MH/T 0068-2018 in English
VALIDSecurity testing guide for mobile application program of civil aviation
- Issued on:2018-12-14
- Implemented on:2019-04-01
- File Format:PDF
- Delivery:Via email within 1~3 business days
$243.00
| Standard No: | MH/T 0068-2018 |
| Document status: | VALID |
| Title in English: | Security testing guide for mobile application program of civil aviation |
| Title in Chinese: | 民用航空移动应用程序安全测评指南 |
| Language: | English |
| File Format: | Electronic (PDF) |
| Delivery: | Via email within 1~3 business days |
| Issued on: | 2018-12-14 |
| Implemented on: | 2019-04-01 |
| Professional Classification: | MH-Civil Aviation |
| Related Keywords: | civil aviation mobile applications
core security requirements security civil aviation administration civil aviation introduction standard background mobile application program |
| Related Topics: | evaluation
application Safety Evaluation Evaluation Standards Immigrate to outer space immigration space mh/t 4049-2018 Mobile Application Security The whole program is blank Mobile air conditioner safety t/csee0068-2018 t/cwan 0068 t/cpcif 0068 |
Introduction
Standard Background and Scope of Application
MH/T 0068-2018 was proposed by the Civil Aviation Administration of China to establish a standardized framework for the safety assessment of civil aviation mobile applications. The standard applies to civil aviation mobile applications classified as Level 2 and Level 3 by GB/T 22240, covering typical scenarios such as air travel services and airport operations.
Analysis of core security requirements
| Security domain | Key control points | Evaluation method |
|---|---|---|
| Identity authentication | Two-factor authentication, login failure lock, forced modification of initial password | Manual inspection + penetration testing |
| Access control | Principle of least privilege, separation of privileges, protection against unauthorized access | Permission matrix review + interface testing |
| Data security | Transmission encryption, storage encryption, residual information removal | Traffic packet capture analysis + storage detection |
Typical implementation case
Case:During the penetration test of a certain airline check-in APP, it was found that:
1. The unencrypted passenger ID number field was intercepted using Burp Suite
2. Unauthorized viewing of other people’s itineraries was achieved by modifying HTTP parameters
Corrective measures:Use the national secret SM4 algorithm to encrypt sensitive fields and increase the server-side permission verification layer
Evaluation implementation process
- Preparation stage:Determine the scope of the evaluation (it is recommended to include ≥3 typical business modules)
- Tool selection:It is recommended to use a combination of MobSF static scanning + OWASP ZAP dynamic testing
- Risk control:The test data must use desensitized simulated data
- Report output:It must include the vulnerability CVSS score and repair priority recommendations
Technology Evolution Trends
As civil aviation mobile applications develop towards mini-programs, subsequent versions of the standard need to supplement:
1. Security detection items for cross-platform frameworks (such as Flutter)
2. Application specifications for biometric authentication in check-in scenarios
3. Communication security requirements in 5G network environments
Loading PDF document...
Error loading PDF. Please make sure the file is valid and try again.
We also recommend
-
MH/T 3024-2013 in English
Specification of engine fuel pump and fuel metering unit test equipment
2013-03-13 -
MH/T 1030-2018 in English
Specification for air transport of dangerous goods carried by passangers or crew
2018-03-27 -
MH/T 5044-2020 in English
System for Standards of Civil Aviation Project Construction
2020-08-28 -
MH/T 4016.9-2011 in English
Civil aviation meteorology-part 9:output message format of automated weather observing system
2011-03-25 -
MH/T 4009-2000 in English
Aeronautical mobile satellite services communication aircraft earth station-general technical requirements
2000-04-24 -
MH/T 0022-2001 in English
Assessing principles and calculating methods for the economic effect of standardization of civil aviation
2001-08-21 -
MH/T 4034-2012 in English
Data link and voice compatible automatic terminal information service
2012-01-19 -
MH/T 6017-2017 in English
Aircraft tow tractor
2017-01-02 -
MH/T 0002-1997 in English
Genaral rules for drafting standards
1997-04-24 -
MH/T 6043-2015 in English
Cleaner for aircraft components, solvent type
2015-03-03
