JR/T 0204-2020Distributed Database Technology Financial Application Specification Security Technical Requirements (English PDF)

6.1 Cybersecurity requirements

basic requirements.

a) Different network security areas should be divided, and security isolation levels should be set. Distributed transaction database clusters should be deployed in high security Level within the area.

b) The network domain deployed by the distributed transaction database cluster should be regularly tested for security penetration, and network security vulnerabilities should be repaired.

Enhancement requirements.

a) The physical isolation of the deployed different database cluster networks should be ensured.

b) The physical isolation between the network that provides external services and the database management network should be ensured.

6.2 System safety requirements

basic requirements.

a) The access control strategy of the system should be determined according to business requirements and system security analysis.

b) A system security management system should be established, and the system security strategy, security configuration, log management and daily operation procedures should be implemented.

Specify specific regulations.

c) Malicious code static detection and behavior detection should be performed on the underlying software environment on which the distributed transaction database cluster depends on a regular basis, and timely update the security patch package, such as. operating system, virtualization software.

d) The open source components on which the distributed transaction database cluster depends should be statically detected and behaviorally detected for malicious code, and Update the security patch package from time to time.

Enhancement requirements.

6.3 Equipment safety requirements

basic requirements.

a) The key equipment should be deployed redundantly according to high availability requirements.

b) Data storage devices should be safely cleared when they are reused, replaced, or scrapped.

c) The cryptographic equipment shall be safely cleared of the key when it is reused, replaced, or discarded.

d) Respond to the safe removal of sensitive configuration information when key network equipment is reused, replaced, or scrapped.

Enhancement requirements.

The physical specificity of key equipment deployed should be ensured.

7.1 Identification and authentication

basic requirements.

a) It should support the uniqueness of identity identification (such as user name), and support the function of identity authentication through user password.

b) It shall support the function of setting, detecting and restricting the use of weak passwords for the complexity of user passwords.

c) It should support the function of setting, detecting and restricting login for user identity authentication failure processing.

d) Encrypted storage of user identification information (such as user passwords) should be supported.

Enhancement requirements.

It is advisable to use two or more combinations of authentication technologies to authenticate the management users.

7.2 User authorization

basic requirements.

a) Should support user-based authorization methods.

b) It should support the creation, logout and restricted login functions of users.

c) The user's permission addition and cancellation functions should be supported.

Enhancement requirements.

a) The authorization method based on user groups should be supported.

b) It should support the creation, logout and restricted login functions of user groups.

c) It should support the function of adding and revoking the permissions of the user group.

d) It should support the cascading transfer and recovery functions of user permissions.

7.3 Role management

basic requirements.

a) Different database administrator roles should be provided to provide management functions such as separation of duties and role constraints.

b) The roles of system administrator, audit administrator, and security administrator should be established, and the responsibilities of each role should be defined.

c) It shall support the restriction of the authority of ordinary users, and its authority shall not exceed the management scope of its own business data and database objects.

Enhancement requirements.

a) The authority of the system administrator should include important operations such as the creation, change, configuration and maintenance of the database cluster.

b) The audit administrator's authority should include operations such as viewing various logs and audit records, and importing and exporting audit records.

c) The authority of the security administrator should be limited to operations such as formulating, modifying, and checking security rules.

d) It is advisable to provide more fine-grained permissions based on the three roles of system administrator, audit administrator, and security administrator to meet the database application side customizes to minimize the need for separation of duties.

8.1 Object access control

basic requirements.

a) The function of configuring different access permissions for various database objects (such as library tables) should be supported.

b) Should support independent database users to manage database object permissions, such as granting and recycling of object access permissions, etc.

c) Should support the control of the maintenance authority of the library table structure, such as creating, deleting, changing the library table structure, etc. The maintenance of the library table structure should be performed by it is done by the user or related authorized users.

d) It should support the control of database table data access permissions. The database table data access permissions should include the insertion, the authority to update, delete, and query, and access to database table data should be done by the user to which it belongs or related authorized users.

Enhancement requirements.

a) The authority to maintain the database table structure should be granted only to the system administrator.

b) It should support the function of restricting system administrators and security administrators' access to database table data.

c) It should support label-based access control strategies.

8.2 Cluster access control

basic requirements.

When multiple applications share a database cluster, logical isolation of their own database objects among multiple applications should be supported.

Enhancement requirements.

8.3 Session access control

basic requirements.

The connection authentication function based on IP address, port, database, user and password shall be supported, and the session shall be securely isolated.

Enhancement requirements.

8.4 Node access control

basic requirements.

Should support the whitelist function, only the addresses on the whitelist list can be connected and accessed.

Enhancement requirements.

It should support users to add source address whitelist function.

8.5 Resource control

basic requirements.

a) Concurrency control strategies should be supported to prevent high concurrent connections from affecting the overall quality of service of the database.

b) The traffic distribution load strategy should be supported, and the control traffic can be evenly distributed to different computing nodes to avoid excessive traffic concentration.

Enhancement requirements.

a) It should support the function of dividing database cluster resources based on logical domains.

b) It is advisable to support resource protection mechanisms to avoid affecting availability due to excessive resource consumption by a single connection or session.

8.6 Read and write security policy

basic requirements.

a) Protective measures should be in place to prevent data from being directly updated by SQL requests at the slave node.

b) Read and write entries should be unified to avoid direct access to data storage nodes.

Enhancement requirements.

Should provide reading negative...