EN 18031-2 EUROPEAN STANDARD NORME EUROPEENNE EUROPAISCHE NORM August 2024 ICS 33.060.20 English version Common security requirements for radio equipment - Part 2: radio equipment processing data, namely Internet connected radio equipment, childcare radio equipment, toys radio equipment and wearable radio equipment Exigences de sécurite communes applicables aux Gemeinsame Sicherheitsanforderungen fur équipementsradioélectriques-Partie2:Equipements datenverarbeitendeFunkanlagen,namentlichmitdem radioelectriques quitraitent des donnees,a savoir les InternetverbundeneFunkanlagen,inder équipementsradioélectriquesconnectésal'internet, Kinderbetreuung eingesetzte Funkanlagen, in les équipementsradioélectriquesdestinesalagarde SpielzeugeingesetzteFunkanlagen sowiean einemTeil d'enfants, les jouets dotés d'équipements desmenschlichenKorpersoderanKleidungsstiucken radioélectriques et les équipements radioelectriques getrageneFunkanlagen portables This European Standard was approved by CEN on 1 August 2024. CEN and CENELECmembers are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN and CENELEC member. This European Standard exists in three official versions (English, French, German). A version in any other language made by translationundertheresponsibilityofa CENandCENELECmember intoits ownlanguageand notifiedtotheCEN-CENELEC ManagementCentrehasthesamestatusastheofficialversions. CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium, Latvia,Lithuania,Luxembourg,Malta,Netherlands,Norway,Poland,Portugal,Republic ofNorthMacedonia,Romania,Serbia Slovakia,Slovenia, Spain, Sweden, Switzerland, Turkiyeand United Kingdom. cen CENELEC EN 18031-2:2024 (E) Contents Page European foreword . Introduction. 1 Scope. 2 Normative references.. .7 3 Terms and definitions .7 4 Abbreviations... .12 5 Application of this document... 6 Requirements.. .16 6.1 [ACM] Access control mechanism .... .16 6.1.1 [ACM-1] Applicability of access control mechanisms . .16 6.1.2 [ACM-2] Appropriate access control mechanisms... .21 6.1.3 [ACM-3] Default access control for children in toys... 6.1.4 [ACM-4] Default access control to children's privacy assets for toys and childcare equipment...... 6.1.5 [AcM..5] Parental/Guardian access controls for children in toys ..36. 6.1.6 [ACM-6] Parental/Guardian access controls for other entities' access to managed children's privacy assets in toys.... 6.2 [AUM] Authentication mechanism.... 6.2.1 [AUM-1] Applicability of authentication mechanisms ... .45 6.2.2 [AUM-2] Appropriate authentication mechanisms ... 6.2.3 [AUM-3] Authenticator validation ... 6.2.4 [AUM-4] Changing authenticators... 6.2.5 [AUM-5] Password strength.... .8. 6.2.6 [AUM-6] Brute force protection.... .76 6.3 [SUM] Secure update mechanism.. ..80 6.3.1 [SUM-1] Applicability of update mechanisms... 6.3.2 [SUM-2] Secure updates.. .83 6.3.3 [sUM-3] Automated updates.. 6.4 6.4.1 [ssM.-- ] Applicability of secure storage mechanisms.. ..91 6.4.2 [ssM-2] Appropriate integrity protection for secure storage mechanisms .. 6.4.3 [ssM-3] Appropriate confidentiality protection for secure storage mechanisms... 101 6.5 [SCM] Secure communication mechanism..... .106 6.5.1 [SCM-1] Applicability of secure communication mechanisms . .106 6.5.2 jsCM-2j Appropriate integrity and authenticity protection for secure communication mechanisms .... .112 6.5.3 [SCM-3] Appropriate confidentiality protection for secure communication 6.5.4 [ScM-4] Appropriate replay protection for secure communication mechanisms ... 123 6.6 [LGM] Logging mechanism .. ..128 6.6.1 [LGM..] App.licability of loging mechanisms... 6.6.2 [LGM-2] Persistent storage