GB/T 47473-2026Technical requirements for identity verification in internet domain name services (English PDF)

5.1 Technical Framework

Before registering a domain name, the domain registrant should verify the authenticity of their identity information through the domain registration service provider and the domain registration management agency.

Verification. The technical framework for verifying the identity information of domain registrants is shown in Figure 1, and the verification process for domain registrants' identity information is detailed in Appendix A.

Note: This diagram is a logical framework diagram. In actual implementation, it can be implemented as a whole or some functions can be implemented by a professional organization. Dashed lines and boxes represent related modules. The requirements are not within the scope of this document.

The roles of each component in the identity verification technology framework are as follows.

a) The domain name registrant is the entity that initiates the registration of an internet domain name, and is also the subject of identity verification. The domain name registrant should first... Domain name registration is only permitted after the identity information of both the domain name registration service provider and the domain name registration management authority has been verified.

b) Domain name registration service providers shall verify the identity information of domain name registrants and provide feedback on the verification results to the domain name registrants;

c) The domain name registration management agency receives the domain name registrant identity information provided by the domain name registration service provider and verifies the identity of the domain name registrant.

The identity information is verified, and the verification results are reported back to the domain name registration service provider.

5.2 Functions

Domain name registration service providers and domain name registration management agencies should have identity verification and data security functions. Yes, specifically as follows.

a) Identity verification, which involves the domain name registration service provider and the domain name registration management authority collecting and verifying the identity information of the domain name registrant.

Data can be used to verify the authenticity and validity of the domain registrant's identity information; if necessary, identity verification sources can be used for this purpose.

b) Data security, namely, verifying identity information through data security management technologies, information protection systems, and emergency mechanisms.

Secure collection, secure transmission, secure use, secure storage, and secure destruction.

6.1 Domain Name Registration Service Providers

6.1.1 Verification of Personal Identity Information

Verification of the authenticity and validity of personal identity information includes the following.

a) Domain name registration service providers should require domain name registrants to provide legal identification documents and key identity information;

b) Domain name registration service providers should have the ability to verify the authenticity and validity of the domain name registrant's identity information, and may take measures to verify the identity information.

The authenticity and validity of information are verified by comparing the source with the verification source.

c) Domain name registration service providers should ensure the image quality of the legal identification documents submitted by domain name registrants during the identity verification process.

Verify that the key information on the identification documents submitted by the domain registrant is clearly identifiable;

d) Domain name registration service providers should have the capability to perform OCR on Chinese resident identity cards;

e) Domain name registration service providers should conduct real-person authentication of the domain name registrant;

f) The types of documents supported for personal identification information verification shall comply with the provisions of Appendix B.

6.1.2 Verification of Organizational Identity Information

6.2 Domain Name Registration Management Organization

Verification of the authenticity and validity of organizational identity information includes the following.

a) Domain name registration service providers should require domain name registrants to provide valid organizational documents and key identity information;

b) Domain name registration service providers should have the ability to verify the authenticity and validity of the organizational documents provided by the domain name registrant.

The authenticity and validity of the information are verified by comparing it with the identity information verification source;

c) Domain name registration service providers should ensure the image quality of organizational documents submitted by domain name registrants during the identity verification process.

Verify that the key information on the organizational documents submitted by the domain name registrant is clearly identifiable;

d) Domain name registration service providers should possess the capability to perform OCR on their business license and unified social credit code certificate;

e) The types of certificates supported by the organization's verification should comply with the provisions of Appendix C.

6.2.1 Verification of Personal Identity Information

Verification of the authenticity and validity of personal identity information includes the following.

a) Domain name registration authorities should require domain name registration service providers to provide the legal identification documents and key identity documents of the domain name registrant. information;

b) Domain name registration management agencies should be able to verify the authenticity of the identity documents of domain name registrants provided by domain name registration service providers.

Effective capabilities can be achieved by comparing the information with identity verification sources to verify the authenticity and validity of the information;

c) Domain name registration management agencies should ensure the image quality of legal identification documents submitted by domain name registration service providers during the identity verification process.

The quantity is assessed to ensure that key information on the identification documents submitted by the domain name registration service provider is clearly identifiable;

d) Domain name registration management agencies should have the capability to perform OCR on Chinese resident identity cards;

e) The types of documents supported for personal identification information verification shall comply with the provisions of Appendix B.

6.2.2 Verification of Organizational Identity Information

Verification of the authenticity and validity of organizational identity information includes the following.

a) Domain name registration authorities should require domain name registration service providers to provide valid identification documents of the domain name registrant's organization and key identification documents. Information;

b) Domain name registration management agencies should be able to verify the authenticity of the organizational documents of domain name registrants provided by domain name registration service providers.

The effective capability can be achieved by comparing the information with the identity information verification source to verify its authenticity and validity;

c) Domain name registration management agencies should conduct image quality checks on the organizational documents submitted by domain name registrants during the identity verification process.

Verify that the key information on the organizational documents submitted by the domain name registrant is clearly identifiable;

d) Domain name registration management agencies should possess the capability to OCR their business license and unified social credit code certificate;

e) The types of certificates supported by the organization's verification should comply with the provisions of Appendix C.

7.1 Collection Requirements

Requirements for collecting identity information from domain name registration management agencies and domain name registration service agencies.

a) Identity information should be collected in accordance with the principles of legality and propriety, and data should not be stolen or collected by other illegal means;

b) Management of personnel and equipment used for collecting identity verification data and sensitive personal information should be strengthened, and the sources, timing, type, quantity, and frequency of collection should be strictly controlled. Record parameters such as speed and flow direction;

c) The collection of personal information shall comply with the requirements of 5.1, 5.2 and 5.4 in GB/T 35273-2020.

7.2 Transmission Requirements

Requirements for the transmission of identity information between domain name registration management agencies and domain name registration service agencies.

a) Cryptographic techniques should be used to encrypt and verify sensitive personal information during transmission to ensure confidentiality and integrity.

Including but not limited to ID card number and ID card photo;

(b) Cryptographic techniques should be used to encrypt and verify identity verification data during transmission to ensure confidentiality and integrity during the transmission process.

This includes, but is not limited to, identity verification request information and identity verification results;

c) Commercial cryptographic algorithms should be used to encrypt and verify sensitive personal information and identity verification data in the transmission protocol used;

d) When authenticating communication entities, the authenticity of their identities must be guaranteed, including but not limited to identity verification services. Call;

e) The transmission of personal information shall comply with the requirements of 9.8 in GB/T 35273-2020.

7.3 Usage Requirements

Requirements for the use of identity information of domain name registration management organizations and domain name registration service organizations.

a) A least-authorization access control policy should be established, granting access only to the minimum amount of sensitive personal information required to fulfill responsibilities, and only to those authorized to perform their duties. Minimum data access permissions required;

b) The use of personal information shall comply with the requirements of 7.2 in GB/T 35273-2020.

7.4 Storage Requirements

Requirements for storing identity information of domain name registration management agencies and domain name registration service agencies.

a) Cryptographic techniques should be used to ensure the confidentiality and integrity of stored sensitive personal information, including but not limited to ID card numbers and identity documents. ID photo;

b) Cryptographic techniques should be used to ensure the confidentiality and integrity of identity verification data storage, including but not limited to identity verification requests. Information and identity information verification results;

c) Commercial cryptographic algorithms should be used to encrypt and store sensitive personal information and identity verification data;

d) The identity verification data of the domain registrant should be retained for at least two years after the domain is deleted. This identity verification data includes... However, this includes, but is not limited to, personal information, sensitive personal information, and identity verification results;

e) The storage of personal information shall comply with the requirements of 6.3 in GB/T 35273-2020.

7.5 Destruction Requirements

Requirements for the destruction of identity information of domain name registration management agencies and domain name registration service agencies.

a) A standardized process for destroying identity information should be established;

b) The requirements for the objects, rules, procedures, and technologies related to the destruction of identity information should be clearly defined;

c) Different destruction methods (demagnetization, shredding, soft destruction, etc.) should be adopted for different types of storage media to ensure irreversible destruction. Destroy the data and its copies.