New Railway Critical Information Infrastructure Protection Regulation: Prioritize Procurement of Secure and Trustworthy Network Products and Services!

Recently, to protect the security of railway critical information infrastructure and maintain cybersecurity, the National Railway Administration has drafted the “Administrative Measures for the Security Protection of Railway Critical Information Infrastructure (Draft for Public Comments)” in accordance with the Cybersecurity Law of the People’s Republic of China and the Regulations on the Security Protection of Critical Information Infrastructure, and is now soliciting public feedback.

Article 14 of the Draft states: Operators shall strengthen supply chain security protection and prioritize the procurement of secure and trustworthy network products and services; where the procurement of network products and services impacts or may impact national security, operators shall assess the potential national security risks arising after the products and services are put into use and declare cybersecurity review in accordance with relevant national regulations.

Critical infrastructure extends deep into every important area of society, politics, and the economy, serving as a vital asset for national development. Railway critical information infrastructure refers to the important network facilities and information systems in the railway sector that, if destroyed, disabled, or subject to data leakage, could severely jeopardize national security, the national economy, people’s livelihoods, and public interests. In recent years, cyber attacks on critical information infrastructure have become increasingly common both domestically and internationally. The introduction of this Draft for Public Comments is a necessary step to strengthen the security protection of critical infrastructure and safeguard cybersecurity in the transportation sector.

Homegrown, Secure, and Trustworthy Products Build a Protective Shield for Critical Infrastructure

In the mission to protect critical information infrastructure, cybersecurity product and service providers supply operators with technological “ammunition” and design security frameworks, forming the capability base for critical infrastructure protection.

As China accelerates the national strategy for IT application innovation, railway systems are rapidly setting up testing environments for innovative IT, piloting domestic replacement of foundational software such as databases and operating systems, promoting the localization and indigenization of control systems and key equipment, and intensifying efforts to replace foreign chips in EMU and train control systems with homegrown alternatives to build controller design capabilities based on domestic components…

To overcome the “bottleneck” technologies in database systems for critical information infrastructure protection, GBASE has persisted in independent innovation for two decades, driven core R&D, and solidified the data underpinning for railway critical information infrastructure security, offering domestically developed GBase database products as a trusted barrier for the design, implementation, and operation of critical infrastructure protection and IT construction.

GBASE Database Widely Deployed Across the Railway Sector

Through over a decade of product delivery and service support, GBASE has grown alongside the evolution of railway critical infrastructure protection, partnering with railway users to create numerous industry benchmarks.

In the next-generation 12306 ticket system analytics platform project of the China Academy of Railway Sciences, GBASE supports the China State Railway Group headquarters and regional railway bureaus in storing and processing over 200TB of data, delivering sub-second efficient online analytical queries on hundreds of billions of data records, and enabling precise, fast query responses for ticket checking and purchasing.

In the data integration project between China State Railway Group’s external collaboration platform and the National Integrated Government Service Platform, GBase database serves as a pre-positioned repository for business and security operation data of the government service platform and the “Internet + Supervision” system, responsible for data storage and exchange in the pre-positioned zone, achieving seamless integration at the data layer between railway information systems and the National Integrated Government Service Platform.

Conclusion

Railway critical information infrastructure bears on national security, the national economy, people’s livelihoods, and public interests. The release of the Draft for Public Comments elevates awareness of its protection to a new height and provides a policy basis and direction for competent authorities and security vendors in building cybersecurity defenses. Under these new policies, contexts, and philosophies, GBASE will continue to explore data security technologies, enhance the self-reliance and controllability of cybersecurity protection, and escort the safety of railway critical information infrastructure.