1、Remote control drone security testing system
According to the rules for remote control drones and the joint order between the Department of Industry and Commerce and the Ministry of Transport, the "Remote Control Drone Security Testing Specification," manufacturers or importers of remote control drones who publicly sell them, government agencies (structures), schools, or legal entities conducting drone group fly performances, or those operating in restricted or prohibited areas, must obtain a security testing report that is qualified.
In addition, the implementation dates for drone group fly performances, public sales of remote control drones, and operations in restricted or prohibited areas are as follows: 2024 December 1st for drone group fly performances, 2025 December 1st for public sales, and 2027 December 1st for operations in restricted or prohibited areas. Manufacturers, importers, and government agencies (structures) can conduct remote control drone security testing according to the testing specification.
2、Security testing notice
1、Testing regulations
- Single drone security testing report: refers to the test results of a remote control drone that pass the testing specification's Chapter 6 (excluding Chapter 6 and Chapter 8.1), which cover system, software, communication, and firmware security testing.
- Drone group fly security testing report: refers to the test results of a remote control drone that pass the testing specification's Chapter 7, which cover ground control device security testing.
- To meet the needs of defense purchases, the testing specification may include additional chapters, such as Chapter 8, which cover special security testing, such as satellite positioning source code.
2、Compliance report
- Before publicly selling remote control drones, manufacturers or importers must log in the relevant information in the Civil Aviation Administration Information System.
- If the manufacturer or importer has already obtained a security testing report for a remote control drone of the same brand and type (model), they can log in the system to submit the report (as shown in the figure).
| Item number | Login information | Related agencies |
|---|---|---|
| 1 | Brand/type | Brand/typeCivil Aviation Administration |
| 2 | Model/specification | Civil Aviation Administration |
| 3 | Company name | Economic Department Production and Development Department |
| 4 | Company registration/import information | Economic Department Production and Development Department |
| 5 | Security testing report | Department of Remote Control Drones |
| 6 | Product/type testing qualification certificate | Civil Aviation Administration, Economic Department Standardization and Inspection Department |
| 7 | Radio equipment type authentication | Radio Communication Association |
3、Promote series model testing
To lower the time and cost required to obtain a security testing report for remote control drones, the Department of Remote Control Drones proposed to modify the "Remote Control Drone Security Testing Specification" to allow series model testing for products with the same brand and type (model) as the main product.
- Same brand
- Same brand and model flight control system
- Ground control software
The main product is tested according to Chapter 6 of the testing specifications, covering system security testing, software security testing (including weak scanning), communication security testing, and firmware security testing, with the test report as the main body;
The series products are tested according to the series testing section of Chapter 6 of the testing specifications, including the flight control system SBOM (supplier name, software suite name, software suite version or Hash), ground station weak scanning, and communication security testing (if the communication module is different), with the test report as the main body of the series products and the main product.
| Product situation | Main product | Series products |
|---|---|---|
| Product image |  |  |
| Testing regulations | Chapter 6 of the testing specifications | Series testing section of Chapter 6 of the testing specifications |
| Testing content | 1. System security testing 2. Software security testing (including weak scanning) 3. Communication security testing 4. Firmware security testing | 1. Flight control system SBOM (supplier name, software suite name, software suite version or Hash) 2. Ground station weak scanning 3. Communication security testing (if the communication module is different) |
| Testing report content |  Main product |  Series products + main product |
Appendix 1, Remote-controlled drone management regulations
| Item number | Paragraph | Regulations |
|---|---|---|
| 1 | Paragraph 17 |
Manufacturers or importers of unmanned aerial vehicles (UAVs) should log in to the designated information system of the Civil Aviation Administration of China (CAAC) for the following information before public sale: 1. Brand and type name. 2、 Remote control type and specifications. 3、 For importers from abroad, the classification number of their imported goods is listed. 4、 Domestic manufacturers, their factory registration related information. Fifth, the public institutions or legal entities of the Ministry of Digital Development shall issue a remote unmanned aerial vehicle (UAV) security inspection report that meets the remote control inorganic security inspection standards set by the Ministry of Digital Development and the Ministry of Transport. 6、 Remote controlled drones with a maximum takeoff weight of 200 kilograms should be registered with a certificate of conformity issued by the International Standards Inspection Bureau of the Ministry of Economic Affairs; Remote controlled unmanned aerial vehicles with a maximum takeoff weight of more than 2 kilograms should be registered with the type inspection certificate or recognition certificate issued by the Civil Aviation Administration of China. 7、 The RF material complies with the relevant documents of the National Communications Commission's telecommunications regulatory review certificate. 8. Other matters stipulated by the Civil Aviation Administration of China. |
| 2 | Paragraph 31 | Government agencies, schools, or legal entities engaged in flight activities within a certain distance around prohibited or restricted areas, as well as airports or airfields, using remote-controlled drones equipped with navigation devices, shall comply with the following regulations: Starting from December 1st, 160th year of the Republic of China, government agencies, schools, or legal entities engaged in the first and second flying activities using remote-controlled unmanned aerial vehicles equipped with navigation devices shall comply with the following regulations: 1. A professional organization or legal entity announced by the Ministry of Digital Development shall issue a remote-controlled unmanned aerial vehicle security testing qualification report that complies with the remote-controlled unmanned aerial vehicle security testing standards jointly formulated by the Ministry of Digital Development and the Ministry of Transportation. . However, those who have obtained a special inspection certificate for agricultural use in accordance with Article 15 are not subject to this restriction. 2. Remote controlled unmanned aerial vehicles with a maximum takeoff weight of 200 kilograms shall have a commodity inspection certificate in accordance with the Economic Standards Inspection Bureau; Remote controlled unmanned aerial vehicles with a maximum takeoff weight of more than 2 kilograms shall have a type inspection certificate or recognition certificate issued by the Civil Aviation Administration of China. However, those who have obtained a special inspection certificate for agricultural use in accordance with Article 15 are not subject to this restriction. |
| 3 | Paragraph 32 | When government agencies (institutions), schools, or legal entities engage in restricted activities as stipulated in Article 90-14, Paragraphs 1 to 8, they shall submit an activity plan (Attachment 14) to the Civil Aviation Administration for permission 15 days before the activity date; For activities involving crowds or outdoor collective activities, approval documents from the municipal, county (city) government, and central competent authority shall be submitted; When controlling more than 200 remote-controlled drones for exhibition activities at the same time, a qualified report on the remote control drone swarm flying system security testing issued by a professional organization or legal entity that complies with the remote control drone security testing standards set by the Ministry of Digital Development and the Ministry of Transportation should be attached. Starting from December 1st, 160th year of the Republic of China, remote control drones equipped with navigation devices used by government agencies, schools, or legal persons engaged in the first type of flying activity shall comply with the following regulations: 1. A professional organization or legal person announced by the Ministry of Digital Development shall issue a remote control drone security testing qualification report that complies with the remote control drone security testing standards formulated by the Ministry of Digital Development and the Ministry of Transportation. However, those who have obtained a special inspection certificate for agricultural use in accordance with Article 15 are not subject to this restriction. 2. Remote controlled unmanned aerial vehicles with a maximum takeoff weight of less than 200 kilograms shall have a commodity inspection certificate in accordance with the Economic Standards Inspection Bureau; Remote controlled unmanned aerial vehicles with a maximum takeoff weight of more than 2 kilograms shall have a type inspection certificate or recognition certificate issued by the Civil Aviation Administration of China. However, those who have obtained a special inspection certificate for agricultural use in accordance with Article 15 are not subject to this restriction. |
Appendix 2, Summary of remote control drone security testing items
Chapter 6, Remote control drone security testing
- Remote control drones made and imported by manufacturers or importers.
- Remote control drones used by government agencies (institutions), schools, or legal entities engaged in restricted activities.
- Remote control drones used by government agencies (institutions), schools, or legal entities operating in restricted areas.
| Item No. | Security Requirements Item | Remote Control Drone | Ground Control Station |
|---|---|---|---|
| 6.2.1 | Identity Authentication | √ | |
| 6.2.2 | Network Service Port Detection | √ | |
| 6.2.3 | System Exceptional Traffic | √ | √ |
| 6.3.1 | Malicious Programs | √ | |
| 6.3.2 | Vulnerability Scanning | √ | |
| 6.4.1 | Wireless Communication Security | √ | √ |
| 6.5.1 | Firmware Update Security | √ |
Chapter 7, Remote control drone group flight system security testing
- Remote control drones used by government agencies (institutions), schools, or legal entities engaged in group flight activities (200 or more drones).
| Item No. | Security Requirements Item | Remote control drones with network connection capabilities as payloads | Ground Control Station for Group Flight System |
|---|---|---|---|
| 7.1.1 | Group Flight System Vulnerability Scanning | √ | √ |
| 7.1.2 | Group Flight System Network Service Ports | √ | √ |
| 7.1.3 | Remote Login Access Management for Group Flight System | √ | √ |
| 7.1.4 | Protection of Remote Login Access Content for Group Flight System | √ | √ |
| 7.1.5 | Management of High-Risk Services for Group Flight System | √ | √ |
| 7.1.6 | Web Application Detection for Group Flight System | - | √ |
| 7.1.7 | Identity Verification Mechanism for Group Flight System | √ | √ |
| 7.1.8 | Strength and Protection of User Passwords for Group Flight System | √ | √ |
| 7.1.9 | Management of Web Application Transmission Security for Group Flight System | - | √ |
| 7.1.10 | Management of Web Application Authorization for Group Flight System | - | √ |
| 7.1.11 | Security of Wireless Communication for Group Flight System | - | √ |
| 7.1.12 | Protection of Physical Security for Group Flight System | √ | √ |
Chapter 8, Additional Security Testing for Remote Control Drones
- Remote control drones used in defense and national security procurement.
| Item No. | Additional Security Requirements Item | Remote Control Drones | Ground Control Station |
|---|---|---|---|
| 8.1.1 | Enhanced Capability of Satellite Positioning System | √ | - |
| 8.1.2 | Capability of Satellite Positioning System to Handle Interference | √ | - |
| 8.1.3 | Basic Security Stamp for Mobile Application | - | √ |
| 8.1.4 | Capability of Wireless Communication to Handle Failure | √ | √ |
| 8.1.5 | Detection of Known Vulnerabilities in Firmware | √ | - |
| 8.2.1 | Security of Data Storage | √ | √ |
| 8.2.2 | Authentication Mechanism for Command Link of Drones | √ | √ |
| 8.2.3 | Debugging Interface for Engineering | √ | - |
| 8.2.4 | Security Scan of Source Code | √ | |
| 8.2.5 | Exposure of Application Code | - | √ |
| 8.2.6 | Security of Software Updates | - | √ |
Contact Us：
Service Hotline：0755-23722370 / Anna.Chan13823706750 / King.huang18025443654 / Sally.Wei18165707930
We will provide you with professional certification advice and services to ensure the smooth entry of your products into the local market
Service Hotline：0755-23722370 / Anna.Chan13823706750 / King.huang18025443654 / Sally.Wei18165707930
We will provide you with professional certification advice and services to ensure the smooth entry of your products into the local market
