GB/T 38626-2020Information security technology—Guide to password protection for intelligent connected device (English PDF)

3.1 Intelligent connected device

A device with the ability to access the network for communication, data perception, data storage, data processing and human-computer interaction.

Note: Mainly refers to the end devices in the Internet of Things, including web cameras, smart home appliances, network set-top boxes, smart projectors, home routers, etc., excluding computers, mobile phones and other general computing devices. encryption function, which can be used to calculate password authentication data. [GB/T 25069-2010, definition 2.2.2.186]

7.1 Password generation

Matters of concern include:

a) The automatically generated password is random, and the length is not less than 6 characters.

b) The basic policy content that the password set by the user complies with is as follows:

1) The password length is not less than 8 characters;

2) The maximum allowed length of the password is not less than 64 characters;

3) The password contains at least two types of characters among numbers, lowercase letters, uppercase letters, special characters.

c) For intelligent connected devices that use the activation mechanism in exit-factory configuration, when the user accesses the device for the first time, it needs to activate the device by setting a password for the device. Inactive devices refuse to operate other than activation.

Note: "Activation" means that the user sets a password that meets the password complexity requirements when the device is used for the first time.

d) For the intelligent networked devices that use the initial password in the exit-factory configuration, the initial password is randomly generated for each device; the user is reminded to modify the password every time they log in, until the initial password is modified.

7.2 Password usage

Matters of concern include:

a) Password transmission adopts secure transmission channel or encrypted transmission;

b) By default, the password in the input box is hidden-displayed;

c) The function that prohibits the password from being copied from the input box;

d) The user cannot view his password after successfully logging in;

e) The password authentication process has the function of preventing brute force cracking. If the wrong login attempts exceed the set number of times, the operating account is locked, or the IP is operated for a period of time.

7.3 Password management

Matters of concern include:

a) All passwords can be modified; hard-coded passwords cannot be used;

b) Before the user changes the password, provide the function of verifying the old password and reconfirming the new password;

c) Encryption is required when storing passwords;

d) The stored password has an anti-cracking mechanism, including but not limited to salt;

e) Restrict access to and modification of password files, including but not limited to using the access control function of the operating system;

f) Cannot read the password plaintext through the user interface or API;

g) Provide the function of restoring the device to the exit-factory state through physical buttons or other security methods when the account or password is forgotten;

h) The password complexity strategy is configurable, allowing administrators to configure enhanced password complexity strategies according to application scenarios;

i) Have the ability to display the security strength of the password.

7.4 Log

All users' operations on passwords are recorded in logs. The contents of the logs include user ID, IP address, operation time, operation content, operation result and other information.