GB/T 38660-2020Identification system for internet of things—Security mechanism for Ecode identification system (English PDF)

3.1 Security Mechanism for Ecode Identification System

Security mechanism for Ecode identification system refers to a collection of assessment or certification of a nationally approved third-party institution.

5.3 Disaster Recovery Center

The Ecode identification system disaster recovery center should select a location with good geological conditions. The disaster recovery center shall adopt remote disaster recovery and should not be in the same earthquake zone as the main center.

5.4 Security Audit

Security audit shall include functions, such as: automatic response, data generation, audit analysis, review, event selection and event storage, etc. The audit log content shall include the time, type, subject identity and result of security event.

6.1 Ecode Encoding Data Storage

The security of Ecode encoding data storage shall comply with the following requirements:

a) The medium that stores Ecode encoding data shall be stable and reliable, and shall not be significantly affected by the physical conditions of the external environment;

b) Mobile medium shall not be used to store or transfer Ecode encoding data;

c) Technical processing shall be carried out on the medium, from which, Ecode encoding data has been deleted, so that the deleted data cannot be recovered;

d) Authorization management shall be carried out on the storage medium entry and exit process, and corresponding records shall be retained.

6.2 Ecode Encoding Data Transmission

The anti-interference, privacy, integrity and correctness of Ecode encoding data during the transmission process shall be guaranteed. See the specific requirements below:

a) Necessary technical and management measures shall be taken to prevent interference of Ecode encoding data during the transmission.

b) Necessary technical and management measures shall be taken to ensure the privacy of Ecode encoding data during the transmission. The network transmission of the Ecode identification system shall have the capability of preventing eavesdropping; security protocols, for example, HTTPS, should be adopted; digital certificates shall be installed. The security protection mechanism of the transmission protocol shall comply with the requirements established, which shall be respectively stored on media like disks, so as to facilitate data recovery when necessary;

d) A regular transferred storage system of the Ecode database shall be established. In accordance with the Ecode encoding data transaction volume, the frequency of the transferred storage shall be determined. The strategy of real-time transferred storage should be adopted.

6.5 Ecode Identification System Sensitive Information Protection

Necessary technical and management measures shall be taken to protect sensitive information of the Ecode identification system. See the specific requirements below:

a) Sensitive information, such as: ID cards and business licenses, shall be stored and calculated in the Ecode identification system; data shall not be locally stored;

b) The application and transferring process of sensitive information storage media shall be rigorously tracked and monitored, so as to prevent loss and information leakage;

c) Without permission, the scope of data services must not be exceeded, and data must not be altered or transmitted. In addition, it is prohibited to display sensitive information in the Ecode identification system in plain text;

d) Unified medium destruction tools shall be provided, which include, but are not limited to: physical destruction and degaussing equipment, so as to implement effective destruction of various media.

6.6 Ecode Encoding Verification

Ecode encoding verification shall comply with the following requirements:

a) In the Ecode encoding structure, the MD encoding method shall be complete and accurate; necessary verification mechanisms shall be adopted;

b) Ecode encoding resolution system shall establish an Ecode encoding comparison and verification mechanism to compare and verify the resolved V, NSI and MD information with the original codewords in the database, so as to ensure the accuracy and consistency of the encoding.

7.1 Ecode Identification System Identity Authentication Management

11.1 Registration Approval Mechanism

The Ecode identification system shall add a registration approval mechanism. When users are applying for codes online, they shall submit corresponding materials to be used in the internal approval process of the management institution.

11.2 Security Management

11.2.1 Daily security management

In the Ecode identification system, the daily security management shall comply with the following requirements:

a) Establish a security management system for the daily management activities;

b) Designate or authorize specialized personnel to take charge of the formulation and assessment of the security management system;

c) Publish the security management system to relevant personnel in various forms, such as: paper documents and electronic documents, etc.

11.2.2 Software maintenance management

The software maintenance management of the Ecode identification system shall comply with the following requirements:

a) Store source files of software products on the media, for example, disks; compile detailed catalogs for the long-term preservation;

b) Make two copies of important software. One shall be archived as the master copy, and the other shall be used as a backup;

c) It shall be ensured that the modification of relevant software of the Ecode identification system will not impair the security of the system.

11.3 Personnel Management

The Ecode identification system shall establish necessary personnel recruitment, assessment, security education and training, and external personnel access management systems, so as to ensure that the system hardware, software and data are not altered, leaked or destroyed due to accidental and malicious reasons. […]