essential provisions of this document. Dated citations are not included. For references to documents, only the version corresponding to that date applies to this document; for undated references, the latest version (including all amendments) applies. This document.

GB/T 20518 Information Security Technology - Public Key Infrastructure - Digital Certificate Format

GB/T 22239-2019 Information Security Technology - Basic Requirements for Network Security Level Protection

GB/T 30290.1 Beidou Satellite Positioning Vehicle Information Service System - Part

3 Terms and Definitions

The terms and definitions defined in GB/T 30290.1 and GB/T 30290.2-2025, as well as the following terms and definitions, apply to this document.

3.1 Access control A means to ensure that the resources of a data processing system can only be accessed by authorized entities in an authorized manner. [Source: GB/T 25069-2022, 3.147]

3.2 Device authentication The process of verifying the identity of a device and granting it permission or authorization to access system resources.

3.3 Information security The satellite positioning vehicle information service system enables device authentication and data transmission protection for in-vehicle terminals and vehicle information service centers.

18 Reference 19

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part

1.Structure and Drafting Rules of Standardization Documents". Drafting. This document is Part 3 of GB/T 30290 "BeiDou Satellite Positioning Vehicle Information Service System". GB/T 30290 has been published. The following section.

1.Functional Description;

2.Information Exchange Protocol between Vehicle Terminal and Service Center;

3.Information Security Specifications;

4.Performance Requirements and Test Methods for Vehicle-Mounted Information Terminals;

5.Recorder Performance Requirements and Test Methods;

6.Performance requirements and test methods for emergency rescue terminals. This document replaces GB/T 30290.3-2013 "Satellite Positioning Vehicle Information Service System Part

3.Information Security Specification" and is consistent with... Compared with GB/T 30290.3-2013, apart from structural adjustments and editorial changes, the main technical changes are as follows:

a) The terminology for "access control," "confidentiality," "key," "cryptographic algorithm," "decryption," "device authentication," "encryption," and "integrity" has been changed. and definitions (see 3.1, 3.5, 3.8, 3.12, 3.14, 3.2, 3.13, 3.6, and 3.1, 3.2, 3.3, 3.4, 3.5, 3.6,

3.7 of the.2013 edition). 3.8);

b) Added the terms "information security", "information security system", "availability", "key negotiation", "public key", "private key", "digital signature", and "cryptography". "Suite", "Pre-Master Key", "Master Key" and "Working Key" and their definitions (see 3.3, 3.4, 3.7, 3.9, 3.10, 3.11, 3.15, 3.16,...) (3.17, 3.18, 3.19)

c) The terms "security and confidentiality mechanism" and "security model" and their definitions have been removed (see

3.10 in the.2013 edition);