T/GHDQ 105-2022 移动终端控车应用软件信息安全

ICS43.020

CCST40

团体标准

T/GHDQ105-2022

移动终端控车应用软件信息安全

Testingspecificationforcarcontrolmobileapplicationsecurity

2022-11-02发布2022-11-03实施

吉林省汽车电子协会发布

T/GHDQ105-2022

目次

前言.................................................................................III

引言...................................................................................V

1范围.................................................................................1

2规范性引用文件.......................................................................1

3术语和定义...........................................................................1

4缩略语...............................................................................2

5移动端应用程序安全检测...............................................................3

5.1移动端安全包签名校验检测.......................................................3

5.2移动端代码安全检测.............................................................3

5.3应用程序加固安全检测...........................................................3

5.4调试安全检测...................................................................3

5.5检测App程序不可被Root的手机设备中运行........................................3

6敏感信息安全基本技术要求检测.........................................................3

6.1密钥与证书安全检测.............................................................3

6.2日志安全检测...................................................................4

6.3隐私、敏感信息安全检测.........................................................4

6.4敏感个人信息安全检测...........................................................4

7账户安全基本技术要求检测.............................................................4

7.1检测移动端应用登入业务逻辑-多点登录............................................4

7.2检测移动端登入业务逻辑-防非法手机登入..........................................4

7.3检测移动端登入业务逻辑-登入时防被窃取..........................................4

7.4检测移动端登入业务逻辑-账户窃取登入防护........................................5

7.5检测移动端登入业务逻辑-短信验证................................................5

7.6检测移动端登入业务逻辑-调试接口关闭............................................5

7.7检测移动端登入业务逻辑-凭证暴力破解............................................5

7.8检测移动端登入业务逻辑-弱token.................................................5

7.9检测移动端登入业务逻辑-凭证有效性..............................................5

7.10检测移动端注册安全............................................................5

7.11检测汽车控制指令重放攻击......................................................5

7.12检测软键盘劫持................................................................5

8检测数据通信安全基本技术要求.........................................................6

8.1检测通信保密-安全协议..........................................................6

8.2检测通信保密-证书有效性........................................................6

8.3检测通信保密-关键数据加密......................................................6

8.4检测通信保密-数据合法性........................................................6

9通讯安全基本技术要求检测.............................................................6

9.1检测程序中断-通讯..............................................................6

I

T/GHDQ105-2022

9.2程序中断-网络中断或异常检测....................................................6

10WebView客户端、小程序、公众号