GM/T 0074-2019Technical requirements on cryptographic application for internet banking (English PDF)

7.1.3 Data integrity requirements

The data exchanged between the customer and the internet banking system shall be checked for integrity, to prevent third party modification. The data that needs to be checked for integrity include, but are not limited to: the login data, transaction application data, and contract data sent by the customer from the local bank to the internet banking system; as well as the login results, query results, transaction results, contract results as sent from the online banking system to the client.

In order to ensure the integrity of the data, it shall be digitally signed, hashed, or other similarly processed. According to the application scenario, use the cryptographic algorithm of GB/T 32918, GB/T 32905, GB/T 32907, or as approved by the national cryptographic authority. Among them, when using the cryptographic algorithm of GB/T 32918, it shall follow the requirements of GB/T 35275 or GB/T 35276.

7.1.4 Non-repudiation requirements

The transactions and contracting activities performed by customers after logging in to the internet banking system require that both the bank and the customer cannot be denied: the customer cannot deny the finished transfer records or contract records, etc.; the bank cannot deny the finished transfer, contract, and other operations.

In order to ensure the non-repudiation of the actions of both parties, it shall make digital signature of the action information. According to the application scenario, use a cryptographic algorithm approved by GB/T 32918 or the national cryptographic authority.

7.1.5 Verification audit requirements

Verification audit mainly includes two aspects: in-process verification audit and post-process verification audit. In-process verification audit is to verify or audit whether the client's identity and authority are legal during the operation of the internet banking system by the customer. It mainly includes system login, identity authentication and authority checking in transactions. post-process verification audit is to verify or audit the correctness of the transaction data stored in the background of the internet banking system.

To ensure the operability and security of the verification audit, before audit, it should encrypt or shield the key fields such as name, account number, amount in the audit target. If encryption is adopted, it shall use the cryptographic algorithm of GB/T 32918, GB/T 32905, GB/T 32907, or as approved by the the working key inside the device can be backed up in the security area of the device. When the device detects that the working key has been illegally changed, the device shall recover the key. It is forbidden to provide external access interfaces in the secure area of key work and storage, to prevent key leakage.

When an external backup of the key is required, it shall be protected by security hardware, or exported in cipher text after the key is encrypted; it shall not be exported directly in plain text.

7.2.6 Key revocation and archiving

Expired, obsolete or leaked keys shall be updated in a timely manner. The original keys can be archived but shall no longer be used.

7.3.1 Overview

Digital certificates used in internet banking mainly refer to digital certificates used by end users to complete identity authentication, secure communication, and transaction signatures.

The construction of certificate authentication systems and related key management systems shall follow the requirements of GM/T 0028, GM/T 0034, GM/T 0037, GM/T 0038, GM/T 0039, GM/T 0054, GB/T 28447 and other related standards.

The certificate format shall follow the requirements of GB/T 20518 and GM/T 0015.

The online certificate status service shall comply with the requirements of GB/T 19713.

7.3.2 Certificate lifecycle management

The certificate lifecycle includes the following phases:

a) Certificate application: When an internet banking customer applies for a certificate, the bank reviews the application information and identity information submitted by the user, to confirm that it is complete, authentic, valid.

b) Certificate downloading: During the certificate downloading process, the private key generated by the asymmetric key pair inside the smart key shall be protected by the smart key at all times; the externally-derived key pair shall be encrypted and protected, to prevent private key disclosure;

e) Cryptographic hashing operation: Single-packet or multi-packet hash generation;

f) Message authentication code calculation: Single-packet or multi-packet message authentication code generation and verification;

g) Certificate operation: Provide functions such as certificate verification and certificate analysis;

h) Key and certificate management: Import, export, backup, restore of various keys; import, export, backup, restore of public key certificates;

i) Correctness self-test: Automatic testing of the correctness of the cryptographic module or function.

7.5.2 Interface requirements

The interface of smart cryptographic key device shall meet GM/T 0016; the interface of service cryptographic device shall meet GM/T 0018; the service interface of other cryptographic device shall support GM/T 0019. When using other specifications (such as CSP, PKCS #11 etc.), the implementation of the underlying algorithms, functions, etc. shall follow the requirements of relevant standards.

7.5.3.1 General requirements

The cryptographic device used in the internet banking system shall be a commercial cryptographic product that has obtained a model recognized by the national cryptographic authority; during use, it shall ensure that the private key and the symmetric key do not appear outside the cryptographic device in plain text.

7.5.3.2 Security requirements for server-side cryptographic devices

In addition to the general security requirements for cryptographic device, the server-side cryptographic device used in the internet banking system shall also meet the server-side security function requirements in JR/T 0068. The signature verification server shall meet the requirements of GM/T 0029; the server's cipher machine shall meet the requirements of GM/T 0030; the financial data cipher machine shall meet the requirements of GM/T 0045.

7.5.3.3.1 Overall requirements

Client security shall follow the requirements of JR/T 0068.