Newsletter

中国:关于调整《网络关键设备和网络安全专用产品目录》的公告

2023-07-13

2023年7月3日依据《中华人民共和国网络安全法》,国家互联网信息办公室会同工业和信息化部、公安部、国家认证认可监督管理委员会等部门更新了《网络关键设备和网络安全专用产品目录》,现予以公布,自印发之日起施行。

2017年国家互联网信息办公室、工业和信息化部、公安部、国家认证认可监督管理委员会联合发布的《关于发布〈网络关键设备和网络安全专用产品目录(第一批)〉的公告》(2017年第1号)中的网络关键设备和网络安全专用产品目录同步废止。

特此公告。

网络关键设备和网络安全专用产品目录

一、网络关键设备

序号

设备类别

范围

1

路由器

整系统吞吐量(双向)≥12Tbps

整系统路由表容量≥55万条

2

交换机

整系统吞吐量(双向)≥30Tbps

整系统包转发率≥10Gpps

3

服务器(机架式)

CPU数量≥8个

单CPU内核数≥14个

内存容量≥256GB

4

可编程逻辑控制器(PLC设备)

控制器指令执行时间≤0.08微秒

 

二、网络安全专用产品

序号

产品类别

产品描述

1

数据备份与恢复产品

能够对信息系统数据进行备份和恢复,且对备份与恢复过程进行管理的产品。

2

防火墙

对经过的数据流进行解析,并实现访问控制及安全防护功能的产品。

3

入侵检测系统(IDS)

以网络上的数据包作为数据源,监听所保护网络节点的所有数据包并进行分析,从而发现异常行为的产品。

4

入侵防御系统(IPS)

以网桥或网关形式部署在网络通路上,通过分析网络流量发现具有入侵特征的网络行为,在其传入被保护网络前进行拦截的产品。

5

网络和终端隔离产品

在不同的网络终端和网络安全域之间建立安全控制点,实现在不同的网络终端和网络安全域之间提供访问可控服务的产品。

6

反垃圾邮件产品

能够对垃圾邮件进行识别和处理的软件或软硬件组合,包括但不限于反垃圾邮件网关、反垃圾邮件系统、安装于邮件服务器的反垃圾邮件软件,以及与邮件服务器集成的反垃圾邮件产品等。

7

网络安全审计产品

采集网络、信息系统及其组件的记录与活动数据,并对这些数据进行存储和分析,以实现事件追溯、发现安全违规或异常的产品。

8

网络脆弱性扫描产品

利用扫描手段检测目标网络系统中可能存在的安全弱点的软件或软硬件组合的产品。

9

安全数据库系统

从系统设计、实现、使用和管理等各个阶段都遵循一套完整的系统安全策略的数据库系统,目的是在数据库层面保障数据安全。

10

网站数据恢复产品

提供对网站数据的监测、防篡改,并实现数据备份和恢复等安全功能的产品。

11

虚拟专用网产品

在互联网链路等公共通信基础网络上建立专用安全传输通道的产品。

12

防病毒网关

部署于网络和网络之间,通过分析网络层和应用层的通信,根据预先定义的过滤规则和防护策略实现对网络内病毒防护的产品。

13

统一威胁管理产品(UTM)

通过统一部署的安全策略,融合多种安全功能,针对面向网络及应用系统的安全威胁进行综合防御的网关型设备或系统。

14

病毒防治产品

用于检测发现或阻止恶意代码的传播以及对主机操作系统应用软件和用户文件的篡改、窃取和破坏等的产品。

15

安全操作系统

从系统设计、实现到使用等各个阶段都遵循了一套完整的安全策略的操作系统,目的是在操作系统层面保障系统安全。

16

安全网络存储

通过网络基于不同协议连接到服务器的专用存储设备。

17

公钥基础设施

支持公钥管理体制,提供鉴别、加密、完整性和不可否认服务的基础设施。

18

网络安全态势感知产品

通过采集网络流量、资产信息、日志、漏洞信息、告警信息、威胁信息等数据,分析和处理网络行为及用户行为等因素,掌握网络安全状态,预测网络安全趋势,并进行展示和监测预警的产品。

19

信息系统安全管理平台

对信息系统的安全策略以及执行该策略的安全计算环境、安全区域边界和安全通信网络等方面的安全机制实施统一管理的平台。

20

网络型流量控制产品

对安全域的网络进行流量监测和带宽控制的流量管理系统。

21

负载均衡产品

提供链路负载均衡、服务器负载均衡、网络流量优化和智能处理等功能的产品。

22

信息过滤产品

对文本、图片等网络信息进行筛选控制的产品。

23

抗拒绝服务攻击产品

用于识别和拦截拒绝服务攻击、保障系统可用性的产品。

24

终端接入控制产品

提供对接入网络的终端进行访问控制功能的产品。

25

USB移动存储介质管理系统

对移动存储设备采取身份认证、访问控制、审计机制等管理手段,实现移动存储设备与主机设备之间可信访问的产品。

26

文件加密产品

用于防御攻击者窃取以文件等形式存储的数据、保障存储数据安全的产品。

27

数据泄露防护产品

通过对安全域内部敏感信息输出的主要途径进行控制和审计,防止安全域内部敏感信息被非授权泄露的产品。

28

数据销毁软件产品

采用信息技术进行逻辑级底层数据清除,彻底销毁存储介质所承载数据的产品。

29

安全配置检查产品

基于安全配置要求实现对资产的安全配置检测和合规性分析,生成安全配置建议和合规性报告的产品。

30

运维安全管理产品

对信息系统重要资产维护过程实现单点登录、集中授权、集中管理和审计的产品。

31

日志分析产品

采集信息系统中的日志数据,并进行集中存储和分析的安全产品。

32

身份鉴别产品

要求用户提供以电子信息或生物信息为载体的身份鉴别信息,确认应用系统使用者身份的产品。

33

终端安全监测产品

对终端进行安全性监测和控制,发现和阻止系统和网络资源非授权使用的产品。

34

电子文档安全管理产品

通过制作安全电子文档或将电子文档转换为安全电子文档,对安全电子文档进行统一管理、监控和审计的产品。

 

 

 

 

相关网站链接:

https://www.cnca.gov.cn/zwxx/gg/lhfb/art/2023/art_d23c99a685b9449296052c2e4f9e8473.html

For additional information regarding this alert, please contact:

VSCB Specialists
 Email:Lisa.liu@vscbcorp.com


The following is an unofficial translation


Subject:Announcement on the adjustment of the Catalogue of Network Critical Equipment and Network Security Products

Content:On July 3, 2023, in accordance with the Cybersecurity Law of the People's Republic of China, the Cyberspace Administration of China, together with the Ministry of Industry and Information Technology, the Ministry of Public Security, the Certification and Accreditation Administration and other departments, updated the Catalogue of Network Critical Equipment and Network Security-Specific Products, which is hereby promulgated and shall come into force as of the date of issuance.

In 2017, the State Internet Information Office, the Ministry of Industry and Information Technology, the Ministry of Public Security, and the Certification and Accreditation Administration jointly issued the "Announcement on the release of < Network Critical Equipment and Network security Dedicated Product Catalog (the first batch) >" (2017 No. 1) in the network critical equipment and network security dedicated product catalog simultaneously repealed.

It is hereby announced.

Network critical equipment and network security dedicated product catalog

First, network key equipment

No.

DeviceCategory

Range

1

Router

System throughput (bidirectional) ≥12Tbps

The capacity of the routing table in the system is greater than or equal to 550,000 entries

2

Switch

System throughput (bidirectional) ≥30Tbps

Packet forwarding rate of the whole system ≥10Gpps

3

Server (rack)

The number of cpus must be greater than or equal to eight

The number of cpus must be at least 14

Memory capacity ≥256GB

4

Programmable logic controller (PLC equipment)

Controller instruction execution time ≤0.08 microseconds

 

 

Second, network security products

No.

Product Category

Product description

1

Data Backup and Restoration product

The product can back up and restore information system data and manage the backup and restoration process.

2

Firewall

The firewall analyzes the data flow and implements access control and security protection functions.

3

The Intrusion detection system (IDS)

Uses data packets on the network as the data source, listens to all data packets of the protected network nodes, and analyzes them to find abnormal behaviors.

4

The intrusion prevention system (IPS)

Is deployed on the network path in the form of a bridge or gateway. It detects network behaviors with intrusion characteristics by analyzing network traffic and intercepts them before they pass into the protected network.

5

 Network and Terminal isolation products

Establish security control points between different network terminals and network security domains to provide controllable access services between different network terminals and network security domains.

6

Anti-Spam products

Software or a combination of software and hardware that can identify and deal with spam, including but not limited to anti-spam gateways, anti-spam systems, anti-spam software installed on mail servers, and anti-spam products integrated with mail servers.

7

Network security audit products

Collect records and activity data of networks, information systems, and their components, and store and analyze these data to achieve event tracing and discover security violations or anomalies.

8

Network Vulnerability Scanning product

Software or a combination of software and hardware that uses scanning to detect possible security weaknesses in a target network system.

9

Secure database system

A database system that follows a complete set of system security policies from all stages of system design, implementation, use and management, is designed to ensure data security at the database level.

10

Website data recovery products

Provide website data monitoring, anti-tampering, and data backup and recovery and other security functions of the product.

11

Virtual private network products

A product that establishes a dedicated secure transmission channel on a public communication infrastructure network such as an Internet link.

12

Antivirus gateway

The product is deployed between networks, analyzes the communication between the network layer and the application layer, and protects against viruses on the network based on predefined filtering rules and protection policies.

13

Unified Threat Management Product (UTM)

A unified security policy integrates multiple security functions to comprehensively defend against security threats to networks and application systems.

14

Virus control products

Products used to detect or prevent the spread of malicious code and tampering, theft and destruction of host operating system applications and user files.

15

Secure operating system

The operating system from system design, implementation to use and other stages follow a complete set of security policies, the purpose is to ensure system security at the operating system level.

16

Secure network storage

A dedicated storage device connected to a server over a network based on different protocols.

17

Public key infrastructure

Support public key management system, provide authentication, encryption, integrity and non-repudiation service infrastructure.

18

Cybersecurity situational awareness products

By collecting network traffic, asset information, logs, vulnerability information, alarm information, threat information and other data, analyzing and processing network behavior and user behavior and other factors, grasp the network security status, predict the network security trend, and display, monitor and warn the product.

19

Information system security management platform

The platform implements unified management of the security policy of information system and the security mechanism of the secure computing environment, security zone boundary and secure communication network that execute the policy.

20

Network-based flow control products

A traffic management system that monitors traffic and controls bandwidth on the network in the security domain.

21

Load balancing product

 

It provides link load balancing, server load balancing, network traffic optimization, and intelligent processing.

22

Information filtering products

 

Text, pictures and other network information screening control products.

23

Denial of service attack resistant products

 

Products used to identify and intercept denial of service attacks and ensure system availability.

24

Terminal access control products

 

The product provides the access control function for terminals that access the network.

25

USB mobile storage media management system

 

The mobile storage device uses identity authentication, access control, and audit mechanisms to implement trusted access between the mobile storage device and host devices.

26

File encryption product

 

Protects data stored in files from attackers and ensures data security.

27

Data breach protection products

 

By controlling and auditing the main channels for the output of sensitive information inside the security zone, it prevents unauthorized disclosure of sensitive information inside the security zone.

28

Data destruction software products

 

Information technology is used to clear the underlying data at the logical level and completely destroy the products of the data carried by the storage media.

29

Security configuration Check the product

 

The product detects asset security configuration and analyzes asset compliance based on security configuration requirements, and generates security configuration suggestions and compliance reports.

30

Operation and maintenance security management products

 

The product implements single sign-on, centralized authorization, centralized management, and audit during the maintenance of important information system assets.

31

Log analysis product

 

A security product that collects log data from information systems and performs centralized storage and analysis.

32

Identity authentication product

 

Products that require users to provide identification information based on electronic information or biological information to confirm the identity of users of the application system.

33

Terminal security monitoring products

 

Monitor and control terminal security to detect and block unauthorized use of system and network resources.

34

Electronic document security management products

By creating or converting secure electronic documents into secure electronic documents, you can manage, monitor, and audit secure electronic documents in a unified manner.

 

 

Related website links:

https://www.cnca.gov.cn/zwxx/gg/lhfb/art/2023/art_d23c99a685b9449296052c2e4f9e8473.html

For additional information regarding this alert, please contact:

VSCB Specialists
 Email:Lisa.liu@vscbcorp.com


Loading...