Encryption Application System Construction (Government Affairs Direction)

1. Background

Cryptography is the core technology and basic support to ensure network and information security, and it is the most effective, reliable and economical means to solve network and information security problems. The promulgation and implementation of the "Encryption Law" provides a fundamental basis for the development of commercial cryptography applications from the legal level, and the promulgation and implementation of the "National Government Informationization Project Construction Management Measures" further promotes the comprehensive application of commercial cryptography.

Implement the requirements of the "Cryptography Law" on the application of passwords in information systems, and combine the "Guiding Opinions on National E-Government Construction" to build password applications and password application and security evaluation systems, proactively discover hidden risks and non-compliance, and clarify password application reinforcement Points, fully support the orderly development of cryptography application work, and effectively guarantee the implementation of the national cryptography application strategy.

2. The relationship between passwords and equal security and the compliance inspection index system

Information system cryptographic application can be divided into general requirements, cryptographic function requirements, cryptographic technology application requirements (including physical and environmental, network and communication security, equipment and computing security, application and data security), secret key management requirements and security management requirements ( Including system, personnel, implementation and emergency). According to different security levels, password applications have different requirements. For example, the requirements for the second level (level protection) of network and communication security include:

• a) It is advisable to conduct identity authentication based on cryptographic technology before communication, use the confidentiality and authenticity functions of cryptographic technology to realize anti-interception, anti-counterfeiting and anti-reuse, and ensure the confidentiality of authentication information during transmission and the authenticity of network device entity identities sex;
• b) The integrity function of cryptographic technology should be used to ensure the integrity of network boundary and system resource access control information;
• c) Encryption technology should be used to ensure the integrity of data during communication;
• d) Encryption technology should be used to ensure the confidentiality of sensitive information data fields or the entire message in the communication process;
• e) It is advisable to use a second-level or above cryptographic module in accordance with GM/T 0028 or a hardware cryptographic product approved by the national cryptographic management department to realize cryptographic operations and key management.

Level 3 (level insurance) requirements include:

• a) The identity authentication of both parties should be performed based on cryptographic technology before communication, and the confidentiality and authenticity functions of cryptographic technology should be used to achieve anti-interception, anti-counterfeiting and anti-reuse, and ensure the confidentiality of authentication information and network equipment entities during transmission. authenticity of identity;
• b) The integrity function of cryptographic technology shall be used to ensure the integrity of network boundary and system resource access control information;
• c) Encryption technology should be used to ensure the integrity of data during communication;
• d) Encryption technology should be used to ensure the confidentiality of sensitive information data fields or the entire message during communication;
• e) Cryptography technology should be used to establish a secure information transmission channel to centrally manage the security devices or components in the network;
• f) It is advisable to adopt a third-level and above cryptographic module in accordance with GM/T 0028 or a hardware cryptographic product approved by the national cryptographic management department to realize cryptographic operations and key management.

 For compliance inspection indicators, please refer to GMT 0054-2018 "Basic Requirements for Password Application in Information Systems".

4. Construction plan

4.1 Construction ideas

Article 15 of the "Measures" requires that "the project construction unit shall implement the relevant laws, regulations and standards of the national encryption management, and simultaneously plan, construct, and operate the encryption security system and conduct regular evaluations", that is, the encryption security in the information system The system should achieve "three synchronizations and one evaluation". The cryptographic application and security assessment of the general information system run through the planning, construction and operation stages of the system, and its implementation process is shown in the figure below.

(1) Planning stage

In the information system planning stage, the project construction unit analyzes the current situation of the system, analyzes the security risks and risk control requirements faced by the system, and clarifies the application requirements of passwords. System password application scheme template, compile information system password application scheme, and select commercial encryption application security assessment institutions from the "Commercial Encryption Application Security Assessment Pilot Institution Catalog" to conduct commercial encryption application security assessment. It is a necessary condition for the project approval that the cryptographic application scheme pass the secret evaluation.

(2) Construction stage

In the information system construction stage, under the explicit requirements of the project construction unit, a password protection system shall be constructed according to the password application plan that has passed the secret review, so as to ensure that the system password application meets the national password management requirements. If the construction phase involves the adjustment and optimization of the encryption application scheme, a secret evaluation agency should be entrusted to confirm the adjusted encryption application scheme again. After the system construction is completed, the project construction unit entrusts a secret evaluation agency to carry out a secret evaluation of the system. Passing the secret evaluation of the system is a necessary condition for project acceptance. For information systems that have not passed the secret evaluation, the project construction unit shall promptly rectify the safety problems found in the evaluation. After the rectification is completed, the secret evaluation agency may be asked to conduct a re-evaluation and update the evaluation results. 

(3) Operation stage

During the operation stage of the information system, the project user unit regularly entrusts a secret evaluation agency to conduct a secret evaluation of the system. For information systems with a network security protection level of level three and above, the secret evaluation shall be conducted at least once a year. Overall consideration and coordinated implementation of safety level evaluation and other work.

Follow the principle of continuous improvement, timely check, summarize, and adjust existing password application measures according to security requirements, system vulnerability, risk threat level, system environment changes, and deepening understanding of system security, and confirm the system's various encryption technologies and Whether the management measures are in place.

4.2 Construction Basis

1. GB/T 39786-2021 "Basic Requirements for Cryptography Application in Information Security Technology Information System"
2.  GM/T 0054-2018 "Basic Requirements for the Application of Passwords in Information Systems"
3. GM/T 0071-2019 "Guidelines for the Application of Electronic File Passwords"
4. GB/T 33482-2016 "Specifications for the Construction of Electronic Official Document System of Party and Government Organs"
5. GM/T 0036-2014 "Technical Guidelines for Password Application of Access Control Systems Using Contactless Cards"
6. GM/T 0023-2014 "IPSec VPN Gateway Product Specification"
7. GM/T 0024-2014 "SSL VPN Technical Specifications"
8. GM/T 0025-2014 "SSL VPN Gateway Product Specification"
9. GM/T 0026-2014 "Safe Authentication Gateway Product Specification"
10. GM/T 0030-2014 "Technical Specifications for Server Cipher Machines"
11. GM/T 0031-2014 "Technical Specifications for Secure Electronic Signature Password"
12. GM/T 0027-2014 "Technical Specifications for Smart Password Keys"
13.  GM/T 0014-2012 "Certificate Authentication System Cryptography Protocol Specification"
14. GM/T 0028-2014 "Technical Requirements for Security of Cryptographic Modules"
15.  GM/T 0033-2014 "Time Stamp Interface Specification"
16. GM/T 0029-2014 "Technical Specifications for Signature Verification Server"
17. GB/T 36968-2018 "Information Security Technology IPSec VPN Technical Specifications"
18. ....

4.3 Overview of Construction Content

4.3.1 Physical and Environmental Security

It is mainly to realize the physical protection of important areas such as the computer room where the information system is located. The cryptographic functions that should be included include:

1. Confirm the identity of personnel entering each important area, and prevent irrelevant and counterfeit personnel from entering;

2. Protect the integrity of the entry and exit records of the electronic access control system and video surveillance audio-visual records, and prevent unauthorized tampering.

To achieve the above functions, the following password application measures can be selected in combination with the network security protection level of the information system:
1. Deploy an electronic access control system based on password technology (refer to GB/T 37033-2018 "Technical Requirements for Password Application of Radio Frequency Identification System for Information Security Technology" , GM/T 0036-2014 "Technical Guidelines for the Application of Passwords in Access Control Systems Using Contactless Cards" and other standards), to identify the identities of personnel entering and exiting important physical areas (such as computer centralized office areas, equipment rooms, etc.), and electronic access control Integrity protection of data such as system access records;

2. Deploy a video surveillance system based on cryptographic technology to protect the integrity of data such as video surveillance audio and video records.

4.3.2 Network and communication security

It is mainly to realize the security protection of network communication between the information system and external entities, and the cryptographic functions that should be provided include:

1. Confirm the identity of the communicating entity and prevent communication with counterfeit entities;

2. Protect data during communication, prevent data from being tampered with without authorization, and prevent sensitive data from leaking.

To achieve the above functions, when transmitting sensitive data in non-secure network channels, the following password application measures can be selected in combination with the network security protection level of the information system:

1. Deploy IPSec VPN products (in compliance with GM/T 0022-2014 "IPSec VPN Technical Specifications", GM/T 0023-2014 "IPSec VPN Gateway Product Specifications" and other standards) to realize the identity authentication of both parties in the communication process. Data confidentiality, integrity protection;

2. Deploy SSL VPN products (in compliance with GM/T 0024-2014 "SSL VPN Technical Specifications", GM/T 0025-2014 "SSL VPN Gateway Product Specifications" and other standards) to realize the identity authentication of both parties in the communication process, sensitive Data confidentiality and integrity protection.

4.3.3 Device and Computing Security

It is mainly to realize the security protection of all kinds of equipment and computing environment in the information system. The cryptographic functions that should have include:

1. Identify and confirm the identities of privileged users (including system administrators, security administrators, audit administrators, etc., hereinafter referred to as "administrators") and ordinary users of the device to prevent counterfeit personnel from logging in;

2. During remote management, the administrator's identity authentication information (such as password, etc.) is protected to prevent leakage of authentication information;

3. Protect system resource access control information (such as device configuration information, security policies, resource access control lists, etc.), important information resource security marks (such as data labels, etc.), log records (such as system logs, database logs, etc.) and important executable programs (such as important applications, key system files, etc.) to prevent unauthorized tampering.

To realize the above-mentioned password function, the following password application measures can be selected in combination with the network security protection level of the information system on the computer terminal and server:

1. Deploy smart password keys, smart IC cards or other password products with identity authentication functions to authenticate logged-in users;

2. Build a secure communication link (such as an SSL channel) for remote management to protect the confidentiality of authentication information;

3. Deploy a trusted computing cryptographic support platform, signature verification server or server cipher machine to realize trusted computing capabilities, establish a chain of trust from the system to the application, protect the integrity of important information, and ensure the security and credibility of the computing environment.

4.3.4 Application and Data Security

It is mainly to realize the security protection of the application and its data in the information system. The cryptographic functions that should have include:

1. Confirm the identity of administrators and ordinary users of the application system to prevent counterfeit personnel from logging in;

2. Access control policies for application systems (such as security policies, resource access control lists, etc.), database table access control information (such as user identity information, database security policies, user permission lists, etc.), important information resource security marks (such as data label) etc. for protection against unauthorized tampering;

3. Protect important data (including but not limited to authentication data, important business data, important user information, etc.) transmitted between the client and the server, and between application systems in non-secure network channels, to prevent data leakage;

4. Protect important stored data (including but not limited to authentication data, important business data, important user information, etc.), to prevent data leakage and unauthorized tampering;

5. Protect important log records (such as authentication login logs, configuration operation logs, etc.) to prevent unauthorized tampering;

6. Protect the data sending and data receiving operations in the application system that may involve the determination of legal liability, and ensure that the sender and receiver cannot deny the operation that has occurred.

To achieve the above functions, the following password application measures can be selected in combination with the network security protection level of the information system:

1. Configure password products with identity authentication functions such as smart password keys, smart IC cards, and mobile smart terminal password modules for users, and manage system user identities;

2. Deploy a security authentication gateway system to perform identity authentication and authority control on users accessing the application server, and protect the confidentiality and integrity of data transmitted between the client, the server, and the application system;

3. Deploy storage encryption products, server cipher machines or other cipher modules to protect the confidentiality and integrity of stored important data;

4. Deploy signature verification servers, server cipher machines or other cryptographic modules to protect the integrity of stored log records;

5. According to the needs of the application system, deploy cryptographic products such as signature verification server, electronic signature system, and time stamp server to sign the data sent and received and related operation records, so as to realize the non-repudiation of the original behavior of data and the behavior of data reception of non-repudiation.

4.3.5 Key Management

In the cryptographic application scheme of the information system, it is necessary to include a complete key management scheme, clarify the key types and management links used, and design a safe technical implementation method to ensure the generation, storage, distribution, import, export, and use of keys , Backup, recovery, archiving, destruction and other full life cycle security.

The technical implementation of the key management scheme must be provided by commercial cryptographic products that have passed testing and certification. The technical implementation of key management solutions that have not been tested and certified can be submitted to the national encryption management department to organize a security review.

4.3.6 Security Management

According to the "Basic Requirements", the security management measures of information systems include four aspects: system, personnel, implementation and emergency response.

In terms of systems, project construction units and users need to establish corresponding password security management systems and operating specifications, covering password management related content such as password construction, operation and maintenance, personnel, equipment, and keys. Relevant systems can be formulated separately for the password protection system, or they can be reflected in existing information system security management related systems and specifications.

In terms of personnel, the project construction unit and the user unit need to set up password management and operation related posts according to the needs of information system password management, formulate relevant regulations on personnel post responsibilities, personnel assessment, personnel training, personnel confidentiality and transfer, and implement personnel management according to the regulations. equipment and management.

In terms of implementation, the project construction unit and the user unit carry out the password application work of information system planning, construction and operation, focusing on the design and secret evaluation of the password application scheme, the construction and secret evaluation of the password security system, and related closed-loop management.

In terms of emergency safety management, the project construction unit needs to clarify typical emergency events and emergency treatment and disposal plans during the project construction stage and the project user unit during the system operation period, and prepare emergency resources. When an event occurs, according to the emergency plan combined with the actual situation The situation was dealt with in a timely manner.

4.4 Safety Assessment

According to the "Basic Requirements", "Commercial Password Application Security Evaluation Management Measures (Trial)", "Information System Password Evaluation Requirements (Trial)", "Commercial Password Application Security Evaluation and Evaluation Process Guide (Trial)", "Commercial Password Application Security Evaluation and Evaluation Operation Instructions (Trial)" and other standard specifications, guiding documents and management requirements, compare the cryptographic application schemes that have passed the secret evaluation, check whether the conditions for inapplicable indicators are established, and whether alternative risk control measures are implemented, so as to determine whether it is applicable or not Then evaluate from the overall requirements, physical and environmental security, network and communication security, equipment and computing security, application and data security, key management, security management, etc., according to the current security status of the information system, give Evaluate the results and make targeted rectification suggestions.

References:

"Cipher Law"

"National Government Informationization Project Construction Management Measures"

GMT 0054-2018 "Basic Requirements for the Application of Passwords in Information Systems"

"Guidelines for the Application and Security Assessment of Cryptography in Government Information Systems"