GB/T 41269-2022 in English

GB/T41269-2022, as an important part of the security standard system for critical network equipment, forms a supporting standard with the general requirements of GB40050-2021. This standard proposes 5 categories and 12 items of specific security technical requirements for router equipment:

• Device identification and access control
• Redundant backup and anomaly detection
• Pre-installed software security management
• Communication protocol security protection
• Data security and password requirements

5.1 Equipment identification security

It is recommended to adopt a three-level identification system:

1. The serial number of the entire device adopts an identification scheme that complies with ISO/IEC 15459
2. The board-level logo is embedded in the hardware security chip
3. The software version is verified using SHA-256 hash value

5.7 User Identity Authentication

Note when implementing a multi-factor authentication solution:

• The default password must be forcibly modified upon first login
• The session timeout is recommended to be set to 15-30 minutes
• The password complexity should contain uppercase and lowercase letters + numbers + special characters

With the widespread application of core routers in critical information infrastructure, the original YD/T series industry standards can no longer meet the following requirements:

• New security challenges brought by large-scale deployment of IPv6
• Firmware risks exposed by frequent supply chain security incidents
• Targeted use of routing protocols by APT attacks

This standard proposes innovative requirements such as "fault isolation" (Clause 4.2) for the first time, and prevents lateral penetration risks through hardware-level security design.