| Standard ID | Contents [version] | USD | STEP2 | [PDF] delivered in | Standard Title (Description) | Status | PDF |
| JR/T 0193-2020 | English | RFQ |
ASK
|
3 days [Need to translate]
|
(Blockchain technology financial application evaluation rules)
| Valid |
JR/T 0193-2020
|
PDF similar to JR/T 0193-2020
Basic data | Standard ID | JR/T 0193-2020 (JR/T0193-2020) | | Description (Translated English) | (Blockchain technology financial application evaluation rules) | | Sector / Industry | Finance Industry Standard (Recommended) | | Classification of Chinese Standard | A11 | | Word Count Estimation | 100,184 | | Date of Issue | 2020-07-10 | | Date of Implementation | 2020-07-10 | | Regulation (derived from) | Notice of the National Financial Standardization Technical Committee (2020.07.10) | | Issuing agency(ies) | People's Bank of China | JR/T 0193-2020: (Blockchain technology financial application evaluation rules)---This is a DRAFT version for illustration, not a final translation. Full copy of true-PDF in English version (including equations, symbols, images, flow-chart, tables, and figures etc.) will be manually/carefully translated upon your order.
Financial application of blockchain technology-Evaluation rules
ICS 35.240.40
A 11
JR
People's Republic of China Financial Industry Standards
Blockchain technology financial application evaluation rules
2020-07-10 released
2020-07-10 implementation
Issued by the People's Bank of China
Table of contents
Foreword...III
1 Scope...1
2 Normative references...1
3 Terms and definitions...1
4 Abbreviations...3
5 General...3
5.1 Evaluation objectives...3
5.2 Starting conditions...3
5.3 Evaluation method...3
5.4 Evaluation criteria...3
6 Evaluation of basic requirements...4
6.1 Ledger technology...4
6.2 Consensus Protocol...17
6.3 Smart Contract...20
6.4 Node communication...24
6.5 Event Distribution...27
6.6 Key Management...29
6.7 State Management...32
6.8 Member Management...36
6.9 Trading System...43
6.10 Interface Management...47
7 Performance Evaluation...51
7.1 Transaction Throughput Rate...51
7.2 Querying Throughput Rate...52
7.3 Transaction synchronization performance...53
7.4 Deployment efficiency...55
7.5 Growth rate of ledger data...55
8 Security Assessment...56
8.1 Basic hardware...56
8.2 Basic software...59
8.3 Cryptographic Algorithm...64
8.4 Node communication...67
8.5 Ledger data...69
8.6 Consensus Protocol...76
8.7 Smart Contract...79
8.8 Identity Management...81
8.9 Privacy protection...85
8.10 Regulatory support...87
8.11 Security O&M...89
8.12 Security governance...92
Foreword
This standard was drafted in accordance with the rules given in GB/T 1.1-2009.
This standard was proposed by the People's Bank of China.
This standard is under the jurisdiction of the National Financial Standardization Technical Committee (SAC/TC 180).
Drafting organizations of this standard. Department of Science and Technology of the People’s Bank of China, Digital Currency Research Institute of the People’s Bank of China, China Financial Electronics Corporation, China
China UnionPay Co., Ltd., China Banknote Blockchain Technology Research Institute, China Development Bank, Industrial and Commercial Bank of China Co., Ltd., China Agriculture
Bank of China Co., Ltd., Bank of China Co., Ltd., China Construction Bank Co., Ltd., Bank of Communications Co., Ltd.,
Commercial Bank Co., Ltd., Shanghai Pudong Development Bank Co., Ltd., China CITIC Bank Co., Ltd., Industrial Bank Co., Ltd.
Company, China Minsheng Bank Co., Ltd., Zhejiang Internet Commercial Bank Co., Ltd., Shenzhen Qianhai WeBank Co., Ltd., Everbright
Technology Co., Ltd., Ping An Insurance (Group) Co., Ltd. of China, Taikang Insurance Group Co., Ltd., Huatai Securities Co., Ltd.
Company, Shenzhen Tencent Computer System Co., Ltd., JD Digital Technology Holdings Co., Ltd., Baidu Online Network Technology (Beijing)
Co., Ltd., Zhejiang Ant Small and Micro Financial Services Group Co., Ltd., Huawei Technologies Co., Ltd., Longying Zhida (Beijing) Technology Co., Ltd.
Company, Hangzhou Xita Technology Co., Ltd., Hangzhou Fun Chain Technology Co., Ltd., Beijing Qingxin Technology Co., Ltd., Hangzhou Yunxiang Network Technology
Limited Company, Tsinghua University, Peking University, Institute of Computing Technology, Chinese Academy of Sciences, Institute of Financial Technology, Renmin University of China, China Pay
Clearing Association, Beijing Zhongjin Guosheng Certification Co., Ltd., Beijing UnionPay Gold Card Technology Co., Ltd.
The main drafters of this standard. Li Wei, Mu Changchun, Di Gang, Li Xingfeng, Qu Weimin, Cheng Sheng, Guo Dong, Duan Lifa, Gao Tian, Zhao Xinyu,
Liu Mingjun, Huang Qin, Zhuang Guangyao, Wang Yang, Fan Yuanyuan, Guo Jian, Lin Hainan, Xie Jin, Wang Guangzhong, Wang Bei, Feng Chengyong, Liu Yun, Chen Zhiming,
Wang Tong, Huang Haiquan, Yao Qian, Sun Yi, Zhang Hanwen, Liu Yao, Wang Yanbo, Liu Xizi, Yu Pei, Xiang Haifei, Luo Hongwei, Song Zheng, Song Ke,
Wu Yongqiang, Fu Bo, Li Bin, Xu Lei, Lin Hua, Wang Liancheng, Chen Linxue, Li Yaorong, Peng Shunqiu, Chen Fashan, Lin Wenxuan, Yu Xiao, Guo Jian,
Bai Yang, Zhang Xiaojun, Chen Lijun, Wang Lei, Li Hongjian, Xu Chenglin, Sun Hongxuan, Zhang Liyong, Chen Pan, Li Shi, Wen Yuhui, Lin Chun, Wang Xuan,
Liu Weihuai, Xiao Yao, Zan Chao, Zhang Haipeng, Chen Xuexiu, Zhao Shuxiang, Yang Qiulin, Li Yiping, Yan'an, Lin Hua, Chen Xiaofeng, Zheng Peiyu, Zhang
Lu, Wu Yuhui, Yan Jipan, Fu Xiaoyan, Li Li, Guo Linhai, Luo Meiqin, Chang Wenting, Xu Quanqing, Huang Kaifeng, Pan Haiqing, Yu Zhibei,
Wang Congli, Huang Butian, Jin Bo, Yang Bo, Qiao Kexin, Guan Chunsheng, Chen Zhong, Guan Zhi.
Blockchain technology financial application evaluation rules
1 Scope
This standard specifies the specific implementation requirements, evaluation methods, and judgment criteria for financial applications of blockchain technology.
This standard is applicable to product design, software development, and system evaluation of financial institutions carrying out blockchain technology financial applications.
2 Normative references
The following documents are indispensable for the application of this document. For dated reference documents, only the dated version applies to this document.
For undated references, the latest version (including all amendments) applies to this document.
GB/T 5271.18-2008 Information Technology Vocabulary
GB/T 22239-2019 Information Security Technology Network Security Level Protection Basic Requirements
GB/T 32915 Information Security Technology Binary Sequence Randomness Detection Method
JR/T 0171-2020 Personal Financial Information Protection Technical Specification
JR/T 0184-2020 Financial Distributed Ledger Technology Security Specification
3 Terms and definitions
The following terms and definitions apply to this document.
3.1
Blockchainblockchain
One is jointly maintained by multiple parties, uses cryptography to ensure transmission and access security, and can achieve consistent data storage, tamper-proof, and non-repudiation
Technical system.
Note. A typical blockchain implements data storage in a block chain structure.
3.2
Block
The unit of data storage in the blockchain.
Note. It consists of block header and block body.
3.3
Consensus node
The node responsible for the consistency of the ledger data.
[JR/T 0184-2020, definition 3.24]
3.4
Accounting node
The node responsible for the integrity of the ledger data.
[JR/T 0184-2020, definition 3.25]
3.5
User
The basic unit that participates in the actual responsible subject on the blockchain.
3.6
Data changes
The operation of changing the data of a single or multiple accounts on the blockchain.
Examples. deployment of smart contracts, change of contract status, modification of configuration parameters, etc.
3.7
Atomicity
If an error occurs during the execution of the smart contract, it will be rolled back to the state before the start of the smart contract.
[JR/T 0184-2020, definition 3.36]
3.8
Transaction
An atomic account data state change on the blockchain and its process and result records.
3.9
Asset
It can be issued, circulated, stored, and traded on the blockchain to complete the rights and interests of the payment and clearing business.
3.10
Node authorization
The action of determining whether a requesting node (object) has the authority to access resources (subject) in the blockchain system.
3.11
Peer-to-peer network
A computer network that contains only nodes equivalent to control and operation capabilities.
[GB/T 5271.18-2008]
3.12
Consensus protocol
The calculation method used to reach agreement among nodes in the distributed ledger system.
[JR/T 0184-2020, definition 3.17]
3.13
Smart contract
A computer protocol designed to spread, verify, or execute contracts in an information-based way, which is embodied in a distributed ledger that can be automatically executed
Computer program.
[JR/T 0184-2020, definition 3.20]
4 Abbreviations
The following abbreviations apply to this document.
5 General
5.1 Evaluation objectives
On the basis of determining the version of the blockchain technology financial application system, the basic requirements, performance, and security of the blockchain financial application
Evaluate, objectively and fairly evaluate whether the system can guarantee the safe and stable operation of blockchain financial facilities and applications.
5.2 Starting conditions
The starting conditions specifically include.
a) The tested version of the submitted system (or executable file) should be consistent with the production version.
b) The submitted system should have completed internal testing.
c) System requirements specification, system design specification, user manual (including but not limited to operation and maintenance manual, user manual), product manual
Relevant documents (including but not limited to component lists, feature indicators, system architecture) and other related documents should be prepared.
d) Minimum hardware requirements. Institutions should disclose the minimum hardware requirements for normal operation of their blockchain system under the requirements of consensus validity.
Source, including hardware equipment and network requirements, needs to verify the completeness of functions and reliability under the minimum hardware environment.
e) The evaluation environment should be prepared, including.
1) The evaluation environment should be consistent or basically the same as the production environment, and the basic requirements, performance, and safety should be carried out in the production environment.
2) The tested version of the system and other related peripheral systems and equipment should have been deployed and configured correctly.
3) The basic data for basic requirements and performance evaluation should be prepared.
4) The evaluation equipment should be ready and the system and software installed.
5) The assessment environment network should be configured correctly and connected smoothly to meet the assessment requirements.
5.3 Evaluation method
The evaluation method and description are as follows.
a) Review materials. review audit reports, self-examination reports, external evaluation reports, design documents, development documents, user documents, management
Documents, product inspection reports and other related materials.
b) View system. View system logs, configuration files, parameter settings, product version, network configuration, etc.
c) Interviewer. conduct activities such as communication and discussion with relevant personnel of the tested system or product to obtain relevant evidence and understand relevant information.
d) Test system. Use professional tools to scan and detect the target system to produce specific responses and other activities,
By analyzing the response results, obtaining evidence to prove whether the basic requirements, performance, and security of the information system can be effectively implemented.
5.4 Evaluation criteria
5.4.1 Problem classification
5.4.1.1 Severity issues
The principles for determining the severity of issues are as follows.
a) Obvious conflicts with relevant laws, regulations and standards.
b) Failure to meet the relevant requirements in this standard, resulting in.
1) The situation where the basic operation and safety requirements of the system cannot be met.
2) A situation where there is a major security risk that will cause serious damage to the interests of customers.
3) Circumstances where the regulatory support requirements cannot be met, and operational activities cannot be effectively supervised.
5.4.1.2 General issues
The principles for determining general issues are as follows.
a) Failure to meet the relevant requirements in this standard, resulting in.
1) The partial function cannot be used normally, but it does not affect the realization of the overall process of the system.
2) There are security risks that will cause direct or potential damage to the interests of customers.
3) There are defects in the supervision support, which is not conducive to the legal supervision of the management department.
5.4.1.3 Suggested questions
The principles for determining suggested issues are as follows.
a) Failure to meet the relevant requirements in this standard, resulting in.
1) The function can be used normally, but the ease of use of the system is poor.
2) There are security risks, but it will not cause direct or potential damage to the interests of customers.
5.4.2 Judgment Principles of Evaluation Results
The evaluation results are determined as follows.
a) Compliance. During the evaluation process, no problems or only suggestive problems are found, and the evaluation result of the evaluation item is judged as "compliant".
b) Non-conformity. During the evaluation process, serious and general problems are found, and the evaluation result of the evaluation item is judged as "non-conformity".
c) Not applicable. During the evaluation process, according to the system statement and the applicability of the applicable object in each evaluation item, it is not the evaluation of the applicable object
The item can be judged as "not applicable".
6 Evaluation of basic requirements
6.1 Ledger technology
6.1.1 Data storage method
The data storage method evaluation content is shown in Table 1.
6.1.5 Data Archiving
The evaluation content of the data archiving function is shown in Table 5.
6.1.6 Data expansion
The data expansion assessment content is shown in Table 6.
6.1.7 Data cross-chain function
If the ledger data cross-chain function is supported, the evaluation content of the data cross-chain function is shown in Table 7.
6.1.8 Data fragmentation function
If the data fragmentation technology is supported, the evaluation content of the data fragmentation function is shown in Table 8.
6.2 Consensus Agreement
6.2.1 Consensus Algorithm
The evaluation content of the consensus algorithm is shown in Table 9.
6.2.2 Consistency
The content of consensus algorithm consistency assessment is shown in Table 10.
6.2.4 Fault tolerance threshold
The content of the consensus mechanism fault tolerance threshold evaluation is shown in Table 12.
6.2.5 Reliability
The reliability evaluation content of the consensus algorithm is shown in Table 13.
6.2.6 Scalability
The content of scalability evaluation is shown in Table 14.
6.3 Smart Contract
6.3.1 Smart contract virtual machine
The evaluation content of the smart contract virtual machine is shown in Table 15.
6.3.2 Smart contract programming language
The programmability evaluation content of the smart contract is shown in Table 16.
6.3.3 Smart contract compilation
The content of smart contract source code compilation and evaluation is shown in Table 17.
6.3.4 Correctness of Smart Contract
See Table 18 for the correctness evaluation of smart contracts.
6.3.5 Smart contract consistency
Refer to Table 19 for the content of the consistency evaluation of smart contract call execution.
6.3.6 Smart contract reliability
The content of the smart contract reliability assessment is shown in Table 20.
6.3.7 Smart contract business isolation
See Table 21 for the content of smart contract business isolation evaluation.
6.3.8 Smart contract life cycle management
See Table 22 for the assessment content of the full life cycle management of smart contracts.
6.3.9 Smart contract version control
The content of smart contract version control evaluation is shown in Table 23.
6.4 Node communication
6.4.1 Networking mode
See Table 24 for the evaluation content of the networking mode.
6.4.2 Message forwarding
The message forwarding evaluation content is shown in Table 25.
6.4.4 Node exit
Refer to Table 27 for node exit evaluation content.
6.5 Event distribution
The content of event distribution evaluation is shown in Table 28.
6.6 Key Management
6.6.1 Key generation
The key generation evaluation content is shown in Table 29.
6.6.2 Key storage
The key storage evaluation content is shown in Table 30.
6.6.3 Key update
The evaluation content of the key update is shown in Table 31.
6.6.4 Key usage
See Table 32 for the evaluation content of key usage.
6.6.5 Key revocation, destruction and archiving
See Table 33 for key revocation, destruction and archive evaluation.
6.7 State management
6.7.1 Query block height
See Table 34 for the content of query block height evaluation.
6.7.2 Query block details
See Table 35 for the detailed evaluation content of the query block.
6.7.3 Query transaction information
See Table 36 for the evaluation content of query transaction information.
6.7.4 Query transaction results
See Table 37 for the evaluation content of query transaction results.
6.7.5 Query the status of the ledger
See Table 38 for the content of the status evaluation of the query ledger.
6.7.6 Ledger status update
See Table 39 for the assessment content of the status update of the ledger.
6.8 Member Management
6.8.1 User registration
See Table 40 for user registration evaluation content.
6.8.2 User identification
Refer to Table 41 for user identification evaluation content.
6.8.3 User permissions change
See Table 42 for the evaluation content of user authority change.
6.8.4 User role authorization
The user role authorization evaluation content is shown in Table 43.
6.8.5 Freeze and unfreeze user accounts
See Table 44 for the evaluation content of user account freezing and unfreezing.
6.8.6 User logout
Refer to Table 45 for user logout evaluation content.
6.8.7 User Information Query
See Table 46 for user information query and evaluation content.
6.8.8 User transactions
See Table 47 for user transaction evaluation content.
6.9 Trading System
6.9.1 Smart contract deployment transaction
If smart contract deployment is supported, see Table 48 for the evaluation content of smart contract deployment transactions.
6.9.2 Smart contract method call transaction
Refer to Table 49 for the evaluation content of smart contract calling methods.
6.9.3 Native transaction
If native transaction function is provided, the content of native transaction evaluation is shown in Table 50.
6.9.4 Transaction atomicity
See Table 51 for transaction atomicity evaluation.
6.10 Interface Management
6.10.1 External interface
The external interface evaluation content is shown in Table 52.
6.10.2 User Interface
The user interface evaluation content is shown in Table 53.
6.10.3 Management interface
The management interface evaluation content is shown in Table 54.
6.10.4 Inter-system interface
See Table 55 for the evaluation content of the interface between systems.
7 Performance evaluation
7.1 Transaction throughput rate
See Table 56 for the evaluation content of transaction throughput.
7.2 Query throughput rate
See Table 57 for the content of the query throughput evaluation.
7.3 Transaction synchronization performance
The transaction synchronization performance evaluation content is shown in Table 58.
7.4 Deployment efficiency
The deployment efficiency assessment content is shown in Table 59.
7.5 Growth rate of ledger data
See Table 60 for the performance evaluation of single node data capacity growth rate.
8 Safety assessment
8.1 Basic hardware
8.1.1 Basic conditions
See Table 61 for the basic hardware requirements assessment content.
8.1.2 Physical Security
8.1.2.1 Site safety
See Table 62 for site safety assessment content.
8.1.2.2 Hardware equipment
See Table 63 for hardware equipment evaluation.
8.1.2.3 Node deployment security
See Table 64 for the node deployment security assessment content.
8.1.2.4 Hardware encryption device security
See Table 65 for the security assessment content of hardware encryption equipment.
8.1.3 Network Security
8.1.3.1 Network architecture security
The content of the network architecture security assessment is shown in Table 66.
8.1.3.2 Communication transmission security
See Table 67 for the content of the communication transmission security assessment.
8.2 Basic software
8.2.1 Basic conditions
The basic requirements assessment content of the basic software is shown in Table 68.
8.2.2 Ledger structure
See Table 69 for the evaluation content of the ledger structure.
8.2.3 Data storage
The data storage evaluation content is shown in Table 70.
8.2.4 Consensus module
The evaluation content of the consensus module is shown in Table 71.
8.2.5 Distributed networking
See Table 72 for the evaluation content of distributed networking.
8.2.6 Smart Contract
The content of smart contract evaluation is shown in Table 73.
8.2.7 Interface design
The interface design evaluation content is shown in Table 74.
8.2.8 Data Transmission
The data transmission evaluation content is shown in Table 75.
8.2.9 Time synchronization
The time synchronization assessment content is shown in Table 76.
8.2.10 Operating System
Operating system evaluation content is shown in Table 77.
8.3 Cryptographic Algorithm
8.3.1 Algorithm basic conditions
8.3.1.1 Symmetric encryption and decryption
See Table 78 for the evaluation content of symmetric encryption and decryption.
8.3.1.2 Asymmetric encryption and decryption
Asymmetric encryption and decryption evaluation content is shown in Table 79.
8.3.1.3 Hash Algorithm
The evaluation content of the hash algorithm is shown in Table 80.
8.3.1.4 Random number
The random number evaluation content is shown in Table 81.
8.3.2 Confidentiality
The confidentiality assessment content is shown in Table 82.
8.3.3 Completeness
See Table 83 for completeness assessment content.
8.3.4 Authenticity
The authenticity assessment content is shown in Table 84.
8.4 Node communication
8.4.1 Node authentication
See Table 85 for the node identity verification evaluation content.
8.4.2 Communication integrity
The content of communication integrity assessment is shown in Table 86.
8.4.3 Communication confidentiality
The content of communication confidentiality assessment is shown in Table 87.
8.5 Ledger data
8.5.1 Ledger data integrity
The content of the integrity assessment of the ledger data is shown in Table 88.
8.5.2 Ledger data consistency
The content of the consistency assessment of the ledger data is shown in Table 89.
8.5.3 Confidentiality of ledger data
The content of the confidentiality assessment of the ledger data is shown in Table 90.
8.5.4 Validity of ledger data
See Table 91 for the content of the validity evaluation of the ledger data.
8.5.5 Ledger data redundancy
The content of the data redundancy assessment of the ledger is shown in Table 92.
8.5.7 Ledger data security audit
See Table 94 for the content of the account book data security audit evaluation.
8.6 Consensus Agreement
8.6.1 Legality
The content of the legitimacy assessment of the consensus protocol is shown in Table 95.
8.6.3 Finality
The final evaluation content of the consensus protocol is shown in Table 97.
8.6.4 Unforgeability
The unforgeability assessment content of the consensus protocol is shown in Table 98.
|