GB/T 45502-2025General requirements for information security of service robots (English PDF)

Foreword

This document was drafted in accordance with the rules given in GB/T 1.1-2020 Directives for standardization - Part 1: Rules for the structure and drafting of standardizing documents.

Attention is drawn to the possibility that some elements of this document may be the subject of patent rights. The issuing body of this document shall not be held responsible for identifying any or all such patent rights.

This document was proposed by the China Machinery Industry Federation and is under the jurisdiction of the National Technical Committee on Robot of Standardization Administration of China (SAC/TC 591).

Drafting organizations of this document: China Software Testing Center (Software and Integrated Circuit Promotion Center of the Ministry of Industry and Information Technology), Beijing Humanoid Robot Innovation Center Co., Ltd., Beijing Research Institute of Automation for Machinery Industry Co., Ltd., Beijing Yunji Technology Co., Ltd., Zhejiang University, Beijing University of Posts and Telecommunications, Wuhan University of Technology, Shenyang Institute of Automation of the Chinese Academy of Sciences, Shenzhen UBTECH Robotics Corp., Ltd. and other enterprises and institutes.

GB/T 45502-2025 was issued on 28 March 2025 by the State Administration for Market Regulation and the Standardization Administration of China and has been in force since 1 October 2025. It is a recommended national standard.

1 Scope

China's national standard for the cybersecurity of service robots - the delivery robots in hotels and hospitals, the guide and reception robots in banks and stations, the cleaning, cooking and companion robots in homes. These machines combine a mobile body with cameras, microphones, lidar and a network connection, and they are usually controlled from a phone app and managed from a cloud back end, so a weakness in any of the three can leak personal data, hand control of a moving machine to an attacker or turn a fleet of robots into a foothold in a corporate network. The standard treats the robot as a system of three parts - the host system on the robot itself, the operating terminal and the back-end management system - and for each sets out the security functions it must provide and the concrete requirements: protected or disabled debug interfaces, secure storage, authentication and role-based permissions, firewalls and minimum services, encrypted communications with mutual certificate verification, authenticity and integrity checks with rollback for firmware and software updates, protection of vital data and command replay, patching of disclosed vulnerabilities and security auditing. It then gives a test method for every requirement, and an informative annex that grades the level of protection a robot needs according to its type and use. It is intended for manufacturers and integrators designing and hardening service robots and for the laboratories that evaluate them, and may be applied by reference to special and medical robots.

This document specifies the information security requirements and test methods for service robots.

This document applies to the design, implementation, evaluation and hardening of information security of service robots.

Special robots and medical robots may use it for reference.

Note: this document applies to all kinds of service robots, mainly including personal/domestic service robots and public service robots.

2 Normative references

The contents of the following documents constitute indispensable provisions of this document through normative references in the text. For dated references, only the edition corresponding to that date applies to this document. For undated references, the latest edition (including all amendments) applies to this document.

GB/T 12643-2025 Robotics - Vocabulary.

GB/T 25069-2022 Information security technology - Glossary.

GB/T 35273 Information security technology - Personal information security specification.

3 Terms and definitions

For the purposes of this document, the terms and definitions given in GB/T 12643-2025 and GB/T 25069-2022 and the following apply.

3.1 service robot - a robot that performs useful tasks for humans or equipment in personal use or professional use. Note 1: tasks in personal use include handling or serving of items, transportation, physical support, providing guidance or information, grooming, cooking and food handling, and cleaning. Note 2: tasks in professional use include inspection, surveillance, handling of items, person transportation, providing guidance or information, cooking and food handling, and cleaning. [Source: GB/T 12643-2025, 3.7]

3.2 debug interface - a physical interface reserved for the development, maintenance, diagnosis and so on of the robot.

3.3 operating terminal - a computing device used on the move to interact with the service robot, having an open operating system that provides an application development interface and can install and run third-party application software.

3.4 host system - the core software and hardware platform that coordinates the functions of the robot, such as navigation, perception, decision-making and interaction, so that the robot can perform its tasks effectively. Note: the host system includes modules such as the service robot body, the operating system and sensors.

3.5 credential - a representation of an identity used for authentication. Note 1: a credential is usually made to facilitate data authentication of the identity information it represents, and data authentication is usually used for authorization. Note 2: for example, the identity information represented by a credential can be printed on human-readable media or stored in a physical token, usually presented in a way intended to reinforce its perceived validity. Note 3: a credential may be a user name, a user name with password, a personal identification number (PIN), a certificate, a smart card, a token, a fingerprint and so on. [Source: GB/T 25069-2022, 3.458, modified]

3.6 vital data - data whose disclosure may directly affect public health and safety. Note: it includes user data, credentials, system configuration, database contents, IP addresses, passwords, sensitive file paths, private keys, certificates and API keys.

3.7 key instruction data - a series of instructions and parameters used to direct the behaviour and decisions of the service robot. Note: it includes control instructions, task instructions and configuration parameter adjustments.

4 Abbreviations

The following abbreviations apply to this document: AES, Advanced Encryption Standard; AP, Access Point; API, Application Programming Interface; CNNVD, China National Vulnerability Database of Information Security; CNVD, China National Vulnerability Database; CPU, Central Processing Unit; CRC, Cyclic Redundancy Check; IP, Internet Protocol; MD5, Message Digest Algorithm 5; NVD, National Vulnerability Database (United States); SQL, Structured Query Language; SSL, Secure Sockets Layer; TCP, Transmission Control Protocol; TLS, Transport Layer Security; USB, Universal Serial Bus; WAPI, Wireless LAN Authentication and Privacy Infrastructure; WPA, WAPI Protected Access.