GB/T 36470-2018Information security technology—Common security functional requirements for data acquisition and control field devices of industrial control systems (English PDF)

3.1 Industrial control system on-site measurement and control equipment

An independent physical device in the industrial control system that is located on site and has all or part of the following production-related functions.

--- Receive acquisition data from process equipment such as sensors, transmitters, regulators or switches;

--- Perform logic and control calculations;

--- Send control commands to process execution devices such as regulators or switches.

The device communicates with other similar devices, system masters or applications to collect digital and analog signals such as data and control commands.

See Appendix A for the function and composition of the on-site measurement and control equipment for typical industrial control systems.

Note: The following equipment is a typical industrial control system on-site measurement and control equipment.

--- Remote Terminal Unit (RTU, RemoteTerminalUnit);

---Intelligent Electronic Equipment (IED, Inteligent ElectricDevice);

---Distributed Processing Unit (DPU, Distributed Processing Unit).

3.2 Identification of authentication

In an information system, a user, process, or device authenticates its identity before accessing it. [NISTSP800-53R3]

3.3 Flooding

By attempting to provide input to a computing system or other data processing entity that is greater than its processing power, in an attempt to cause information security Faulty attack. [RFC2828]

5.1 Requirements class structure

Figure 1 illustrates in block diagram form the structure of the required class. Each requirement class includes a class name, a class description, and one or more requirement families.

Class names provide the information necessary to identify and classify different required classes. Each requirement class has a unique name, class classification information Consists of a shorthand of three characters. See Appendix B for a short description of the required class classification information. The short name of the class name is also used for the family name of the family. Fan Zhong.

The class description generally describes the families contained in the class and the main roles required by the class. Class descriptions use diagrams to describe the families in the class and in each family The hierarchy of components.

5.2 Requirements family structure

Figure 2 illustrates in block diagram form the structure of the claim family. Each requirement family includes a family name, a family description, and one or more components.

Family names provide the information necessary to identify and classify different families of requirements. Each claim family has a unique name, the classification information of the family It consists of shorthand for the class and shorthand for the three characters of the family name. A brief description of the classification information of the required family is given in Appendix B.

The family describes the general description of the family and the main role required by the family.

5.3 Requirements structure

Figure 3 illustrates in block diagram form the structure of the requirements. Each requirement includes the name of the request, the content of the request, the description of the request, zero or more Requirements to strengthen child and dependency requirements.

Request Name. Used to identify, classify, and classify different requirements. Each request has a unique name that indicates the purpose of the request. use The serial number identifies the location in the family.

Requirement. Describe the requirements and describe the conditions that the equipment should meet in order to meet the requirements.

Description of requirements. Describe the typical implementation mechanisms and technical principles required.

Requirement to strengthen. Requirement to strengthen the sub-item is to strengthen the strength of the requirements or increase the content, and use the serial number to identify the position within the requirements.

Dependency requirements. When a requirement item needs to depend on other requirements or be used in conjunction with other requirements, this The direct association of his claim is noted in this section. See Appendix C for details of the dependencies between requirements.

6.1 Overview

The general safety function requirements for on-site measurement and control equipment for industrial control systems are summarized in Appendix D.

6.2 FIA class. user identification and authentication

6.2.1 Class Description

The purpose of user identification and authentication is to determine the access actors (people, processes, and devices) of the device, and to perform access behaviors. control.

Depending on the number of devices and the level of intelligence, the device has multiple external access interfaces. Typical interfaces include.

--- Local operation panel for viewing or modifying the configuration;

---Local RS232 or RS485 interface for business data transmission or equipment debugging and management;

--- Network for equipment debugging, management and business data transmission.

Typical users accessing devices through these interfaces include, but are not limited to, the following.

---Manipulating personnel such as equipment use and configuration;

---Device configuration software;

--- System host computer application process.

6.2.2 FIA_IAM family. identification and authentication

6.2.2.1 Family Description

The device identifies and authenticates the user's identity as the most basic security protection for the device, as well as the implementation of rights allocation and access control. basis.

6.2.2.2 FIA_IAM.1 logo and method

6.2.2.2.1 Requirements

The industrial control system on-site measurement and control equipment should have the ability to identify users.

6.2.2.2.2 Description of requirements

Provide important users with identity, such as configuration management users, PC control processes, and so on. Typical user identity identifiers include Network address (such as physical address, IP address), user identifier of the controller, and so on.

6.2.2.2.3 Requirements for strengthening

The enhancements to the FIA_IAM.1 logo and method requirements include.

a) The device has the ability to identify users on all external interfaces;

b) The device has the ability to uniquely identify users on all external interfaces.

6.2.2.2.4 Dependency requirements

no.

6.2.2.3 Identification and method of FIA_IAM.2

6.2.2.3.1 Requirements

The industrial control system on-site measurement and control equipment should have the ability to identify the user's identity on the external interface.

6.2.2.3.2 Description of requirements

The device should authenticate the open network service interface and important local access users, such as configuration management users and remote access services.

Wait. Typical methods of identity authentication include. passwords, shared keys, digital certificates, and biometrics.

6.2.2.3.3 Requirement to strengthen

The requirements for FIA_IAM.2 identification and methods are enhanced to include.

a) The device performs two-factor authentication on the remote network access interface for users with control, parameter and fixed value modification functions;

b) The device performs two-factor authentication for users on all remote network access interfaces.

6.2.2.3.4 Dependency requirements

The dependency requirement for FIA_IAM.2 authentication and mode is FIA_IAM.1.

6.2.3 FIA_IDM family. identifier management

6.2.3.1 Family description

Industrial control system on-site measurement and control equipment can be used to identify the identity of users (people, processes and equipment) including network-level IP addresses, physical Address, TCP/UDP port, application address, or operator identifier.

The function of the user user identifier management is equivalent to the user management of the ordinary IT application system, and the direct use of the control panel pair The device is viewed or configured by the controller, and the management of the IP address, physical address, and port is described in Access Control.

6.2.3.2 FIA_IDM.1 Manipulator Identifier Management

6.2.3.2.1 Requirements

The industrial control system on-site measurement and control equipment should have the ability to assign identifiers to the operator.

6.2.3.2.2 Description of requirements

The device should have the ability to assign an identifier to a controller with access to the operating parameters or device configuration.

6.2.3.2.3 Requirements for strengthening

The enhanced requirements for FIA_IDM.1 Manipulator Identifier Management include.

a) The device supports the management of adding, deleting, etc. the operator identifier;

b) The device supports locking of the operator identifier that is not used by the security policy for a period of time.

6.2.3.2.4 Dependency requirements

The dependency requirement for FIA_IDM.1 Manipulator Identifier Management is FIA_IAM.1.

6.2.4 FIA_ACM family. authentication certificate management

6.2.4.1 Family description

The ability of the industrial control system on-site measurement and control equipment to manage user identity authentication credentials mainly includes the management of the strength and use of the authentication credentials.

Since the access method to the device may include local panel access, serial port access, network access, and upper computer application access, the authentication credential is Use and manage the identification that covers both the device layer and the network layer.

6.2.4.2 FIA_ACM.1 password modification

6.2.4.2.1 Requirements

The industrial control system on-site measurement and control equipment should support administrators and other control personnel to modify their management within the scope of normal operation.

Password. The device should support and prompt for modifications to the factory default password.

6.2.4.2.2 Description of requirements

It mainly manages the passwords of device controllers such as administrators, configuration viewers, and configuration users.

6.2.4.2.3 Requirements for strengthening

no.

6.2.4.2.4 Dependency requirements

The dependency requirement for FIA_ACM.1 password modification is FIA_IAM.2.

6.2.4.3 FIA_ACM.2 password replacement cycle

6.2.4.3.1 Requirements

The industrial control system on-site measurement and control equipment should support the password life cycle required in the security policy.

6.2.4.3.2 Description of requirements

After the operator has successfully verified, the on-site monitoring and control equipment of the industrial control system shall provide the necessary automatic reminding capability to notify the user of the last modification.

The password time has exceeded the password usage period required by the security policy.

6.2.4.3.3 Requirement to strengthen

The FIA_ACM.2 password replacement cycle requirement is enhanced so that the device should support the administrator to configure the password replacement cycle.

6.2.4.3.4 Dependency requirements

The dependency requirement for the FIA_ACM.2 password replacement cycle is FIA_IAM.2.

6.2.4.4 FIA_ACM.3 password strength control

6.2.4.4.1 Requirements

The industrial control system on-site measurement and control equipment should provide the ability to support the password strength requirements in the security policy.

6.2.4.4.2 Description of requirements

In the implementation, when the user sets the password strength insufficient, the on-site monitoring and control equipment of the industrial control system should automatically remind the user that the password strength should be satisfied. Kind of security strategy.

6.2.4.4.3 Requirement to strengthen

FIA_ACM.3 password strength control requirements are enforced to support the administrator's minimum password length, life cycle and letters Or configure the number of special characters.

6.2.4.4.4 Dependency requirements

The dependency requirement for FIA_ACM.3 password strength control is FIA_IAM.2.

6.2.4.5 FIA_ACM.4 password invalidation

6.2.4.5.1 Requirements

The device username/password authentication control should not be bypassed.

6.2.4.5.2 Description of requirements

Typical bypass mechanisms include, but are not limited to, the following mechanisms and techniques.

---Embedded master password

---The default admin rights for embedded chips to run automatically in the event of a hardware or software failure

---Password module or hardware bypass such as jumper and switch settings

Vendors should describe all mechanisms on the device that bypass user-created username/password authentication. If the device does not have such a mechanism, the factory The business should declare it.

6.2.4.5.3 Requirement to strengthen

no.

6.2.4.5.4 Dependency requirements

The dependency requirement for FIA_ACM.4 password invalidation is FIA_IAM.2.

6.2.4.6 FIA_ACM.5 certificate and public and private key management

6.2.4.6.1 Requirements

If a public or private key or certificate is used as the authentication mechanism, the industrial control system on-site monitoring and control equipment (and its configuration software) should provide the public and private keys. And the ability to manage certificates.

6.2.4.6.2 Description of requirements

When users use the configuration software to configure the industrial control system on-site measurement and control equipment, they often use certificates for identity authentication and configuration software.

It should be possible to manage the configuration user's public key and identify the certificate.

At the communication level, public and private keys can be used for communication between field measurement and control equipment and other equipment, remote configuration systems, monitoring background or host computers.

Identification. The device shall ensure the security of the local storage private key, and shall be able to correctly parse the certificate and enter the authenticity and validity of the certificate. Line verification.

6.2.4.6.3 Requirement to strengthen

The enhanced requirements for FIA_ACM.5 certificates and public and private key management include.

a) The on-site measurement and control equipment and its configuration software shall support the regular updating of the public and private keys in accordance with the requirements of the security policy;

b) Establish an effective public and private key management facility, such as a CA, at the industrial control system level.

6.2.4.6.4 Dependency requirements

The dependency requirement for FIA_ACM.5 certificate and public and private key management is FIA_IAM.2.

6.2.4.7 FIA_ACM.6 symmetric key management

6.2.4.7.1 Requirements

If a symmetric key is used as the authentication mechanism or the transmission data is encrypted, the on-site measurement and control equipment of the industrial control system should provide symmetric encryption. The ability to manage keys.

6.2.4.7.2 Description of requirements

Symmetric keys can be used for on-site measurement and control equipment and other equipment, monitoring background or host computer communication identity. Equipment should be able to guarantee this Secure the key and meet the key management strategy.

6.2.4.7.3 Requirement to strengthen

The enhanced requirements for FIA_ACM.6 symmetric key management include.

a) The on-site measurement and control equipment shall support the regular update of the symmetric key in accordance with the requirements of the security policy;

b) The on-site measurement and control equipment shall support the key management system at the industrial control system level, supporting the distribution, update and cancellation of keys. achieve.

6.2.4.7.4 Dependency requirements

The dependency requirement for FIA_ACM.6 symmetric key management is FIA_IAM.2.

6.2.4.8 FIA_ACM.7 password service is invalid

6.2.4.8.1 Requirements

If a password-based authentication mechanism is used, the on-site access of important users of the industrial control system on-site measurement and control equipment must not depend on external confidentiality. Code service.

6.2.4.8.2 Description of requirements

If an external password (such as encryption, key verification) service is not available, it may cause the measurement and control device to refuse service. Local important users access The key function should not rely on external authentication services. For remote access to critical functions, consider using them as appropriate.

6.2.4.8.3 Requirement to strengthen

no.

6.2.4.8.4 Dependency requirements