China’s Network Data Labeling Guide Calls for Encrypted Transport
A Chinese cybersecurity practice guide sets out data labeling, verification, logging and protection requirements, including secure transport protocols such as HTTPS.
China’s Cybersecurity Standards Practice Guide — Technical Requirements for Network Data Labels and Identifiers covers terminology, attribute formats, generation, labeling and verification rules, log retention and security safeguards. It calls for senders to use secure protocols such as HTTPS for encrypted transport. The title and selected provisions below are explanatory translations of the Chinese source.
The guide, compiled under the Secretariat of China’s National Technical Committee on Cybersecurity Standardization, has been officially released. It is based on China’s Cybersecurity Law, Data Security Law, Personal Information Protection Law and Network Data Security Management Regulations, and is intended to improve network data security management through labeling technologies.
It helps data handlers attach labels and identifiers to data, supporting classification and graded protection—particularly for important data and personal information—and traceability throughout the data lifecycle. Its security requirements include encrypted transmission using protocols such as HTTPS. Relevant provisions are summarized below.
7.2.2 Structured data: synchronous mode
When applying labels to structured data synchronously in dynamic scenarios:
- a) The sender should automatically encapsulate the generated dynamic label identifier in the application-layer protocol header, bind it to the data object and transmit both together.
- b) The recipient should automatically recognize, parse and extract the dynamic label identifier.
Example: Structured data is commonly transmitted through an API using HTTPS. Label-binding logic can be added to the system’s shared HTTP request module. Before sending the data, the program generates a dynamic label identifier and places it in a newly defined HTTP header attribute. The identifier and data object are then transmitted using TLS encryption. The source guide refers to its Appendix B.4 for implementation details.
The receiving system needs corresponding processing during HTTPS request handling to recognize and parse the dynamic identifier from the headers automatically. The guide refers to Appendix C for implementation details.
7.2.3 Structured data: asynchronous mode
When labeling structured data asynchronously in dynamic scenarios:
- The sender should generate the dynamic label identifier before transmitting the data object and establish their logical association.
- The sender should transmit the object and identifier separately in the manner agreed with the recipient, for example through different APIs or in an agreed sequence.
Example: Both parties agree to use HTTPS for the data-object API and the label-identifier API. Illustrative endpoints in the original guide are https://xxx/data for the data object and https://xxx/label for the identifier. These are placeholders, not operational services.
10.1 Encrypted transport
The sender should encrypt the transmission of network data labels and identifiers using secure transport protocols such as HTTPS. The guide refers readers to standards including GB/T 38636.
Source: China’s National Technical Committee on Cybersecurity Standardization. The appendix references belong to the original guide; this article is not a replacement for that document.