GB/T 20276-2016 in English

《GB/T 20276-2016信息安全技术 具有中央处理器的IC卡嵌入式软件安全技术要求》由TC260（全国网络安全标准化技术委员会）归口，主管部门为国家标准化管理委员会。

1 Scope

This standard specifies the security requirements for the security protection of embedded software in IC card with CPU of EAL4 enhanced level and EAL5 enhanced level, including the security problem definition, security objectives, security requirements, rationale, etc.

This standard is applicable to the testing, evaluation and procurement of embedded software products in IC card with CPU, and may also be used to guide the research and development of such products.

2 Normative references

The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

GB/T 18336 (All parts) Information technology - Security techniques - Evaluation criteria for IT security
GB/T 25069-2010 Information security technology - Glossary

3 Terms, definitions and abbreviations

3.1 Terms and definitions

For the purposes of this document, the terms and definitions given in GB/T 25069-2010, GB/T 18336.1 and the followings apply.

3.1.1
personalization data
data written in the personalization process of embedded software in IC card, which is used to configure parameters related to specific applications or users

3.2 Abbreviations

For the purposes of this document, the following abbreviations apply.

 
CM: Configuration Management
EAL: Evaluation Assurance Level
EEPROM: Electrically-Erasable Programmable Read-only Memory
IC: Integrated Circuit
I/O: Input/Output
RAM: Random-Access Memory
ROM: Read-Only Memory
ST: Security Target
TOE: Target of Evaluation
TSF: TOE Security Functionality

Foreword i
Introduction iii
1 Scope
2 Normative references
3 Terms, definitions and abbreviations
3.1 Terms and definitions
3.2 Abbreviations
4 Descriptions of embedded software in IC card
5 Security problem definition
5.1 Assets
5.2 Threats
5.3 Organizational security policies
5.4 Assumptions
6 Security objectives
6.1 Security objectives for the TOE
6.2 Security objective for environment
7 Security requirements
7.1 Security functional requirements
7.2 Security assurance requirements
8 Rationale
8.1 Rationale of security objectives
8.2 Rationale of security requirements
8.3 Component dependencies
Bibliography