GB/T 35787-2017Security technical requirement for the read-write equipment of electronic identification of motor vehicles (English PDF)

3.1 Security Module

Security module refers to a component, which is imbedded in the read-write equipment and provides the function of cryptographic operation to the read-write equipment.

5.3 Cryptographic Algorithm

Security module and PSAM card shall adopt cryptographic algorithm approved by national password management department.

5.4 Key Management

Key management shall comply with the following requirements.

a) The generation, input, storage, dispersion and usage of key shall comply with the requirement in GM/T 0035.5;

b) Key in the security module shall be managed by institutions authorized by public security organs;

c) Key in the PSAM card shall be managed by competent departments of application industries.

5.5 Confidentiality

5.5.1 Storage confidentiality

Storage confidentiality shall comply with the following requirements.

a) Sensitive information shall adopt cryptographic algorithm for encryption protection, so as to prevent unauthorized access;

b) Access permission information and keys shall be stored in the security module or the PSAM card;

c) Asymmetric algorithm private key and symmetric algorithm key shall not be readable.

5.5.2 Transmission confidentiality

SSL VPN technology, which complies with the requirement in GM/T 0024, should be adopted, so as to guarantee transmission confidentiality between the read-write equipment and the application system.

5.6 Integrity

Cryptography shall be adopted to verify sensitive information in the transmission between the read-write equipment and the application system, so as to find out information being tampered, deleted or interpolated.

5.7 Non-repudiation

Digital signature technology shall be adopted to implement non-repudiation between the read-write equipment and the application system. […]