GB/T 31505-2015[Replaced by GB/T 20281-2020] Information security technology -- Technique requirements and testing and evaluation approaches for host-based firewall and personal firewall (English PDF)

5.1 General description

5.1.1 Classification of security technical requirements

This standard divides the security technical requirements of host-based firewall

and personal firewall into two major categories.

5.1.2 Security level

This standard divides the level of security function requirements according to

the strength of the host-based firewall security function; divides the level of

security assurance requirements according to GB/T 18336.3-2008.

5.2 Basic level requirements

5.2.1 Security function requirements

5.2.1.2 Security policy revision

Products shall provide standardized security policies, which can be revised by

users.

5.2.1.3 Application network access control

The security function of the product shall be able to control the permission of

each application on the host to use the network; the control of the application's

access to the network shall include the following three methods.

5.2.1.5 Identity authentication

5.2.1.5.1 Basic authentication

Before performing any functions related to the administrator, the product shall

authenticate the user's identity.

5.2.1.5.2 Authentication failure handling

The product shall provide certain authentication failure handling measures, to

prevent violent code cracking.

The product shall have a security audit function; the specific technical

requirements are as follows.

5.2.2 Security assurance requirements

5.2.2.1 Configuration management

5.2.2.1.1 Version number

Developers shall provide unique identifiers for different versions of the product.

5.2.2.3 Development

5.2.2.3.1 Description of informal function specification

The developer shall provide a functional specification, which shall meet the

following requirements.

5.2.2.3.3 Informal correspondence verification

The developer shall provide a correspondence analysis between all adjacent

pairs of product security function representations.

For each adjacent pair represented by the product security function, the

analysis shall explain that all related security functions represented by relatively

abstract security functions shall be correctly and completely refined in the more

specific security function representation.

6.1 Test environment

The test environment is as shown in Figure 1.

6.2 Basic level test

6.2.1 Security function test

6.2.1.1 IP packet filtering

The test evaluation methods and expected results of IP packet filtering of host-

based firewall and personal firewall products are as follows.

6.2.1.3 Application network access control

The test evaluation methods and expected results of application network

access control of host-based firewall and personal firewall products are as

follows.

6.2.1.4 Intrusion prevention

The test evaluation methods and expected results of the intrusion prevention of

host-based firewall and personal firewall products are as follows.

6.2.1.5 Identity authentication

6.2.1.6 Security management

6.2.1.6.3 Remote management encryption

The test evaluation methods and expected results of remote management

encryption for host-based firewall and personal firewall products are as follows.

6.2.1.7 Security audit

The test evaluation methods and expected results of the security audit of host-

based firewall and personal firewall products are as follows.

6.2.2 Security assurance evaluation

6.2.2.1 Configuration management

6.2.2.1.1 Version number

The test evaluation methods and expected results of the version number are as

follows.

6.3.1.5 Intrusion prevention

The test evaluation methods and expected results of the intrusion prevention of

host-based firewall and personal firewall products are as follows.

6.3.2.7.1.2 Analysis confirmation

The test evaluation methods and expected results of analysis confirmation are

as follows.

6.3.2.7.2 Assessment of product security function strength

The test evaluation methods and expected results of the assessment of product

security function strength are as follows.

6.3.2.7.3 Vulnerability analysis

6.3.2.7.3.1 Developer vulnerability analysis

The test evaluation methods and expected results of developer vulnerability

analysis are as follows.

6.3.2.7.3.2 Independent vulnerability analysis

The test evaluation methods and expected results of the independent

vulnerability analysis are as follows.

6.3.2.7.3.3 Intermediate resistance

The test evaluation methods and expected results of intermediate resistance

are as follows.

......