GB/T 44462.3-2024Industrial internet enterprise cybersecurity - Part 3: Protection requirements of industrial internet identification resolution enterprise (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for standardization work Part

1.Structure and drafting rules for standardization documents" Drafting. This document is Part 3 of GB/T 44462 "Industrial Internet Enterprise Cybersecurity". GB/T 44462 has published the following part.

1.Protection requirements for industrial enterprises applying the Industrial Internet;

2.Protection requirements for platform enterprises;

3.Identity resolution enterprise protection requirements. Please note that some of the contents of this document may involve patents. The issuing organization of this document does not assume the responsibility for identifying patents. This document was proposed by the Ministry of Industry and Information Technology of the People's Republic of China. This document was prepared by the National Communications Standardization Technical Committee (SAC/TC485) and the National Cybersecurity Standardization Technical Committee (SAC/TC260). Jointly managed. This document was drafted by: China Academy of Information and Communications Technology, National Industrial Information Security Development Research Center, China Software Evaluation Center (Industrial and Information Technology Ministry Software and Integrated Circuit Promotion Center), China Electronics Technology Standardization Institute, China Industrial Internet Research Institute, Beijing Aviation Industry Corporation University of Aeronautics and Astronautics, Guangdong Xinxing Technology Co., Ltd., Jiangsu Zhongtian Internet Technology Co., Ltd., Beijing Topsec Network Security Technology Co., Ltd., Beijing Venusstar Information Security Technology Co., Ltd., Beijing Eastcom Network Technology Co., Ltd., Zhengzhou Xindajiean Information Technology Co., Ltd. Company, AsiaInfo Technologies (Chengdu) Co., Ltd., China Communications Service Consulting and Design Institute Co., Ltd., Beijing Shenzhou Green Alliance Technology Co., Ltd., Nanjing Zhong Xinsai Technology Co., Ltd., China Mobile Internet of Things Co., Ltd., Guoneng Dadu River Big Data Service Co., Ltd., State Grid Henan Electric Power Co., Ltd. North China Institute of Computer System Engineering (China Electronics Information Industry Group Co., Ltd. Sixth Research Institute), China Telecom Co., Ltd. Beijing Research Institute, Beijing Xin'an Century Technology Co., Ltd., Qi'anxin Technology Group Co., Ltd., State Grid E-commerce Technology Co., Ltd., Qingdao Hisense Communications Co., Ltd., China Classification Society, Changyang Technology (Beijing) Co., Ltd. The main drafters of this document are. Wei Liang, Zhao Shuang, Dong Yue, Zhang Qian, Ke Haoren, Li Yi, Yu Guangchen, Ma Juan, Zhang Yu, Ou Jingan, Wang Yi, Shi Zongsheng, Qu Lixiao, Li Jun, Sun Jun, Yu Guo, Ma Xiao, An Gaofeng, Liu Weihua, Wu Jintao, Tang Gang, Zhang Jiahuan, Cui Tingting, Mi Jingfeng, Tang Yongtian, Zhao Zitong, Cha Qiwen, Hong Sheng, Liu Chao, Gao Lifen, Ye Jianwei, Wang Lei, Tu Yangju, He Yubin, Dang Fangfang, Li Shuai, Huo Chaobin, Fu Jun, Cui Junrong, Jin Xiaoyu, Zhang Xuejie, Zhang Yu, Zhang Yajing, and Liu Wei.

There are many industrial Internet companies, with different levels of informatization development and different types of business, and the network security protection needs of their respective industries In order to solve the problem that the existing network security protection requirements cannot meet the actual needs of the development of industrial Internet enterprises, it is necessary to implement industrial Internet companies' network security is classified and graded and relevant standards are formulated. GB/T 44462 "Industrial Internet Enterprise Cybersecurity" is a guide for industrial Internet enterprises to carry out cybersecurity classification and grading protection work. It is a basic standard for industrial enterprises, industrial Internet platform enterprises, and industrial Internet identification resolution enterprises that apply the industrial Internet. and enterprise data security, and proposes different levels of network security management and security protection technical requirements to guide enterprises to implement Adaptive security measures, due to the different needs of file users, consist of four parts.

1.Protection requirements for industrial enterprises using the Industrial Internet. The purpose is to propose industrial enterprises using the Industrial Internet Security requirements that need to be implemented in carrying out network security classification and grading protection work.

2.Protection requirements for platform enterprises. The purpose is to propose the requirements for industrial Internet platform enterprises to carry out network security classification and classification. Safety requirements that need to be implemented in protective work.

3.Protection requirements for identity resolution companies. The purpose is to propose the requirements for industrial Internet identity resolution companies to carry out network security analysis. Safety requirements that need to be implemented in class-based protection work.

4.Data protection requirements. The purpose is to propose the requirements for industrial Internet enterprises to carry out network security classification and classification protection work. Data security requirements to be implemented. This document is aimed at industrial Internet identity resolution companies, proposes different levels of security protection requirements, and guides companies to implement industrial Internet security The full classification and grading management work lays the foundation for the construction and operation of industrial Internet identification resolution enterprises and the improvement of node security protection capabilities, Industrial Internet security assurance capabilities. Industrial Internet Enterprise Cybersecurity Part

1 Scope

GB/T 44462.3-2024 is Part 3 of the Chinese series on industrial internet enterprise cybersecurity, and covers the identification resolution enterprises - the operators of the national top-level nodes, secondary nodes and recursive nodes that turn an industrial identifier into the address of the data behind it. They are the naming layer of the Chinese industrial internet, and they are attractive targets in the way DNS is: an attacker who can poison a resolution does not need to breach the factory to redirect what the factory believes about a part. The standard determines the security protection level of the resolution enterprise, fixes the scope of the protection - the resolution service, the node infrastructure, the data and the management systems around them - and sets the protection requirements at the initial, basic and enhanced levels, with an informative annex diagramming the protection scope. It takes effect on 1 January 2025.

This document specifies the requirements for industrial Internet identity resolution enterprises in terms of equipment and systems, networks, services and applications, management, and physical environment. Face different levels of network security protection requirements. This document is applicable to guiding Industrial Internet identity resolution companies to carry out network security classification and grading protection work.

2 Normative references

The contents of the following documents constitute essential clauses of this document through normative references in this document. For referenced documents without a date, only the version corresponding to that date applies to this document; for referenced documents without a date, the latest version (including all amendments) applies to This document.

GB/T 25069 Information security technical terms

GB/T 39786 Information security technology Basic requirements for the application of cryptography in information systems

GB/T 42021 Overall network architecture of the industrial Internet

GB 50174 Data Center Design Specification

3 Terms and definitions

The terms and definitions defined in GB/T 25069 and GB/T 42021 and the following apply to this document.

3.1 Industrial Internetindustrialinternet The new infrastructure, application model and industrial ecology of the deep integration of the new generation of information and communication technology and industrial economy will be realized through the integration of people, machines, By fully connecting objects, systems, etc., we will build a new manufacturing and service system covering the entire industrial chain and the entire value chain. [Source: GB/T 42021-2022, 3.1]

3.2 A string used in the Industrial Internet to uniquely identify and locate physical or digital objects and their associated information.

3.3 The process of translating an identity into the information associated with it. [Source: GB/T 33745-2017, 2.4.3, modified]

3.4 An information system that carries the industrial Internet identity resolution service.

3.5 Industrial Internet identity resolution root node operation agency, national top node operation agency, identity registration service agency, recursive node operation agency