FprEN 18031-1

SLOVENSKI STANDARD
oSIST prEN 18031-1:2023
01-november-2023
Splošne varnostne zahteve za radijsko opremo - 1. del: Radijska oprema,
povezana z internetom
Common security requirements for radio equipment - Part 1: Internet connected radio
equipment
Gemeinsame Sicherheitsanforderungen für mit dem Internet verbundene Funkanlagen
Exigences de sécurité communes applicables aux équipements radioélectriques
connectés à linternet
Ta slovenski standard je istoveten z: prEN 18031-1
ICS:
33.060.01 Radijske komunikacije na Radiocommunications in
splošno general
oSIST prEN 18031-1:2023 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

oSIST prEN 18031-1:2023
oSIST prEN 18031-1:2023
EUROPEAN STANDARD DRAFT
prEN 18031-1
NORME EUROPÉENNE
EUROPÄISCHE NORM
August 2023
ICS
English version
Common security requirements for radio equipment - Part
1: Internet connected radio equipment
Exigences de sécurité communes applicables aux Gemeinsame Sicherheitsanforderungen für mit dem
équipements radioélectriques connectés à l¿internet Internet verbundene Funkanlagen
This draft European Standard is submitted to CEN members for enquiry. It has been drawn up by the Technical Committee
CEN/CLC/JTC 13.
If this draft becomes a European Standard, CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal
Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any
alteration.
This draft European Standard was established by CEN and CENELEC in three official versions (English, French, German). A
version in any other language made by translation under the responsibility of a CEN and CENELEC member into its own language
and notified to the CEN-CENELEC Management Centre has the same status as the official versions.

CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.

Recipients of this draft are invited to submit, with their comments, notification of any relevant patent rights of which they are
aware and to provide supporting documentation.Recipients of this draft are invited to submit, with their comments, notification
of any relevant patent rights of which they are aware and to provide supporting documentation.

Warning : This document is not a European Standard. It is distributed for review and comments. It is subject to change without
notice and shall not be referred to as a European Standard.

CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2023 CEN/CENELEC All rights of exploitation in any form and by any means
Ref. No. prEN 18031-1:2023 E
reserved worldwide for CEN national Members and for
CENELEC Members.
oSIST prEN 18031-1:2023
prEN 18031-1:2023 (E)
16 Contents Page
18 European foreword . 4
19 Introduction . 5
20 1 Scope . 6
21 2 Normative references . 6
22 3 Terms and definitions . 6
23 4 Application of this standard . 10
24 5 Requirements . 12
25 5.1 [ACM] Access control mechanism . 12
26 5.1.1 [ACM-1] Applicability of access control mechanisms . 12
27 5.1.2 [ACM-2] Appropriate access control mechanisms . 15
28 5.2 [AUM] Authentication mechanism . 19
29 5.2.1 [AUM-1] Applicability of authentication mechanisms for external interfaces . 19
30 5.2.2 [AUM-2] Appropriate authentication mechanisms for external interfaces . 25
31 5.2.3 [AUM-3] Authenticator validation . 28
32 5.2.4 [AUM-4] Changing authenticators. 31
33 5.2.5 [AUM-5] Preventing static and default values . 35
34 5.2.6 [AUM-6] Brute force protection . 38
35 5.3 [SUM] Secure update mechanism . 42
36 5.3.1 [SUM-1] Applicability of update mechanisms. 42
37 5.3.2 [SUM-2] Secure updates . 45
38 5.3.3 [SUM-3] Automated updates . 49
39 5.4 [SSM] Secure storage Mechanism . 52
40 5.4.1 [SSM-1] Applicability of secure storage mechanisms . 52
41 5.4.2 [SSM-2] Appropriate integrity protection for secure storage mechanisms . 55
42 5.4.3 [SSM-3] Appropriate confidentiality protection for secure storage mechanisms . 58
43 5.5 [SCM] Secure communication mechanism . 61
44 5.5.1 [SCM-1] Applicability of secure communication mechanisms . 61
45 5.5.2 [SCM-2] Appropriate integrity and authenticity protection for secure communication
46 mechanisms . 65
47 5.5.3 [SCM-3] Appropriate confidentiality protection for secure communication
48 mechanisms . 68
49 5.5.4 [SCM-4] Appropriate replay protection for secure communication mechanisms . 72
50 5.6 [RLM] Resilience mechanism. 76
51 5.6.1 [RLM-1] Applicability of resilience mechanisms . 76
52 5.7 [NMM] Network monitoring mechanism . 80
53 5.7.1 [NMM-1] Applicability of and appropriate network monitoring mechanisms . 80
54 5.8 [TCM] Traffic control mechanism . 83
55 5.8.1 [TCM-1] Applicability of and appropriate traffic control mechanisms . 83
56 5.9 [CCK] Confidential cryptographic keys . 86
57 5.9.1 [CCK-1] Appropriate Confidential cryptographic keys (CCKs) . 86
58 5.9.2 [CCK-2] Confidential cryptographic key generation mechanisms . 89
59 5.9.3 [CCK-3] No hard-coded confidential cryptographic keys . 91
60 5.9.4 [CCK-4] Preventing static default values for confidential cryptographic keys. 93
oSIST prEN 18031-1:2023
prEN 18031-1:2023 (E)
61 5.10 [GEC] General equipment capabilities . 97
62 5.10.1 [GEC-1] Up-to-date software and hardware with no publicly known exploitable
63 vulnerabilities . 97
64 5.10.2 [GEC-2] Limit exposure of services via related network interfaces . 99
65 5.10.3 [GEC-3] Configuration of optional services and the related exposed network
66 interfaces . 102
67 5.10.4 [GEC-4] Documentation of exposed services via network interfaces . 104
68 5.10.5 [GEC-5] No unnecessary external interfaces . 106
69 5.10.6 [GEC-7] Input validation . 108
70 5.11 [CRY] Cryptography . 113
71 5.11.1 [CRY-1] Best practice Cryptography . 113
72 Annex A (informative) Rationale . 117
73 A.1 General . 117
74 A.2 Rationale . 117
75 A.2.1 Family of standards . 117
76 A.2.2 Security by design . 117
77 A.2.3 Assets . 117
78 A.2.4 Mechanisms . 118
79 A.2.5 Assessment criteria . 118
80 A.2.5.1 Decision trees . 119
81 A.2.5.2 Technical documentation . 119
82 A.2.5.3 Security testing . 121
83 A.2.6 Security parameters . 121
84 Annex ZA (informative) . 122
85 Table ZA.1 — Correspondence between this European Standard and Directive 2014/53/EU
86 [OJ L 153] . 122
87 Bibliography . 123
oSIST prEN 18031-1:2023
prEN 18031-1:2023 (E)
91 European foreword
92 This document (prEN 18031-1:2023) has been prepared by Technical Committee CEN/CENELEC JTC
93 13/WG 8 “Special Working Group RED Standardization Request”, the secretariat of which is held by NEN.
94 This document is currently submitted to the CEN Enquiry.
95 This document has been prepared under a mandate given to CEN/CENELEC by the European Commission
96 and the European Free Trade Association and supports essential requirements of EU Directive(s) /
97 Regulation(s).
98 For relationship with EU Directive(s) / Regulation(s), see informative Annex ZA, which is an integral part
99 of this document.
oSIST prEN 18031-1:2023
prEN 18031-1:2023 (E)
100 Introduction
101 It is important to note that in order to achieve the overall cybersecurity of radio equipment, defence in
102 depth best practices will be needed. In particular, no one single measure will suffice to achieve the given
103 objectives, indeed achieving even a single security objective will usually require a suite of mechanisms
104 and measures. Throughout this document, the guidance material includes lists of examples. These lists
105 must be read only as indicative possibilities: there are other possibilities that are not listed, and even
106 using the examples given will not be sufficient unless the mechanisms and measures chosen are
107 implemented in a coordinated fashion.
oSIST prEN 18031-1:2023
prEN 18031-1:2023 (E)
108 1 Scope
109 This document specifies common security requirements for internet-connected radio equipment. This
110 document provides technical specifications for radio equipment, which concerns electrical or electronic
111 products that are capa
...