GB/T 33134-2023Information security technology—Security requirement of public domain name service system (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules for Standardization Documents" drafting.

This document replaces GB/T 33134-2016 "Information Security Technology Public Domain Name Service System Security Requirements". Compared with GB/T 33134-2016, in addition to structural adjustments and editorial changes, the main technical changes are as follows:

a) Added the terms "namespace" and "public domain name service system" (see 3.1, 3.11);

b) Deleted the explanatory content of Figure 1 (see Chapter 5, 4.1 of the 2016 edition);

c) The security requirements for the deployment of important DNS infrastructure and the public domain name service system of important government websites have been added (see Chapter 5, 4.2 of the 2016 edition);

d) The protocol requirements have been changed (see 6.1.1, 6.2.1, 5.1.1, 5.2.1 of the 2016 edition);

e) Added system security requirements and analysis security requirements for authoritative servers (see 6.1.3);

f) Added security requirements for recursive server and client connections (see 6.2.3);

g) Added system security requirements and parsing security requirements for recursive servers (see 6.2.4);

h) Changed the regulations on access control of external services (see 7.7.1, 6.7.1 of the 2016 edition);

i) Added security requirements for important DNS infrastructure deployment (see A.1 in Appendix A);

j) The security requirements for the public domain name service system of important government websites have been added (see A.2 in Appendix A).

1 Scope

This document specifies the security technical requirements and security management requirements of the public domain name service system.

This document is applicable to the operation and management of public domain name service systems at all levels.

2 Normative references

The contents of the following documents constitute the essential provisions of this document through normative references in the text. Among them, dated references For documents, only the version corresponding to the date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to this document.

YD/T 2052-2015 Domain Name System Security Protection Requirements

YD/T 2137 Domain Name System Recursive Server Operation Technical Requirements

YD/T 2138 Domain Name System Authoritative Server Operation Technical Requirements

YD/T 2142 General Technical Requirements for Chinese Domain Names Based on International Multilingual Domain Name System

YD/T 2143 Technical Requirements for Coding and Processing of Chinese Domain Names Based on the International Multilingual Domain Name System

YD/T 2438 Requirements for Chinese domain name registration word list based on international multilingual domain name system

IETF RFC 8310 Usage of TLS-based DNS and DTLS-based DNS

3 Terms and Definitions

The following terms and definitions apply to this document.