GB/T 42589-2023 in English
VALIDInformation security technology—Specification for electronic credential service security
- Issued on:2023-05-23
- Implemented on:2023-12-01
- File Format:PDF
- Delivery:Via email within 5 business days
$534.00
| Standard No: | GB/T 42589-2023 |
| Document status: | VALID |
| Title in English: | Information security technology—Specification for electronic credential service security |
| Title in Chinese: | 信息安全技术 电子凭据服务安全规范 |
| Language: | English |
| File Format: | Electronic (PDF) |
| Delivery: | Via email within 5 business days |
| Issued on: | 2023-05-23 |
| Implemented on: | 2023-12-01 |
| Chinese Classification: | L80-Data encryption |
| Professional Classification: | GB-National Standard |
| Related Keywords: | electronic credential service security introduction analysis
security requirements security level information security technology specification ai security collaboration |
| Related Topics: | SNR
Motor technical service electronic service electronic service Sterile clothing safety Vehicle chip information security Telecommunications Security Baseline |
《GB/T 42589-2023信息安全技术 电子凭据服务安全规范》由TC260（全国网络安全标准化技术委员会）归口，主管部门为国家标准委。
Introduction
Analysis of the core framework of the standard
| Service type | Security elements | Key technologies |
|---|---|---|
| Issuance service | Authorization control | Digital signature, access control |
| Issuance service | Data integrity | GM/T0031 electronic signature |
| Verification service | Authenticity verification | Multi-party signature mechanism |
Technical requirements for cryptographic services
The standard requires the use of cryptographic modules that comply with the certification of the National Cryptography Administration, including:
- SM2/SM3/SM4 National Secret Algorithm Combination
- Key Lifecycle Management (Generation/Storage/Rotation/Destruction)
- Remote calls must comply with the security requirements of GB/T 37092-2018
Typical Application Scenarios
A provincial electronic invoice platform adopts a three-level cryptographic service architecture:
- Hardware cryptographic machines provide root key protection
- Virtualized cryptographic resource pools handle high-concurrency signatures
- Terminal SDK implements offline signature verification
Identity Management Implementation Points
| Entity Type | Authentication Method | Typical Control Measures |
|---|---|---|
| Individual users | SMS+Fingerprint | Session Token expiration control |
| Enterprise users | UKey+CA certificate | Permission hierarchical management |
| Device access | Two-way TLS authentication | Device fingerprint verification |
Security Assessment Implementation Guide
Assessment process specified in Chapter 8 of the standard:
- Preparation phase: Determine the security level (level 2 or above is recommended)
- Solution design: Cover 7 types of service test cases
- On-site testing: Use static scanning + dynamic penetration combination verification
Common non-conformities
- The password module has not passed the national secret certification
- The audit log retention time is less than 6 months
- Lack of DDOS protection measures
Standard Evolution Analysis
Compared with traditional paper credential management, this standard highlights:
- Technical requirements for blockchain evidence storage
- Abnormal behavior analysis based on AI
- Security collaboration in a multi-cloud environment
Loading PDF document...
Error loading PDF. Please make sure the file is valid and try again.
We also recommend
-
GB/Z 41288-2022 in English
Information security technology—Guidelines of cyber security protection for important industrial control system
2022-03-08 -
GB/T 28451-2023 in English
Information security technology—Technical specification for network intrusion prevention system
2023-05-23 -
GB/T 30272-2021 in English
Information security technology—Public key infrastructure—Testing and assessment of compliance with standards
2021-08-20 -
GB/T 35274-2023 in English
Information security technology—Security capability requirements for big data services
2023-08-06 -
GB/T 39204-2022 in English
Information security technology—Cybersecurity requirements for critical information infrastructure protection
2022-10-12 -
GB/T 20945-2023 in English
Information security technology—Technical specification for network security audit products
2023-05-23 -
GB/T 17902.1-2023 in English
Information technology―Security techniques―Digital signatures with appendix―Part 1:General
2023-03-17 -
GB/T 25068.3-2022 in English
Information technology—Security techniques—Network security—Part 3: Threats, design techniques and control for network access scenarios
2022-10-12 -
GB/T 20274.1-2023 in English
Information security technology - Evaluation framework for information systems security assurance - Part 1: Introduction and general model
2023-03-17 -
GB/T 42829-2023 in English
Basic requirements of quantum secure communication applications
2023-08-06
