GB/Z 24294.2-2017Information security technology - Guide of implementation for Internet-based e-government information security - Part2: Access control and secure exchange (English PDF)

Foreword

GB /Z 24294 "Information Security Technology Internet-based e-government information security implementation guidelines" is divided into four parts.

--- Part 1. General principles;

--- Part 2. Access control and security exchange;

--- Part 3. Identity and authorization management;

--- Part 4. Terminal Security. This section GB /Z 24294 Part 2. This section drafted in accordance with GB/T 1.1-2009 given rules. Part of this section instead of GB /Z 24294-2009 "Information Security Technology Internet-based e-government information security implementation guidelines," and GB /Z 24294-2009 compared to the main technical changes are as follows:

--- given access control structure and implementation methods;

--- Access control functions, network adaptability put forward new basic requirements, detailed details of the access authentication, access control rules and Access control management requirements, more suitable for e-government security access control needs;

--- Added to the security exchange information security exchange mode classification;

--- For security exchange to complement the custom data security exchange mode technical requirements and data flow security exchange mode technical requirements. Please note that some of this document may be patentable. The issuing agencies of this document do not bear the responsibility of identifying these patents. This part of the National Information Security Standardization Technical Committee (SAC/TC260) and focal point. This part of the drafting unit. People's Liberation Army Information Engineering University, China Electronics Standardization Institute, Beijing Tian Rong Xin Technology Co., Ltd. Zheng Dazhou Great Information Technology Co., Ltd. The main drafters of this section. Chen Xingyuan, Du Xuehui, Sun Yi, Xia Chuntao, Cao Li-feng, Zhang Dongwei, Ren Zhiyu, Luo Feng surplus, Shangguan Xiao Li, Dong Guohua. This part replaces the standards previously issued as.

--- GB /Z 24294-2009.

As an important information infrastructure of e-government in our country, the Internet has improved the efficiency of office and saved resources and costs Internet openness, access to users, access terminals, diversification of access means, e-government system security requirements and e-government system The contradiction between openness and so on, will make the e-government system is facing illegal access, unauthorized access, information can not be safely shared Question, should be given high priority. To ensure that government users can legally access Internet e-government system security area to prevent illegal access and Unauthorized access, as well as inter-domain information security exchange specially formulated this part to promote the Internet in our e-government security applications. This section puts forward the safety function requirements of security access and security exchange in two stages. Based on the Internet e-government information security department System structure design, network access, information security sharing to provide guidance. This section first of all the domain control and inter-domain information security exchange mode Described, and then separately from the access control and information security exchange technology two stages described. In the access control phase, the first access Control mode is described, a clear access control of the composition, function and access requirements; then access authentication, sub-domain control to Seeking to regulate, clear the access authentication, access equipment functions and other requirements, and describes the implementation of sub-domain control rules; Finally, access control rules Then, the access management has been described, clear access control policies and security management requirements under different circumstances. In the security exchange phase, first of all Describe the security needs of Internet e-government information security exchange; Define the model based on Internet e-government information security exchange Then, the paper puts forward the key aspects of implementing information security exchange in the mode of secure exchange of customized data and the secure exchange of data stream respectively related requirements. This section is mainly applicable to no e-government outside the network line or not leased communication network line conditions of organizations, based on the Internet To carry out e-government construction that does not involve state secrets, when construction needs are met, it can be securely docked with the e-government extranet in accordance with the security strategy. Information Security Technology Internet-based e-government information security implementation guidelines Part 2. Access control and security exchange

1 Scope

GB/Z 24294.2-2017 is the Chinese national standard on information security technology - guide of implementation for internet-based e-government information security - part2: access control and secure exchange, in the field of information technology. The /Z suffix marks it as a guiding technical document: it does not prescribe requirements that can be certified against, but sets out the technique, the method or the state of the art that the standards bodies recommend following. It was issued on 31 May 2017 by the State Administration for Market Regulation; Standardization Administration of China. As a guiding technical document it carries no separate date of entry into force: it applies from publication. Classification: ICS 35.040, CCS L80. This page is published from the official record of the standard held by the Chinese standards administration: the identification, the dates, the classification and the issuing body are taken from there. The clause text, the tables and the numeric limits are in the document itself, which is delivered complete in English translation.

GB /Z 24294 of this part of a clear Internet e-government sub-domain control of two stages, access control phase, access control Structure, access safety equipment functions, access certification, access control rules, access control management and other aspects of the guidelines given recommendations; in safety Exchange phase, the safety of the exchange mode, custom data security exchange requirements, data flow safety requirements for the exchange of guidance to give recommendations. This section applies to no e-government outside the green line or not leased communication network dedicated line organization, based on the Internet E-government security access control strategy design, engineering implementation and system research and development that do not involve state secrets, for managers, engineers and technicians, Information Security Products Providers Provide Management and Technical Reference for Information Security Planning and Construction. Involving state secrets, or the storage, handling, Transmission of information gathering may involve state secrets, in accordance with national security regulations and standards.

2 Normative references

The following documents for the application of this document is essential. For dated references, only the dated version applies to this article Pieces. For undated references, the latest edition (including all amendments) applies to this document. GM/T 0022-2014 IPsec VPN Technical Specifications

3 Terms and definitions

The following terms and definitions apply to this document.

3.1 Access authentication method accessauthenticationmethod Access to the main body of the legitimacy of the inspection methods and means used to ensure the legitimacy of access.

3.2 Access control rules accesscontrolrule For different access agents, develop appropriate security rules to prevent access to the internal network resources of unauthorized access and ultra vires access.

3.3 Access the main group accesssubjectgroup Users, hosts, subnets, address segments, physical network interfaces, services and the like belonging to the same security domain belong to the same access attribute For the same group, the resources accessed by members in each group are the same, and the group is identified by the group object name.

3.4 Access subject accesssubject Can access to the internal network of end users, equipment, regions, network segments. Visitors who access the internal network have their own Name, the alias is called the object name.