YD/T 2407-2013Technical requirements for security capability of smart mobile terminal (English PDF)

Foreword

This Standard was drafted in accordance with the rules given in GB/T

1.1-2009.

This Standard uses redrafting method to modify and adopt ITU-T

X.msec-6.2012 Security aspects of smartphones, a related advice of

International Telecommunication Union (ITU). It is inequivalent to ITU-T

X.msec-6.

This Standard is one of the series of mobile intelligent terminal security series.

The names and structures of this series are expected to be as follows.

a) Guidelines for the design for security capability of smart mobile terminal;

b) YD/T 2407-2013, Technical requirements for security capability of smart

mobile terminal;

c) YD/T 2408-2013, Test methods for security capability of smart mobile

terminal;

d) YD/T 1886-2009, Security requirements and test specification for SoC in

mobile terminal.

This Standard was proposed by and shall be under the jurisdiction of China

Communications Standardization Association.

The drafting organizations of this Standard. Ministry of Industry and

Information Technology, Beijing Spreadtrum Hi-Tech Communications

Technology Co., Ltd., Datang Telecom Technology & Industry Group.

Main drafters of this Standard. Pan Juan, Kuang Xiaoxuan, Luo Hongwei,

Wang Kun, Li Yunfan, Yu Lu, Yuan Guangxiang, He Guili, Shi Denian, Li Wei,

Yu Huawei, Li Jianwei, Li Qian.

Introduction

With the extensive application of smart mobile terminals and the continuous

expansion of functions, the security issues during the use are concerned by

more and more users. In recent years, security incidents such as malicious

charge, eavesdropping, theft record, location information leakage make user

worry about the security of smart mobile terminals, which shall affect the

development of smart mobile terminals and mobile Internet applications. The

purpose of this Standard is to improve the smart mobile terminal's own

security protection, to prevent a variety of security threats on smart mobile

terminals, to protect users from interest damage, while preventing adverse

effects on mobile communication network security caused by smart mobile

terminals.

The basic principle of this Standard is that the behavior and application on

smart mobile terminal shall be in line with the user's wishes. This Standard

does not specify specific implementation methods and measures to facilitate

innovation and development. This Standard specifies the requirements to the

security capability of smart mobile terminal, from five aspects. hardware

security capability requirements, operating system security capability

requirements, peripheral interface security capability requirements,

application software security requirements, and user data security protection

requirements. And it grades the security capability from basic security

protection, difficulty of achievement, special security capability, so as to make

the product has a specific quality, make it easy for consumer to choose. This

Standard not only guides smart mobile terminals to preset application

software more standardized and safer, but also guides smart mobile terminals

to improve their own security capabilities, which shall make them perform

security control on the third-party applications downloaded latter. Meanwhile,

it can also prevent security impact on network caused by the preset malicious

codes in smart mobile terminals.

Technical requirements for

security capability of smart mobile terminal

1 Scope

This Standard specifies the technical requirements for security capability of

smart mobile terminal, including hardware security capability of smart mobile

terminal, operating system security capability of smart mobile terminal,

peripheral interface security capability of smart mobile terminal, application

layer security requirements of smart mobile terminal, user data protection

security capability of smart mobile terminal, etc. And it also grades the

security capability.

This Standard is applicable to various formats of smart mobile terminals.

Individual terms do not apply to special industries, professional applications.

Other terminals shall also refer to use.

2 Normative references

The following referenced documents are indispensable for the application of

this document. For dated references, only the edition cited applies. For

undated references, the latest edition of the referenced document (including

any amendments) applies.

YD/T 1699-2007, Information security technical specification for mobile

terminal

YD/T 1760-2012, Technical requirements for data exchange via peripheral

interface of mobile terminal

3 Terms, definitions and abbreviations