CRP-C0416-01
Certification Report
Kazumasa Fujie, Chairman
Information-technology Promotion Agency, Japan
Target of Evaluation (TOE)
Application Date/ID 2013-04-18 (ITC-3458)
Certification No. C0416
Sponsor RICOH COMPANY, LTD.
TOE Name imagio Security Card Type 7 (Japanese name)
DataOverwriteSecurity Unit Type H (English name)
TOE Version 1.02x
PP Conformance None
Assurance Package EAL3
Developer RICOH COMPANY, LTD.
Evaluation Facility ECSEC Laboratory Inc. Evaluation Center
This is to report that the evaluation result for the above TOE is certified as
follows.
2013-11-29
Takumi Yamasato, Technical Manager
Information Security Certification Office
IT Security Center
Technology Headquarters
Evaluation Criteria, etc.: This TOE is evaluated in accordance with the following
standards prescribed in the "IT Security Evaluation and
Certification Scheme."
- Common Criteria for Information Technology Security Evaluation
Version 3.1 Release 4 (Japanese Translation)
- Common Methodology for Information Technology Security Evaluation
Version 3.1 Release 4 (Japanese Translation)
Evaluation Result: Pass
"imagio Security Card Type 7 (Japanese name), DataOverwriteSecurity Unit
Type H (English name)" has been evaluated based on the standards required, in
accordance with the provisions of the "Requirements for IT Security
Certification" by Information-technology Promotion Agency, Japan, and has met
the specified assurance requirements.
CRP-C0416-01
Notice:
This document is the English translation version of the Certification Report
published by the Certification Body of Japan Information Technology Security
Evaluation and Certification Scheme.
CRP-C0416-01
Table of Contents
1. Executive Summary ............................................................................... 1
1.1 Product Overview ............................................................................ 1
1.1.1 Assurance Package...................................................................... 1
1.1.2 TOE and Security Functionality .................................................... 1
1.1.2.1 Threats and Security Objectives ................................................... 2
1.1.2.2 Configuration and Assumptions .................................................... 2
1.1.3 Disclaimers ................................................................................ 2
1.2 Conduct of Evaluation ...................................................................... 2
1.3 Certification ................................................................................... 2
2. Identification ....................................................................................... 3
3. Security Policy...................................................................................... 4
3.1 Security Function Policy ................................................................... 4
3.1.1 Threat and Security Function Policy .............................................. 4
3.1.1.1 Threat ...................................................................................... 4
3.1.2 Organisational Security Policy and Security Function Policy ............. 4
3.1.2.1 Organisational Security Policy ..................................................... 4
3.1.2.2 Security Function Policy to Organisational Security Policy ............... 5
4. Assumptions and Clarification of Scope .................................................... 6
4.1 Usage Assumptions .......................................................................... 6
4.2 Environmental Assumptions .............................................................. 7
4.3 Clarification of Scope ....................................................................... 7
5. Architectural Information ...................................................................... 8
5.1 TOE Boundary and Components ......................................................... 8
5.2 IT Environment ............................................................................... 9
6. Documentation ................................................................................... 10
7. Evaluation conducted by Evaluation Facility and Results .......................... 11
7.1 Evaluation Approach ...................................................................... 11
7.2 Overview of Evaluation Activity ....................................................... 11
7.3 IT Product Testing ......................................................................... 12
7.3.1 Developer Testing ..................................................................... 12
7.3.2 Evaluator Independent Testing ................................................... 14
7.3.3 Evaluator Penetration Testing .................................................... 15
7.4 Evaluated Configuration ................................................................. 16
7.5 Evaluation Results......................................................................... 16
7.6 Evaluator Comments/Recommendations ............................................ 16
8. Certification ....................................................................................... 17
8.1 Certification Result........................................................................ 17
8.2 Recommendations .......................................................................... 17
CRP-C0416-01
9. Annexes............................................................................................. 18
10. Security Target ................................................................................ 18
11. Glossary.......................................................................................... 19
12. Bibliography .................................................................................... 20
CRP-C0416-01
1
1. Executive Summary
This Certification Report describes the content of the certification result in relation to IT
Security Evaluation of "imagio Security Card Type 7 (Japanese name),
DataOverwriteSecurity Unit Type H (English name), Version 1.02x" (hereinafter referred
to as the "TOE") developed by RICOH COMPANY, LTD., and the evaluation of the TOE
was finished on 2013-11 by ECSEC Laboratory Inc. Evaluation Center (hereinafter
referred to as the "Evaluation Facility"). It is intended to report to the sponsor, RICOH
COMPANY, LTD., and provide security information to procurement personnel and
consumers who are interested in this TOE.
Readers of the Certification Report are advised to read the Security Target (hereinafter
referred to as the "ST") that is the appendix of this report together. Especially, details of
security functional requirements, assurance requirements and rationale for sufficiency of
these requirements of the TOE are described in the ST.
This Certification Report assumes "procurement personnel who purchase this TOE that is
commercially available" to be readers. Note that the Certification Report presents the
certification result based on assurance requirements to which the TOE conforms, and does
not guarantee an individual IT product itself.
1.1 Product Overview
An overview of the TOE functions and operational conditions is described as follows. Refer
to Chapter 2 and subsequent chapters for details.
1.1.1 Assurance Package
Assurance Package of the TOE is EAL3.
1.1.2 TOE and Security Functionality
This TOE, an optional kit that ensures safe usage of the MFP, is the software that operates
inside the MFP. This TOE is saved on an SD Memory Card to be distributed. By operating
the MFP with the SD Memory Card installed, this TOE will be read into the MFP and
operate.
This TOE overwrites an area on the HDD that is specified by the MFP.
The MFP, on which this TOE can be installed, has an overwrite function identical to that of
the TOE. With this TOE installed, the MFP does not use its own overwrite function but
uses the overwrite function of this TOE. This ensures that the overwrite function assured
by the evaluation is operating.
For this security functionality, the evaluation for the validity of the design policy and the
correctness of the implementation is conducted in the scope of the assurance package. The
next clause describes the assumed threats and assumptions in this TOE.
CRP-C0416-01
2
1.1.2.1 Threats and Security Objectives
No threats are assumed for this TOE. As a security function, this TOE has the function to
overwrite an area on the HDD specified by the MFP. This function is to satisfy the demands
of procurement personnel when using the MFP.
1.1.2.2 Configuration and Assumptions
The evaluated product is assumed to be operated under the following configuration and
assumptions.
This TOE is operated while it is installed on the MFP. Refer to Table 4-2 for the list of
target MFPs.
This TOE is assumed to be used under the environment where power supply to the MFP
does not cease during the MFP operation.
1.1.3 Disclaimers
The assurance covers only the function to overwrite an area on the HDD as specified by the
MFP. Whether the MFP instructs appropriately is not included in the assurance.
1.2 Conduct of Evaluation
Under the IT Security Evaluation and Certification Scheme that the Certification Body
operates, the Evaluation Facility conducted IT security evaluation and completed on
2013-11, based on functional requirements and assurance requirements of the TOE
according to the publicised documents "IT Security Evaluation and Certification
Scheme"[1], "Requirements for IT Security Certification"[2], and "Requirements for
Approval of IT Security Evaluation Facility"[3] provided by the Certification Body.
1.3 Certification
The Certification Body verified the Evaluation Technical Report [13] and the Observation
Report prepared by the Evaluation Facility as well as evaluation evidential materials, and
confirmed that the TOE evaluation was conducted in accordance with the prescribed
procedure. The certification oversight reviews were also prepared for those concerns found
in the certification process. Those concerns pointed out by the Certification Body were fully
resolved, and the Certification Body confirmed that the TOE evaluation had been
appropriately conducted in accordance with the CC ([4][5][6] or [7][8][9]) and the CEM
(either of [10][11]). The Certification Body prepared this Certification Report based on the
Evaluation Technical Report submitted by the Evaluation Facility and fully concluded
certification activities.
CRP-C0416-01
3
2. Identification
The TOE is identified as follows:
TOE Name: imagio Security Card Type 7 (Japanese name)
DataOverwriteSecurity Unit Type H (English name)
TOE Version: 1.02x
Developer: RICOH COMPANY, LTD.
Users can verify that a product is the evaluated and certified TOE by the following means.
Following the procedures described in the guidance documents, users operate the MFP and
confirm that the name and version displayed on the screen are identical to those described
in the guidance documents.
CRP-C0416-01
4
3. Security Policy
This chapter describes security function policies that the TOE adopts to counter threats,
and organisational security policies.
This TOE has the function to overwrite an area on the HDD specified by the MFP. This
function prevents the leakage of data that exist in the area on the HDD specified by the
MFP.
3.1 Security Function Policy
No threats are assumed for the TOE. The TOE possesses the security function to satisfy the
organisational security policy shown in Chapter 3.1.2.
3.1.1 Threat and Security Function Policy
3.1.1.1 Threat
No threats are assumed for this TOE.
3.1.2 Organisational Security Policy and Security Function Policy
3.1.2.1 Organisational Security Policy
An organisational security policy required in use of the TOE is shown in Table 3-1.
Table 3-1 Organisational Security Policy
Identifier Organisational Security Policy
P.UNREADABLE The TOE shall prevent the data in the area on the HDD
that the MFP specifies from being read.
This policy is derived from the requirements considered
to be required by procurement personnel who operate
the MFP.
CRP-C0416-01
5
3.1.2.2 Security Function Policy to Organisational Security Policy
The TOE provides the security function to satisfy the organisational security policy shown
in Table 3-1.
(1) Means to support Organisational Security Policy, "P.UNREADABLE"
This TOE has the function to overwrite an area on the HDD specified by the MFP.
P.UNREADABLE is achieved by this function.
For this function, the overwrite methods described below can be specified. However,
when there is a function, which is out of the TOE, to encrypt data to be written on the
HDD of the MFP and the function is operating, the data may actually be overwritten by
the data other than those mentioned below.
- NSA method
NSA method overwrites data as follows:
> overwrites twice by random numbers, and
> once by Null(0).
- DoD method
DoD method overwrites data as follows:
> overwrites once by a fixed value,
> once by the complements of the fixed value,
> once by random numbers, and
> verifies that the data is properly overwritten by reading the HDD.
- Random number method
Random number method overwrites data the specified number of times (1–9 times)
using random numbers.
CRP-C0416-01
6
4. Assumptions and Clarification of Scope
This chapter describes the assumptions and the operational environment to operate the
TOE as useful information for the assumed readers to determine the use of the TOE.
4.1 Usage Assumptions
Table 4-1 shows assumptions to operate the TOE. The effective performance of the TOE
security function is not assured unless these assumptions are satisfied.
Table 4-1 Assumptions in Use of the TOE
Identifier Assumptions
A.MODE.AUTOMATIC The TOE operations shall not be interrupted by MFP
power-off before the TOE completes overwrite
operations by the sequential overwrite method.
In sequential overwriting, the MFP instructs the TOE to
overwrite the area on the HDD of the MFP when any
unnecessary data is generated.
A.MODE.MANUAL Against user's will, the implementation of the Batch
Overwrite Function of the TOE shall not be
unintentionally suspended by the operation of
temporary suspension button or the MFP power-off,
before the TOE completes overwrite operations by the
Batch Overwrite Function.
In batch overwriting, the MFP instructs the TOE to
overwrite all area on the HDD.
CRP-C0416-01
7
4.2 Environmental Assumptions
This TOE is installed and operated on any of the MFPs listed in Table 4-2.
Table 4-2 MFPs to be an Operation Environment of the TOE
Product name in Japan Product name in overseas countries
RICOH MP C5503
RICOH MP C4503
RICOH MP C6003
RICOH MP C5503A
RICOH MP C4503A
Ricoh MP C4503
Ricoh MP C4503G
Ricoh MP C4503A
Ricoh MP C5503
Ricoh MP C5503G
Ricoh MP C5503A
Ricoh MP C6003
Ricoh MP C6003G
Savin MP C4503
Savin MP C4503G
Savin MP C5503
Savin MP C5503G
Savin MP C6003
Savin MP C6003G
Lanier MP C4503
Lanier MP C4503G
Lanier MP C5503
Lanier MP C5503G
Lanier MP C6003
Lanier MP C6003G
nashuatec MP C4503
nashuatec MP C4503A
nashuatec MP C5503
nashuatec MP C5503A
nashuatec MP C6003
Rex-Rotary MP C4503
Rex-Rotary MP C4503A
Rex-Rotary MP C5503
Rex-Rotary MP C5503A
Rex-Rotary MP C6003
Gestetner MP C4503
Gestetner MP C4503A
Gestetner MP C5503
Gestetner MP C5503A
Gestetner MP C6003
infotec MP C4503
infotec MP C4503A
infotec MP C5503
infotec MP C5503A
infotec MP C6003
The reliability of hardware and software of the MFP is outside the scope of this evaluation
(it is assumed to be trustworthy).
4.3 Clarification of Scope
This TOE overwrites an area on the HDD as specified by the MFP (which is outside the
scope of the TOE). The instruction by the MFP (which is outside the scope of the TOE) also
specifies the area on the HDD.
CRP-C0416-01
8
5. Architectural Information
This chapter explains the scope and the main components (subsystems) of the TOE.
5.1 TOE Boundary and Components
Figure 5-1 shows the composition of the TOE.
Figure 5.1 Configuration and Operation Environment of the TOE
Shown below are the explanations of Sequential Overwrite Function and Batch Overwrite
Function, which are the components that configure the TOE.
- Sequential Overwrite Function
As the TOE receives an instruction from "Residual Data Management" of the MFP to
overwrite the area on the HDD where residual data exist, the TOE executes overwrite
operation on the area.
- Batch Overwrite Function
As the TOE receives an instruction from "Batch Overwrite Start-up/Suspension" to start
batch overwriting, the TOE overwrites all areas on the HDD. The overwrite operation
can be suspended by the instruction from the MFP as well.
TOE
Status Display
Residual Data
Auto Erase
Memory
Operation
Settings
Residual data
management
Checking
Residual
data
Start-up and
Suspension
Residual data
area
Auto
Erase
Memory
Erase
All
Memory
Batch overwrite
start-up/
suspension
Printer Fax
Copy
Scanner
Document
Server
Overwriting
Management of
residual data area
generated on the HDD
Generation of
residual data
Sequential
Overwrite
Function
Batch
Overwrite
Function
HDD
MFP
CRP-C0416-01
9
5.2 IT Environment
The TOE operates inside the MFP. Software that control the MFP also operate inside the
MFP, besides the TOE. This TOE is operated by the instructions from the software that
control the MFP.
- Residual Data Management
This is a function to manage the area on the HDD where residual data exist. Any
residual data, generated when using the MFP functions, are notified to the "Residual
Data Management." The "Residual Data Management" instructs the "Sequential
Overwrite Function" of the TOE to overwrite.
"Residual data" are the data as described below:
> The MFP provides the functions of copy, printer, scanner, fax, and Document Server.
When performing these functions, the MFP creates on the HDD the temporary
working data, including a part of or all data of documents. The temporary working
data that become unnecessary when those functions terminate become the "residual
data."
> The MFP can store documents on the HDD using Document Server Function. When
users instruct the MFP to delete the stored documents, the target documents to be
deleted become the "residual data."
- Auto Erase Memory Operation Setting
This is a function to set whether "Residual Data Management" gives an instruction to
overwrite.
- Batch Overwrite Start-up/Suspension
This is a function to instruct "Batch Overwrite Function" of the TOE to start or suspend
batch overwriting.
- Residual Data Status Display
This is a function to display an icon representing the residual data status on the MFP's
Operation Panel. The icon indicates three states: residual data available, no residual
data available, and data being overwritten.
CRP-C0416-01
10
6. Documentation
The identification of documents attached to the TOE is listed below. TOE users are
required to fully understand and comply with the following documents in order to satisfy
the assumptions.
Documents for Japan
- imagio Security Card Type 7
imagio Security Card Type 9
Operating Instructions
Version D377-7902
- Notes for Users
Version D377-7925
Documents for overseas
- DataOverwriteSecurity Unit Type H
DataOverwriteSecurity Unit Type I
Operating Instructions
Version D377-7940
- Notes for Users
Version D377-7250
- Notes for Users
Version D377-7925
CRP-C0416-01
11
7. Evaluation conducted by Evaluation Facility and Results
7.1 Evaluation Approach
Evaluation was conducted by using the evaluation methods prescribed in the CEM in
accordance with the assurance components in the CC Part 3. Details for evaluation
activities were reported in the Evaluation Technical Report. The Evaluation Technical
Report explains the summary of the TOE as well as the content of the evaluation and the
verdict of each work unit in the CEM.
7.2 Overview of Evaluation Activity
The history of the evaluation conducted is described in the Evaluation Technical Report as
follows.
The evaluation has started on 2013-04 and concluded upon completion of the Evaluation
Technical Report dated 2013-11. The Evaluation Facility received a full set of evaluation
deliverables necessary for evaluation provided by the developer, and examined the evidence
in relation to a series of evaluation conducted. Additionally, the evaluator directly visited
the development and manufacturing sites on 2013-05 and 2013-10, and examined the
procedural status conducted in relation to each work unit for configuration management,
delivery and development security by investigating records and interviewing staff. For
some development and manufacturing sites, site visits were omitted as the Evaluation
Facility determined that the examination details of the past CC-certified products could be
reused. Furthermore, the evaluator conducted the sampling check of the developer testing
and the evaluator testing by using the developer testing environment at the developer site
on 2013-07.
Concerns found in evaluation activities for each work unit were all issued as the
Observation Report, and it was reported to the developer. Those concerns were reviewed by
the developer, and all the concerns were solved eventually.
Concerns that the Certification Body found in the evaluation process were described as the
certification oversight reviews, and those were sent to the Evaluation Facility. After the
Evaluation Facility and the developer examined them, those concerns were reflected in the
Evaluation Technical Report.
CRP-C0416-01
12
7.3 IT Product Testing
The evaluator confirmed the validity of the testing that the developer had performed. As a
result of the evidence shown in the process of the evaluation and those confirmed validity,
the evaluator performed the reproducibility testing, additional testing and penetration
testing based on vulnerability assessments judged to be necessary.
7.3.1 Developer Testing
The evaluator evaluated the integrity of the developer testing that the developer performed
and the documentation of actual testing results. The content of the developer testing
evaluated by the evaluator is explained as follows.
1) Developer Testing Environment
The developer testing was performed with the TOE installed on the following MFPs.
- RICOH MP C5503 (System versions: 2.01/2.02)
The following testing tools were also used for operating tests and observing results.
- Computers for testing
Computers on which terminal software connected to the MFP via RS232C or Ethernet
were used.
- IDE bus analyser
IDE-Pocket Ultra DMA/100 supported, manufactured by TOYO Corporation
- Other devices
A boot server to start the MFP in boot mode
A mail server when using e-mail sending function
Some of the MFP models identified in the ST were used as the TOE operation environment.
The differences between the MFP models identified in the ST were examined. Accordingly,
the evaluator also verified those MFP models used for the testing cover the differences
between the MFP models identified in the ST.
Therefore, it can be concluded that the developer testing was performed in the TOE testing
environment, which was identical to the TOE configurations specified in the ST.
2) Summary of the Developer Testing
A summary of the developer testing is as follows.
a. Developer Testing Outline
An outline of the developer testing is as follows.
<Developer Testing Approach>
The following methods were used to stimulate the TSFI and observe the behaviour of the
TSFI. The evaluator had confirmed that the "TOE for testing" and the "MFP with a mode in
which the behaviour of the OS can be observed" are appropriate for operation check of the
TOE.
- Operating from the Operation Panel of the MFP, and checking the display of the
CRP-C0416-01
13
Operation Panel.
- Using the TOE for testing with the additional function to output logs as well as the MFP
with a mode in which the behaviour of the OS can be observed, and checking the
behaviour of the OS in the TOE and the MFP from the computers for testing connected to
the MFP.
- Monitoring the interface to the HDD using IDE bus analyser.
(Note)Regarding a boot server and a mail server in the developer testing environment:
A boot server was used to set the MFP mode in which the behaviour of the OS can be
observed.
A mail server was prepared for the testing in which a mail is sent from the MFP by the
MFP operation.
<Content of the Performed Developer Testing>
The TSFI was stimulated by the MFP operation. The MFP operation was performed
covering parameters of each TSFI.
By checking the behaviour of the OS in the TOE and the MFP from the computers for
testing, it was confirmed that the TOE is operating as parameters intended. In addition,
whether overwriting was performed properly was checked by monitoring using IDE bus
analyser.
b. Scope of the Performed Developer Testing
The developer testing was performed on 51 items by the developer. By the coverage
analysis, it was verified that all security functions and external interfaces described in the
functional specification had been tested. By the depth analysis, it was verified that all the
subsystems and subsystem interfaces described in the TOE design had been sufficiently
tested.
c. Result
The evaluator confirmed the approach of the performed developer testing and the
legitimacy of tested items, and confirmed consistencies between the testing approach
described in the testing plan and the actual testing approach. The evaluator confirmed
consistencies between the testing results expected by the developer and the actual testing
results performed by the developer.
CRP-C0416-01
14
7.3.2 Evaluator Independent Testing
The evaluator performed the sample testing to reconfirm the execution of security
functions by the test items extracted from the developer testing. In addition, the evaluator
performed the evaluator independent testing (hereinafter referred to as the "independent
testing") to ensure that security functions are certainly implemented from the evidence
shown in the process of the evaluation. The independent testing performed by the
evaluator is explained as follows.
1) Independent Testing Environment
The configuration of the testing performed by the evaluator was the same as the
configuration of the developer testing except that the MFP shown below was used. The
evaluator judged that the MFP configuration, which differs from that of the developer
testing, has no influence on the TOE testing.
- Ricoh MP C4503 (System version: 1.06)
The testing tools used for the independent testing were identical to those used in the
developer testing. Operation check of the testing tools was performed by the evaluator.
2) Summary of the Independent Testing
A summary of the independent testing is as follows.
a. Viewpoints of the Independent Testing
Viewpoints of the independent testing that the evaluator designed from the developer
testing and the provided evaluation evidential materials are shown below.
<Viewpoints of the Independent Testing>
1. For the sampling of the developer testing, sufficient tests should be sampled so that all
security functions and interfaces are subject to sampling.
2. If the sufficiency of the developer testing can be doubted in terms of the completeness of
the parameters or the timing of interface usage, additional proprietary testing for the
developer testing will be devised.
b. Independent Testing Outline
An outline of the independent testing that the evaluator performed is as follows.
<Independent Testing Approach>
The same methods with the developer testing were used.
<Independent Testing Tools>
The same testing tools with the developer testing were used.
<Content of the Performed Independent Testing>
Table 7-1 shows viewpoints of the independent testing and the content of the testing
corresponding to them.
CRP-C0416-01
15
Table 7-1 Content of the Performed Independent Testing
Viewpoint Outline of the Independent Testing
1 By performing the same testing with the developer testing, from
which the test items were extracted based on the viewpoints of
testing, it is confirmed that the results were identical to those of the
developer testing. The testing was performed on 11 items.
2 When overwrite method is changed during sequential overwriting, it
is confirmed that overwriting is performed by the expected overwrite
method.
2 When performing more than one sequential overwriting
simultaneously, it is confirmed that more than one object is
overwritten.
2 When the number of overwriting is changed during sequential
overwriting, it is confirmed that the expected number of overwriting
is performed.
c. Result
All the independent testing performed by the evaluator was correctly completed, and the
evaluator confirmed the behaviours of the TOE. The evaluator confirmed consistencies
between the expected behaviours and all the testing results.
7.3.3 Evaluator Penetration Testing
From the evidence shown in the process of the evaluation, the evaluator analysed if the
potentially exploitable vulnerabilities of concern under the assumed environment of use
and attack level exist.
As a result of the analysis, the evaluator concluded that such vulnerabilities did not exist
in the scope of the TOE for the reasons described below. Therefore, the penetration testing
was unnecessary.
- This TOE is the software inside the MFP. In its usage environment, this TOE operates
indirectly with the use of MFP functions.
- Considering such usage environment, as for the potential access to this TOE in the scope
of the assumed attack level, the behaviour of this TOE is sufficiently verified in the
developer testing and independent testing.
a. Result
In the analysis by the evaluator, the evaluator did not find any exploitable vulnerabilities
that attackers who have the assumed attack potential could exploit.
CRP-C0416-01
16
7.4 Evaluated Configuration
This TOE is assumed to be installed on the MFP models indicated in "4.2 Environmental
Assumptions." The TOE was installed on some of those MFP models in the evaluated
configuration.
For the reasons shown in "7.3.1 Developer Testing," the evaluator determined that the
evaluation can be assured when any of the MFPs indicated in "4.2 Environmental
Assumptions" is used as the configuration of the evaluation.
7.5 Evaluation Results
The evaluator had concluded that the TOE satisfies all work units prescribed in the CEM
by submitting the Evaluation Technical Report.
In the evaluation, the following were confirmed.
- PP Conformance: None
- Security functional requirements: Common Criteria Part 2 Extended
- Security assurance requirements: Common Criteria Part 3 Conformant
As a result of the evaluation, the verdict "PASS" was confirmed for the following assurance
components.
- All assurance components of EAL3 package
The result of the evaluation is only applied to those which are composed by the TOE
corresponding to the identification described in Chapter 2.
7.6 Evaluator Comments/Recommendations
There is no evaluator recommendation to be addressed to procurement personnel.
CRP-C0416-01
17
8. Certification
The Certification Body conducted the following certification based on the materials
submitted by the Evaluation Facility during the evaluation process.
1. Contents pointed out in the Observation Report shall be adequate.
2. Contents pointed out in the Observation Report shall properly be solved.
3. The submitted evidential materials were sampled, the contents were examined, and the
related work units shall be evaluated as presented in the Evaluation Technical Report.
4. Rationale of the evaluation verdict by the evaluator presented in the Evaluation
Technical Report shall be adequate.
5. The evaluator's evaluation methodology presented in the Evaluation Technical Report
shall conform to the CEM.
Concerns found in the certification process were prepared as the certification oversight
reviews, and those were sent to the Evaluation Facility. The Certification Body confirmed
such concerns pointed out in the certification oversight reviews were solved in the ST and
the Evaluation Technical Report, and issued this Certification Report.
8.1 Certification Result
As a result of verification of the submitted Evaluation Technical Report, Observation
Report and related evaluation deliverables, the Certification Body determined that the
TOE satisfies all assurance requirements for EAL3 in the CC Part 3.
8.2 Recommendations
- The evaluation only assured that the overwriting by this TOE is performed "as specified
by the MFP."
- Whether the MFP instructs appropriately is not included in the scope of the assurance.
Concerning an overwrite instruction to this TOE by the MFP, for instance, the following
points are not included in the scope of the assurance.
> Whether the area with residual data generated by the MFP use is correctly specified.
> Whether an overwrite instruction is given at appropriate timing.
- For the overwriting by this TOE, overwrite methods such as NSA and DoD can be
specified. However, when there is a function, which is out of the TOE, to encrypt data to
be written on the HDD of the MFP and the function is operating, the data are possibly
overwritten with data that differ from those specified by NSA and DoD overwrite
methods.
CRP-C0416-01
18
9. Annexes
There is no annex.
10. Security Target
Security Target [12] of the TOE is provided as a separate document along with this
Certification Report.
imagio Security Card Type 7, DataOverwriteSecurity Unit Type H Security Target Version
2.00 (November 5, 2013) RICOH COMPANY, LTD.
CRP-C0416-01
19
11. Glossary
The abbreviations relating to the CC used in this report are listed below.
CC Common Criteria for Information Technology Security
Evaluation
CEM Common Methodology for Information Technology Security
Evaluation
EAL Evaluation Assurance Level
PP Protection Profile
ST Security Target
TOE Target of Evaluation
TSF TOE Security Functionality
TSFI TSF Interface
The abbreviations relating to the TOE used in this report are listed below.
DoD Department of Defense
HDD Hard Disk Drive
IDE Integrated Drive Electronics (One of the HDD interfaces)
MFP Multi Function Product
NSA National Security Agency
OS Operating System
The definitions of terms used in this report are listed below.
Document Server
Function
One of the MFP functions.
This function allows users to store scanned paper document
data on the HDD of the MFP. In addition, by using its Copy,
Print, and Document Server Functions, users can print and
delete the document that is stored on the HDD of the MFP.
SD Memory Card A secure digital memory card. A highly functional memory card
that is the size of a postage stamp and can be used to install the
TOE and other applications on the MFP.
CRP-C0416-01
20
12. Bibliography
[1] IT Security Evaluation and Certification Scheme, March 2012,
Information-technology Promotion Agency, Japan, CCS-01
[2] Requirements for IT Security Certification, April 2013,
Information-technology Promotion Agency, Japan, CCM-02
[3] Requirements for Approval of IT Security Evaluation Facility, April 2013,
Information-technology Promotion Agency, Japan, CCM-03
[4] Common Criteria for Information Technology Security Evaluation Part 1:
Introduction and general model, Version 3.1 Revision 4, September 2012,
CCMB-2012-09-001
[5] Common Criteria for Information Technology Security Evaluation Part 2:
Security functional components, Version 3.1 Revision 4, September 2012,
CCMB-2012-09-002
[6] Common Criteria for Information Technology Security Evaluation Part 3:
Security assurance components, Version 3.1 Revision 4, September 2012,
CCMB-2012-09-003
[7] Common Criteria for Information Technology Security Evaluation Part 1:
Introduction and general model, Version 3.1 Revision 4, September 2012,
CCMB-2012-09-001 (Japanese Version 1.0, November 2012)
[8] Common Criteria for Information Technology Security Evaluation Part 2:
Security functional components, Version 3.1 Revision 4, September 2012,
CCMB-2012-09-002 (Japanese Version 1.0, November 2012)
[9] Common Criteria for Information Technology Security Evaluation Part 3:
Security assurance components, Version 3.1 Revision 4, September 2012,
CCMB-2012-09-003 (Japanese Version 1.0, November 2012)
[10] Common Methodology for Information Technology Security Evaluation:
Evaluation methodology, Version 3.1 Revision 4, September 2012, CCMB-2012-09-004
[11] Common Methodology for Information Technology Security Evaluation:
Evaluation methodology, Version 3.1 Revision 4, September 2012, CCMB-2012-09-004
(Japanese Version 1.0, November 2012)
[12] imagio Security Card Type 7, DataOverwriteSecurity Unit Type H Security Target
Version 2.00 (November 5, 2013) RICOH COMPANY, LTD.
[13] imagio Security Card Type 7 (Japanese name), DataOverwriteSecurity Unit Type H
(English name) Version 1.02x Evaluation Technical Report, Version 2.0,
November 22, 2013, ECSEC Laboratory Inc. Evaluation Center