GB/T 35282-2023Information security technology - Security technology specifications of mobile e-government system (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1:1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules for Standardization Documents" drafting: This document replaces GB/T 35282-2017 "Information Security Technology E-Government Mobile Office System Security Technical Specifications", and Compared with GB/T 35282-2017, except for structural adjustment and editorial changes, the main technical changes are as follows:

---Changed the "Scope" chapter (see Chapter 1, Chapter 1 of the:2017 edition);

---Changed the definitions of terms such as mobile terminal, mobile terminal management, and mobile application management, and added government affairs data and mobile government affairs application Terms and definitions such as procedures (see Chapter 3, Chapter 3 of the:2017 edition);

---Changed the structure of the mobile access area and server in the "Basic Structure of E-government Mobile Office System" diagram, increasing system security Management (see Chapter 5, Chapter 5 of the:2017 edition);

--- Increased the relevant content of the main security risks of the e-government mobile office system, and changed the "Security of the e-government mobile office system" "Full Technology Framework" (see Chapter 5 and Appendix A, Chapter 5 of the:2017 edition);

---Changed the specific security technical requirements in mobile terminal security, mobile communication security, mobile access security, and server security (see Section Chapter 6, Chapter 7, Chapter 8, Chapter 9, Chapter 7, Chapter 8, Chapter 9, Chapter 10 of the:2017 edition);

--- Increased the chapter "System Security Management Requirements", and increased the relevant technical requirements for system office security monitoring (see Chapter 10);

---Added the chapter "Testing and Evaluation Methods", and proposed mobile terminal security, mobile communication security, mobile access security, server security The testing and evaluation methods of the overall and system safety management (see Chapter 11): This document is proposed and managed by the National Information Security Standardization Technical Committee (SAC/TC260): This document is drafted by: State Information Center, Beijing Bangbang Security Technology Co:, Ltd:, Shanghai Yinglian Information Technology Co:, Ltd:, Beijing Jingzhiyou Network Security Technology Co:, Ltd:, China Mobile Communications Group Co:, Ltd:, Huawei Technologies Co:, Ltd:, AsiaInfo Technology (Chengdu) Co:, Ltd:, Beijing Beixinyuan Software Co:, Ltd:, Tongzhi Weiye Software Co:, Ltd:, Hangzhou Ying Hi-Tech Co:, Ltd:, Shanghai Guanan Information Technology Co:, Ltd: Technology Co:, Ltd:, Xi'an Jiaotong University Jabil Network Technology Co:, Ltd:, Beijing Tianrongxin Network Security Technology Co:, Ltd:, Yuanxin Information Technology Group Co:, Ltd:, Beijing Jinshan Office Software Co:, Ltd:, China Academy of Information and Communications Technology, Fujian Provincial Economic Information Center, Zhongguancun:com Network Security and Information Industry Alliance, Sangfor Technology Co:, Ltd:, Jilin Information Security Evaluation Center, Xi'an University of Posts and Telecommunications, Wuhan Antiy Information Technology Co:, Ltd:, Shaanxi Provincial Network and Information Security Evaluation Center, Qi Anxin Wangshen Information Technology (Beijing) Co:, Ltd:, Zhengzhou Xinda Jiean Information Technology Co:, Ltd:, Shenyang Neusoft System Integration Engineering Co:, Ltd:, Shenzhen Haiyunan Network Security Technology Co:, Ltd: Company, New H3C Technology Co:, Ltd:, China Software Evaluation Center, China Trade Promotion Information Technology Co:, Ltd: The main drafters of this document: Liu Bei, Cheng Hao, Bao Lina, Xu Jin, Yan Guixun, Yuan Sen, Li Kun, Wu Aming, Han Yun, Zhao Haiyan, Huang Jing, Huang Min, Liao Shuangxiao, Jiang Guohui, Wang Yongqi, Sun Jianshan, He Tao, Liu Hao, Xie Jiang, He Jianfeng, Zhang Chao, Jiang Zhe, Zhang Shuling, Ning Hua, Liu Tao, Zhang Xiaosheng, Wang Ke, Yang Zhigang, Liu Zhanfeng, Zhang Yong, Chen Cheng, Tian Jiahao, Zhao Chunlei, Liang Songtao, Zhao Chunpeng, Xie Chaohai, Wan Xiaolan, Li Yutian, Zhao Tian: The release status of previous versions of this document and the documents it replaces are as follows:

---First published as GB/T 35282-2017 in:2017;

--- This is the first revision: Information Security Technology Security technical specification for e-government mobile office system

1 Scope

GB/T 35282-2023 covers the security of government mobile working systems. Letting officials handle government business on a phone breaks the assumption every earlier government security architecture rested on: that the work happens inside a controlled network, on a managed machine, in a building. A mobile device leaves all of that - it is carried into places nobody vetted, it connects over networks nobody controls, it is lost and stolen at a rate desktops are not, and it mixes personal and official use on the same hardware. The compensating controls have to sit at four distinct points, which is how this document is organised. It specifies the technical requirements for mobile terminal security, mobile communication security, mobile access security and server-side security in e-government mobile office systems, together with the requirements for the system as a whole. Treating access as its own layer is deliberate: the gateway that decides which device, which user and which application may reach the internal system is where most of the risk is actually managed. Under ICS 35.030 and CCS L80, it is written for government IT departments, for the vendors of mobile office platforms, and for the evaluators who certify them.

This document specifies the mobile terminal security, mobile communication security, mobile access security, and server security of the e-government mobile office system: And the technical requirements of each part, such as system safety management, etc:, and the test and evaluation methods are given: This document is applicable to the security design, construction implementation, security management and test evaluation of the e-government mobile office system:

2 Normative references

The contents of the following documents constitute the essential provisions of this document through normative references in the text: Among them, dated references For documents, only the version corresponding to the date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to this document:

GB/T 20279-2015 Information Security Technology Network and Terminal Isolation Product Security Technical Requirements

GB/T 22239-2019 Basic Requirements for Network Security Level Protection of Information Security Technology

GB/T 25069-2022 Information Security Technical Terminology

GB/T 28448-2019 Information Security Technology Network Security Level Protection Evaluation Requirements

GB/T 35281-2017 Information Security Technology Mobile Internet Application Server Security Technical Requirements

GB/T 37952-2019 Technical requirements for information security technology mobile terminal security management platform

GB/T 38636-2020 Information Security Technology Transport Layer Cryptography Protocol (TLCP)

GB/T 39786 Basic Requirements for Cryptography Application in Information Security Technology Information System

3 Terms and Definitions

The following terms and definitions defined in GB/T 25069-2022 apply to this document: 3:1 mobile terminalmobileterminal Mobile communication terminal products that are connected to the public mobile communication network, have an operating system, and can be installed and uninstalled by users themselves: [Source: GB/T 37952-2019, 3:1] 3:2 E-government mobile office system mobilee-governmentsystem Users use mobile terminals and mobile communication networks to access the e-government office system for mobile office information systems: 3:

3 For mobile terminals, it provides remote security control and management of the whole life cycle from registration, activation, use to disposal: 3:

4 For mobile application software, it provides security management for the whole process from distribution, installation, use, upgrade to uninstallation: 3:

5 Government data governmentdata Various data resources collected, generated, stored, and managed by government departments at all levels and their technical support units in accordance with the law in the course of performing their duties: [Source: GB/T 38664:1-2020, 3:1]