GB/Z 268-2026 物联网 可信原则

ICS35.110

CCSL79

中华人民共和国国家标准化指导性技术文件

GB/Z268—2026

物联网可信原则

InternetofThings（IoT）—Trustworthinessprinciples

（ISO/IECTS30149：2024，MOD）

2026⁃09⁃24发布

国家市场监督管理总局

国家标准化管理委员会发布

GB/Z268—2026

目次

前言··························································································································Ⅲ

引言··························································································································Ⅳ

1范围·······················································································································1

2规范性引用文件········································································································1

3术语和定义··············································································································1

4缩略语····················································································································2

5可信概念·················································································································2

5.1与信任的关系·····································································································2

5.2与环境的关系·····································································································3

5.3与特征、行为、保证和信赖的关系·············································································3

6特征·······················································································································3

6.1安全·················································································································3

6.2安全性··············································································································4

6.3隐私·················································································································6

6.4弹性·················································································································8

6.5可靠性··············································································································9

7可信管理·················································································································9

7.1概述·················································································································9

7.2假设················································································································10

7.3保证················································································································10

7.4风险················································································································11

7.5组合················································································································11

7.6可信配置··········································································································11

8可信构建···············································································································11

8.1通则················································································································11

8.2能力视角··········································································································12

8.3风险视角··········································································································13

8.4保证视角··········································································································13

8.5操作化·············································································································13

附录A（资料性）物联网可信最佳实践············································································17

A.1与ISO/IEC30141的关系····················································································17

A.2关注点············································································································17

A.3模式···············································································································18

参考文献····················································································································23

Ⅰ

GB/Z268—2026

前言

本文件为规范类指导性技术文件。

本文件按照GB/T1.1—2020《标准化工作导则第1部分：标准化文件的结构和起草规则》的规定

起草。

本文件修改采用ISO/IECTS30149：2024《物联网可信原则》，文件类型由ISO/IEC的技术规

范调整为我国的国家标准化指导性技术文件。

本文件与ISO/IECTS30149：2024的技术差异及原因如下：

——修改了隐私框架主体内容（见6.3.1），原因是隐私框架主体内容资料性引用的ISO/IEC29100：

2011已废止，并被ISO/IEC29100：2024替代，ISO/IEC29100：2011与ISO/IEC29100：2024

在相关内容上存在技术性差异，本文件依据ISO/IEC29100：2024的最新内容修改了隐私框

架主体内容。

本文件做了下列编辑性修改：

——删除了术语和定义的数据库信息（见第3章）；

——增加了术语中的注（见3.1）；

——删除了术语来源信息（见3.7）；

——使用ISO/IEC27706：2025代替了资料性引用的ISO/IECTS27006‑⁃2：2021；

——使用ISO/IEC9837：2026代替了资料性引用的ISO/IEC9837‑⁃1；

——使用ISO/IEC/IEEE15026‑⁃3：2023代替了资料性引用的ISO/IEC15026‑⁃3：2015；

——使用ISO/IEC29100：2024代替了资料性引用的ISO/IEC29100：2011；

——使用GB/T25000.10代替了资料性引用的ISO/IEC25010；

——增加了参考文献。

请注意本文件的某些内容可能涉及专利。本文件的发布机构不承担识别专利的责任。

本文件由全国信息技术标准化技术委员会（SAC/TC28）提出并归口。

本文件起草单位：中国电子技术标准化研究院、江苏赛西科技发展有限公司、重庆市质量和标准化

研究院、陕西省信息化工程研究院、浪潮电子信息产业股份有限公司、蚂蚁科技集团股份有限公司、

西南石油大学、无锡物联网产业研究院、国家石油天然气管网集团有限公司科学技术研究总院分公司、

中移物联网有限公司、北京邮电大学、西门子（中国）有限公司、金卡智能集团股份有限公司、中移

（杭州）信息技术有限公司、中国南方电网有限责任公司超高压输电公司、上海逸迅信息科技有限公司、

北京电信规划设计院有限公司、成都秦川物联网科技股份有限公司、中国石油天然气股份有限公司勘

探开发研究院西北分院、上海天臣微纳米科技股份有限公司、深圳盼月亮创新技术有限公司、天津鲲鹏

信息科技有限公司、天津市特种设备监督检验技术研究院、感知数链（无锡）科技有限公司、中建科技集

团有限公司、中国铁道科学研究院集团有限公司、豪尔赛科技集团股份有限公司、苏州格比智能科技有

限公司、深圳开鸿数字产业发展有限公司。

本文件主要起草人：王晓春、杨宏、苏静茹、郭雄、卓兰、张程、赵晓荣、张宇川、林冠辰、郑德生、吴明娟、

任武、罗永兵、高伟东、吴琪、郑水云、王亚莱、王宁、刘影、陈书义、李家京、邵汉舒、姚刚、周立雄、张学琴、

李应龙、郭琪、钱维林、曾涛、张惟皎、孙凡力、翁昌祥、贾景润、吴中骅、孙鹏、阮友德、戴聪棋、曹义军、

钱劲。

Ⅲ

GB/Z268—2026

引言

当前，许多物联网解决方案的复杂性不断增加，利益相关方如果缺乏对解决方案的正确背景认知

或技术理解，很难了解产品和方案的固有风险。信任作为一种核心概念，旨在确保所有利益相关方理

解解决方案的特定信任要素及其在特定用例中可能面临任何潜在风险。

不断增加的潜在漏洞和攻击复杂性仅仅是当前风险的一个方面。物联网解决方案的创建、构建和

部署过程涉及设计、组件和开发技术等要素。确保在每个组件的各个开发阶段都能识别信任要素，同

时考虑为所有利益相关方提供一种证明可信的方法。

本文件利用基于系统架构的方法确保本文件与ISO/IEC30141[1]1）中给出的产品和服务保持一

致，将使所有利益相关方能针对产品和解决方案实现可信。

本文件与ISO/IEC30141的关系见图1。

——本文件细化了物联网参考结构的可信视图。

——本文件在附录A中列出了多种模式，这些模式能用于物联网参考结构的构建视图。

注：GB/T33474—2025与ISO/IEC30141：2024的一致性关系为非等效。本文件同样细化了GB/T33474—2025的

可信视图，本文件附录A所列的多种模式为依据GB/T33474—2025构建的物联网系统提供可信实现参考。

图1本文件与ISO/IEC30141的关系

———————————

1）方括号中的数字对应参考文献。

Ⅳ

GB/Z268—2026

物联网可信原则

1范围

本文件根据ISO/IEC30141中规定的物联网参考结构给出了物联网可信要素。

2规范性引用文件

本文件没有规范性引用文件。

3术语和定义

下列术语和定义适用于本文件。

3.1

保证assurance

对某项声明（3.4）已经或将要得以实现的合理置信依据。

注1：保证是针对某项声明而言的。

注2：该声明可以是多项声明的组合。

[来源：ISO/IEC/IEEE15026‑⁃1：2025，3.1.1]

3.2

可组合性composability

不必对组件进行适配或开展额外接口工作，即能从逻辑和物理层面组装组件的能力。

注：“集成”通常表示投入显著的努力，“组合”通常表示所需努力有限，或者不必努力。

示例：组合硬件安全组件和数据存储组件以创建一个安全的数据存储组件。

[来源：GB/T43210.1—2023，3.3.1，有修改]

3.3

可信trustworthiness

以可验证的方式满足利益相关方期望的能力。

注1：根据具体情况或行业，以及所使用的具体产品或服务、数据、技术和流程，适用不同的特征，以及有必要进行验

证以确保满足利益相关方的期望。

注2：可信的特征包括但不限于可问责性、准确性、真实性、可获得性、可控性、完整性、隐私、质量、可靠性、弹性、鲁

棒性、安全、安全性、透明度和可用性。

注3：可信是一种适用于服务、产品、技术、数据和信息以及组织的属性。

注4：可验证性包括基于客观证据的可测量性和可论证性。

[来源：ISO/IECTS5723：2022，3.1.1]

3.4

声明claim

表示物联网系统的某项要求，如果满足该要求，物联网系统将能实现可接受的风险水平。

[来源：ISO/IEC/IEEE15026‑⁃1：2025，3.1.10，有修改]

3.5

生态系统ecosystem

基于组织和利益相关方网络的基础设施和服务。

1