BILISIM TEKNOLOJILERI TEST VE BELGELENDIRME DAÏRESI BASKANLIGI / Doküman No |BTBD-03-01-FR-01 INFORMATION TECHNOLOGIES TEST AND CERTIFICATION DEPARTMENT CCCS CERTIFICATION REPORT IYayın Tarihi [30/07/2015 ReizyonTarni [29/04/2016 [Nos CoH SL. Certification Report EAL 2 Evaluation of ARCELIK A.S Embedded Firmware Security Solution of Connectivity Features V1.0 for Arcelik Bluetooth IoT Devices issued by Turkish Standards Institution Common Criteria Certification Scheme Certificate Number: 21.0.03/TSE-CCCS-58 ei AL Sayfa 1/14 Bu dokiimanin giincelligi, elektronik ortamda TSE Doküman Yünetim Sisteminden takip edilmelidir. BiLisiM TEKNOLOJILERi TEST VE BELGELENDIRME DAIRESi BASKANLIGI / Doküman No |BTBD-03-01-FR-01 INFORMATION TECHNOLOGIES TEST AND CERTIFICATION DEPARTMENT CCCS CERTIFICATION REPORT ayın Tarihi [30/07/2015 Revizyon Tarihi [29/04/2016 |Naj 05 TABLE OF CONTENTS TABLE OF CONTENTS .. DOCUMENT INFORMATION hs DOCUMENT CHANGE LOG 3 DISCLAIMER ........esssssesseesssnessonsenssnssuoonsswssesucensowonsussusstwessisssiounsiessstsenosvsvsstussvenossssbssvstwenavoasetssnsesvaeesiaenssintists 4 FOREWORD RECOGNITION OF THE CERTIFICATE, 1 - EXECUTIVE SUMMARY... 1.1 TOE Overview 1.2 Threats un cn RR QE EN QG RENE 8 2 - CERTIFICATION RESULTS..........sssssssessescssssercesensereseessesseeesenssseeneeseasenssnessensenensesceaseeceesaesesneeessanensseeneneaae 8 2.1 Identification of Target of Evaluation 8 2.2 Security Policy 2.3 Assumptions and Clarification of Scope . 2.4 Architectural Information 2.4.1 Logical SCOPE eue ee ESPERANT NEEDS NAT NT moe 9 2.4.2 Physical Scope 2.5 Documentation... 2.6 IT Product Testing .11 2.7 Evaluated Configuratioı 2.8 Results of the Evaluation... 12 2.9 Evaluator Comments / RecommendationSorssnnsenneeseenneunanennenvsnennssess 13 3 - SECURITY TARGET svcssssssivssssesvnsinssvossessensscsvssusscosssesscssssessscssstessvereoseesstesvaasssvesssoesessabeesvensaseasenasresesias cen 14 4 - BIBLIOGRAPHY..........sccsscsssseesseesesserssssssarsreaesssseessseesssnssaeseusessssessusessaeseeatsessereesnssassesasseseesenerenaeaeeteeeataae 14 ck Sayfa 2/14 uWokümanın güncelligi, elektronik ortamda TSE Doküman Yönetim Sisteminden takip edilmelidir. m BILISIM TEKNOLOJILERI TEST VE BELGELENDIRME DAÏRESI BASKANLIGI / Doküman No _|BTBD-03-01-FR-01 INFORMATION TECHNOLOGIES TEST AND CERTIFICATION DEPARTMENT ayın Tarihi |30/07/2015 CCCS CERTIFICATION REPORT 05 29/04/2016 Na Revigon Tarihi DOCUMENT INFORMATION Date of Issue April 15, 2019 Approval Date April 15, 2019 Certification Report Number 21.0.03/19-004 | Sponsor and Developer Argelik A.S. Evaluation Facility Beam Technology Test Center TOE Embedded Firmware Security Solution of Connectivity Features V1.0 for Arçelik Bluetooth IoT Devices Pages 14 Prepared by Cem ERDIVAN Common Criteria Inspection Expert C Er — & Reviewed by Ibrahim Halil KIRMIZI Common Criteria Technical Responsible “ (Software Product Group) La This report has been prepared by the Certification Expert and reviewed by the Technical Responsible of which signatures are above. DOCUMENT CHANGE LOG Release Date Pages Affected Remarks/Change Reference 1.0 April 16", 2019 All First Release a Sayfa 3/14 Bu dokiimanin giincelligi, elektronik ortamda TSE Doküman Yönetim Sisteminden takip edilmelidir. BILISIM TEKNOLOJILERI TEST VE BELGELENDIRME DAÏRESI BASKANLIGI / Doküman No _|BTBD-03-01-FR-01 INFORMATION TECHNOLOGIES TEST AND CERTIFICATION DEPARTMENT CCCS CERTIFICATION REPORT |Yayın Tarihi [30/07/2015 Reimontarni [29042016 Ind os DISCLAIMER This certification report and the IT product in the associated Common Criteria document has been evaluated at an accredited and licensed evaluation facility conformance to Common Criteria for IT Security Evaluation, version 3.1, revision 5, using Common Methodology for IT Products Evaluation, version 3.1, revision 5. This certification report and the associated Common Criteria document apply only to the identified version and release of the product in its evaluated configuration. Evaluation has been conducted in accordance with the provisions of the CCCS, and the conclusions of the evaluation facility in the evaluation report are consistent with the evidence adduced. This report and its associated Common Criteria document are not an endorsement of the product by the Turkish Standardization Institution, or any other organization that recognizes or gives effect to this report and its associated Common Criteria document, and no warranty is given for the product by the Turkish Standardization Institution, or any other organization that recognizes or gives effect to this report and its associated Common Criteria document. x N Sayfa 4/14 Bu dokümanım güncelligi, elektronik ortamda TSE Doküman Yönetim Sisteminden takip edilmelidir. BILISIM TEKNOLOJILERI TEST VE BELGELENDIRME DAÏRESI BASKANLIGI / Doküman No |BTBD-03-01-FR-01 INFORMATION TECHNOLOGIES TEST AND CERTIFICATION DEPARTMENT ayın Tarihi [30/07/2015 CCCS CERTIFICATION REPORT Roigontaiti [29/04/2016 Ind os FOREWORD The Certification Report is drawn up to submit the Certification Commission the results and evaluation information upon the completion of a Common Criteria evaluation service performed under the Common Criteria Certification Scheme. Certification Report covers all non-confidential security and technical information related with a Common Criteria evaluation which is made under the ITCD Common Criteria Certification Scheme. This report is issued publicly to and made available to all relevant parties for reference and use. The Common Criteria Certification Scheme (CCSS) provides an evaluation and certification service to ensure the reliability of Information Security (IS) products. Evaluation and tests are conducted by a public or commercial Common Criteria Evaluation Facility (CCTL = Common Criteria Testing Laboratory) under CCCS’ supervision. CCEF is a facility, licensed as a result of inspections carried out by CCCS for performing tests and evaluations which will be the basis for Common Criteria certification. As a prerequisite for such certification, the CCEF has to fulfill the requirements of the standard ISO/IEC 17025 and should be accredited by accreditation bodies. The evaluation and tests related with the concerned product have been performed by Beam Technology Testing Facility, which is a commercial CCTL. A Common Criteria Certificate given to a product means that such product meets the security requirements defined in its security target document that has been approved by the CCCS. The Security Target document is where requirements defining the scope of evaluation and test activities are set forth. Along with this certification report, the user of the IT product should also review the security target document in order to understand any assumptions made in the course of evaluations, the environment where the IT product will run, security requirements of the IT product and the level of assurance provided by the product. This certification report is associated with the Common Criteria Certificate issued by the CCCS for Embedded Firmware Security Solution of Connectivity Features V1.0 for Argelik Bluetooth IoT Devices whose evaluation was completed on February 21", 2019 and whose evaluation technical report was drawn up by Beam Technology (as CCTL), and with the Security Target document with version no 0.9 of the relevant product. The certification report, certificate of product evaluation and security target document are posted on the ITCD Certified Products List at bilisim.tse.org.tr portal and the Common Criteria Portal (the official web site of the Common Criteria Project). ce Sayfa 5/14 Bu’dokümanın güncelligi, elektronik ortamda TSE Doküman Yönetim Sisteminden takip edilmelidir, BiLISIM TEKNOLOJILERI

BiLiSiM TEKNOLOJILERI TEST VE BELGELENDIRME DAÏRESI BASKANLIGI / Doküman No |BTBD-03-01-FR-01 INFORMATION TECHNOLOGIES TEST AND CERTIFICATION DEPARTMENT CCCS CERTIFICATION REPORT (as Tai _ 0072015 |Revizyon Tarihi |29/04/2016 [Na 05 Embedded Firmware Security Solution of Connectivity Features v1.0 for Arçelik Bluetooth IoT Devices Required Non-TOE Hardware/Software Configuration: Category Specifications Display Board | MPU 48-MHz ARM Cortex-M0 256KB Flash 32KB SRAM Bluetooth BLE 4.2 Flash Memory 2MB SPI Flash HSM ECC508 Mainboard MPU 48-MHz ARM Cortex-M0+ 128KB Flash 16KB RAM Communication | Mainboard MPU - Display SPI Interface MPU Display MPU - Flash SPI Memory Display MPU - HSM DC Mobile HomeWhiz Requires BLE4.2 or later mobile App/Device device Requires Android 5.0/iOS 9 or later mobile device 2.8 Results of the Evaluation The verdict for the CC Part 3 assurance components (according to EAL2) and the security target evaluation) is summarized in the following table: Class Heading Class Family Description Result ADV: Development ADV_ARC.1 Security architecture description PASS ADV_FSP.2 Security-enforcing functional specification | PASS ADV_TDS.1 Basic design PASS AGD: AGD_OPE.I Operational user guidance PASS Guidance Documents AGD _PRE.l Preparative procedures PASS ALC: ALC_CMC.2 Use of a CM system PASS Lifecycle Support ALC_CMS.2 Parts of the TOE CM coverage PASS ALC_DEL.1 Delivery procedures PASS ASE: ASE CCL.1 Conformance claims PASS Security Target evaluation ASE_ECD.1 Extended components definition PASS ASE INT.1 ST introduction PASS ASE_OBJ.2 Security objectives PASS ASE_REQ.2 Derived security requirements PASS ASE SPD.1 Security problem definition PASS ASE_TSS.1 TOE summary specification PASS Sayfa 12/14 Bu dokümanın güncelligi, elektronik ortamda TSE Doküman Yönetim Sisteminden takip edilmelidir. N BiLisiM TEKNOLOJILERI TEST VE BELGELENDIRME DAÏRESI BASKANLIGI / Doküman No |BTBD-03-01-FR-01 INFORMATION TECHNOLOGIES TEST AND CERTIFICATION DEPARTMENT CCCS CERTIFICATION REPORT ‘aym Tarihi |30/07/2015 Revizyon Tarihi {29/04/2016 No 05 Class Heading Class Family Description Result ATE: ATE _COV.1 Evidence of coverage PASS Tests ATE _FUN.1 Functional testing PASS ATE_IND.2 Independent testing - sample PASS AVA: Vulnerability Analysis | AVA_VAN.2 Vulnerability analysis PASS 2.9 Evaluator Comments / Recommendations No recommendations or comments have been communicated to CCCS by the evaluators related to the evaluation process of “Embedded Firmware Security Solution of Connectivity Features V1.0 for Argelik Bluetooth IoT Devices” product, result of the evaluation, or the ETR. € € M Sayfa 13/14 Bu dokümanın güncelligi, elektronik ortamda TSE Doküman Yünetim Sisteminden takip edilmelidir. BILISIM TEKNOLOJILERI TEST VE BELGELENDIRME DAIRESi BASKANLIGI/ Doküman No |BTBD-03-01-FR-01 INFORMATION TECHNOLOGIES TEST AND CERTIFICATION DEPARTMENT CCCS CERTIFICATION REPORT Yayin Tarihi [30/07/2015 Reizen tarni. [29/04/2016 [No 0s 3 - SECURITY TARGET The security target associated with this Certification Report is identified by the following terminology: Title: Embedded Firmware Security Solution of Connectivity Features V1.0 for Argelik Bluetooth IoT Devices Security Target Version: v0.9 Date of Document: December 25%, 2018 This Security Target describes the TOE, intended IT environment, security objectives, security requirements (for the TOE and IT environment), TOE security functions and all necessary rationale. 4 - BIBLIOGRAPHY [1] Common Criteria for Information Technology Security Evaluation, Version 3.1 Revision 5, April 2017 [2] Common Methodology for Information Technology Security Evaluation, CEM, Version 3.1 Revision 5, April 2017 [3] BTBD-03-01-TL-01 Certification Report Preparation Instructions, Rel. Date: February 8, 2016 [4] ETR v1.2 of Embedded Firmware Security Solution of Connectivity Features V1.0 for Argelik Bluetooth IoT Devices, Rel. Date: February 21%, 2019 [5] Embedded Firmware Security Solution of Connectivity Features V1.0 for Argelik Bluetooth IoT Devices Security Target, Version 0.9, Rel. Date: December 25", 2018 Sayfa 14/14 Bu dokümanın güncelligi, elektronik ortamda TSE Doktiman Yénetim Sisteminden takip edilmelidir.