1
National Information Assurance Partnership
Common Criteria Evaluation and Validation Scheme
Validation Report
for
Black Box Secure KVM/Matrix and KM Peripheral Sharing
Switches
Report Number: CCEVS-VR-10893-2018
Dated: August 3, 2018
Version: 1.0
National Institute of Standards and Technology National Security Agency
Information Technology Laboratory Information Assurance Directorate
100 Bureau Drive 9800 Savage Road STE 6940
Gaithersburg, MD 20899 Fort George G. Meade, MD 20755-6940
®
TM
2
ACKNOWLEDGEMENTS
Validation Team
Stelios Melachrinoudis
Paul Bicknell
Michelle Carlson
Jenn Dotson
Common Criteria Testing Laboratory
Leidos
Columbia, MD
3
Table of Contents
1 Executive Summary...................................................................................................................1
2 Identification..............................................................................................................................3
2.1 Threats...............................................................................................................................3
2.2 Organizational Security Policies.......................................................................................3
2.3 Secure Usage Assumptions...............................................................................................3
3 Architectural Information ..........................................................................................................4
4 Clarifications of Scope...............................................................................................................6
5 Security Policy...........................................................................................................................7
5.1 Keyboard and Mouse Subsystem......................................................................................7
5.2 TOE External Interfaces ...................................................................................................7
5.3 Audio Subsystem ..............................................................................................................7
5.4 Video Subsystem (KVM/Matrix devices only) ................................................................8
5.5 TOE Administration and Security Management...............................................................8
5.6 User Authentication Device Subsystem............................................................................8
5.7 User Control and Monitoring Security .............................................................................8
5.8 Tampering Protection........................................................................................................9
5.9 Self-Testing and Security Audit........................................................................................9
6 Documentation.........................................................................................................................10
7 Independent Testing.................................................................................................................11
7.1 Evaluation team independent testing ..............................................................................11
7.2 Vulnerability analysis .....................................................................................................11
8 Results of the Evaluation .........................................................................................................13
9 Validator Comments/Recommendations .................................................................................14
10 Security Target.........................................................................................................................16
11 Abbreviations and Acronyms ..................................................................................................17
12 Bibliography ............................................................................................................................18
1
1 Executive Summary
This Validation Report (VR) is intended to assist the end-user of this product and any security
certification agent for that end-user to determine the suitability of this Information Technology
(IT) product in their environment. End-users should review the Security Target (ST), (which is
where specific security claims are made) as well as this Validation Report (VR) (which describes
how those security claims were evaluated, tested, and any restrictions that may be imposed upon
the evaluated configuration) to help in that determination. Prospective users should carefully
read the Assumptions and Clarification of Scope in Section 4 and the Validator Comments in
Section 10, where any restrictions on the evaluated configuration are highlighted.
This report documents the National Information Assurance Partnership (NIAP) assessment of the
evaluation of the Black Box KVM/Matrix and KM Peripheral Sharing Switches. It presents the
evaluation results, their justifications, and the conformance results. This VR is not an
endorsement of the Target of Evaluation (TOE) by any agency of the U.S. Government and no
warranty of the TOE is either expressed or implied. This VR applies only to the specific version
and configurations of the products as evaluated and as documented in the ST.
The evaluation of the Black Box KVM/Matrix and KM Peripheral Sharing Switches was
performed by Leidos Common Criteria Testing Laboratory (CCTL) in Columbia, Maryland, in
the United States and was completed in July 2018. The evaluation was conducted in accordance
with the requirements of the Common Criteria and Common Methodology for IT Security
Evaluation (CEM), version 3.1, revision 4 and the assurance activities specified in the Protection
Profile for Peripheral Sharing Switch, Version 3.0 (PSS).
The evaluation was consistent with NIAP Common Criteria Evaluation and Validation Scheme
(CCEVS) policies and practices as described on their web site (www.niap-ccevs.org).
The Leidos evaluation team determined that the Black Box Secure KVM/Matrix and KM
Peripheral Sharing Switches is conformant to the claimed Protection Profile (PP) and, when
installed, configured and operated as specified in the evaluated guidance documentation,
satisfied all of the security functional requirements stated in the ST. The information in this VR
is largely derived from the publicly available Assurance Activities Report (AAR) and the
associated proprietary test report produced by the Leidos evaluation team.
The validation team monitored the activities of the evaluation team, examined evaluation
evidence, provided guidance on technical issues and evaluation processes, and reviewed the
evaluation results produced by the evaluation team. The validation team found that the
evaluation results showed that all assurance activities specified in the claimed PP had been
completed successfully and that the product satisfied all of the security functional and assurance
requirements as stated in the ST.
Therefore, the validation team concludes that the testing laboratory’s findings are accurate, the
conclusions justified, and the conformance results are correct. The conclusions of the testing
laboratory in the evaluation technical report are consistent with the evidence produced.
2
The products, when configured as specified in the guidance documentation, satisfy all of the
security functional requirements stated in the Black Box Secure KVM/Matrix and KM Switch
Security Target.
Item Identifier
Evaluated Product Black Box Secure KVM/Matrix and KM Peripheral Sharing Switches
identified in Table 1, Table 2, and Table 3
Sponsor & Developer John Hickey
Black Box, Inc.
1000 Park Drive
Lawrence, PA 15055
CCTL Leidos
Common Criteria Testing Laboratory
6841 Benjamin Franklin Drive
Columbia, MD 21046
Completion Date August 2018
CC Common Criteria for Information Technology Security Evaluation, Version
3.1, Revision 4, September 2012
Interpretations There were no applicable interpretations used for this evaluation.
CEM Common Methodology for Information Technology Security Evaluation:
Version 3.1, Revision 4, September 2012
PP Protection Profile for Peripheral Sharing Switch, Version 3.0
Disclaimer The information contained in this Validation Report is not an endorsement of
the Black Box Secure KVM/Matrix and KM Peripheral Sharing Switches by
any agency of the U.S. Government and no warranty of the product is either
expressed or implied.
Evaluation Personnel Gregory Beaver
Cody Cummins
Justin Fisher
Gary Grainger
Allen Sant
Kevin Steiner
Validation Personnel Stelios Melachrinoudis, Lead Validator
Paul Bicknell, Senior Validator
Michelle Carlson, ECR Team
Jenn Dotson, ECR Team
The MITRE Corporation
Table 1: Evaluation Details
3
2 Identification
The CCEVS is a joint National Security Agency (NSA) and National Institute of Standards and
Technology (NIST) effort to establish commercial facilities to perform trusted product
evaluations. Under this program, security evaluations are conducted by commercial testing
laboratories called Common Criteria Testing Laboratories (CCTLs) in accordance with National
Voluntary Laboratory Assessment Program (NVLAP) accreditation.
The NIAP Validation Body assigns validators to monitor the CCTLs to ensure quality and
consistency across evaluations. Developers of information technology products desiring a
security evaluation contract with a CCTL and pay a fee for their product’s evaluation. Upon
successful completion of the evaluation, the product is added to NIAP’s Product Compliant List
(PCL).
The following table identifies the evaluated Security Target and TOE.
Name Description
ST Title Black Box Secure KVM/Matrix and KM Switch Security Target
ST Version 1.14
Publication Date May 10, 2018
Vendor and ST
Author
Black Box, Inc.
TOE Reference Black Box KVM/Matrix and KM Peripheral Sharing Switches identified in Table 1,
Table 2, and Table 3
TOE Software
Version
Black Box KVM/Matrix and KM Peripheral Sharing Switches identified in Table 1,
Table 2, and Table 3
Keywords KVM, KM, Isolator, Matrix, Secure, BLACK BOX, Protection Profile 3.0
2.1 Threats
The Security Problem Definition, including the threats, may be found in the PSS.
That information has not been reproduced here.
2.2 Organizational Security Policies
There are no Organizational Security Policies in the PSS.
2.3 Secure Usage Assumptions
The Security Problem Definition, including the assumptions, may be found in the PSS.
4
3 Architectural Information
The Black Box Secure Peripheral Sharing Switches provide a secure medium to share a single
set or more of peripheral components such as keyboard, video display and mouse/pointing
devices among one or multiple computers over USB, DVI, HDMI, and DisplayPort for
KVM/Matrix Switches and keyboard, mouse/pointing devices among multiple computers over
USB for KM Switches. For KVM/Matrix models, the architecture is such that only one set of
keyboard and mouse operation is permitted at a time, thereby enforcing a single user mode of
operation even when multiple input port groups are present.
Some Black Box Secure KVM models with DVI video input and output also include PS/2
connection for keyboard and mouse on the console side. Any text, comment, description and
notation mentioning PS/2 throughout the Security Target are related to KVM models with PS/2
connectors only. Tables 9, 10 and 11 in the Security Target list PS/2 supported models. The PS/2
keyboard and mouse signal is converted to a USB signal using a PS/2 to USB adapter before the
data flow from the keyboard and mouse reaches the microcontroller.
The Black Box Secure PSS product utilizes multiple isolated microcontrollers to emulate the
connected peripherals in order to prevent a multitude of threats. The TOE is also equipped with
numerous unidirectional data flow forcing devices to guarantee isolation of connected computer
data channels.
Black Box Secure KVM port models:
 1-Port
 2-Port
 4-Port
 8-Port
 16-Port
Black Box Secure KVM video outputs (displays):
 Single head
 Dual-head
 Quad-head
Black Box Secure Matrix port models:
 4-Port
 8-Port
Black Box Secure Matrix video outputs (displays):
 Single head – 2 or 4 displays
Black Box Secure KM port models:
 4-Port
 8-Port
5
The Black Box KVM with Preview Screen provides the capability of presenting one or more
video input over a single or two monitors. For instance -
Single monitor system:
All connected PC’s to the TOE (PC 1, 2, 3 and 4) can output video into one monitor.
Two monitor system:
PC 1 outputs video to monitor 1 on the left and the rest (PC 2, 3 and 4) are outputting video to
monitor 2.
The Black Box Secure KVM/Matrix and KM switches are compatible with standard
personal/portable computers, servers or thin-clients. Connected computers are assumed to run
off-the-shelf general-purpose operating systems such as Windows or Linux. The PSS includes
ports for the following interfaces:
 USB keyboard (KVM/Matrix and KM)
 USB mouse (KVM/Matrix and KM)
 PS/2 keyboard and mouse (KVM) – supported models only
 DVI, HDMI 1.4 and DisplayPort 1.2 Video Input (computer ports) (KVM/Matrix) –
specific port depends on model
 DVI, HDMI 1.4 and DisplayPort 1.2 Video Output (peripheral port) (KVM/Matrix) –
specific port depends on model
 3.5mm Audio Input (computer ports) (KVM/Matrix and KM)
 3.5mm Audio Output (peripheral port) (KVM/Matrix and KM)
 USB Smart-card reader, PIV/CAC reader, Token or Biometric reader (KVM/Matrix and
KM) – supported models only
Computers of varying sensitivities are connected to a single TOE that is intended to restrict
peripheral connectivity to one computer at a time. Data leakage is prevented across the TOE to
avoid severe compromise of the user's information.
6
4 Assumptions
The ST identifies the following assumptions about the use of the product:
 It is assumed that the computers and peripheral devices connected to the TOE are not
TEMPEST approved.
 It is assumed that the computers connected to the TOE are not equipped with special
analog data collection cards or peripherals such as: Analog to digital interface, high
performance audio interface, Digital Signal Processing function, and analog video
capture function.
 Physical security, commensurate with the value of the TOE and the data it contains, is
assumed to be provided by the environment.
 TOE Administrators and users are trusted to follow and apply all guidance in a trusted
manner.
 Personnel configuring the TOE and its operational environment will follow the applicable
security configuration guidance.
4.1 Clarifications of Scope
All evaluations (and all products) have limitations, as well as potential misconceptions that need
clarification. This text covers some of the more important limitations and clarifications of this
evaluation. Note that:
1. As with any evaluation, this evaluation only shows that the evaluated configuration meets
the security claims made, with a certain level of assurance (the assurance activities
specified in the claimed PPs and performed by the evaluation team).
2. This evaluation covers only the specific hardware products, and firmware versions
identified in this document, and not any earlier or later versions released or in process.
3. The evaluation of security functionality of the product was limited to the functionality
specified in the claimed PPs. Any additional security related functional capabilities of the
product were not covered by this evaluation. Any additional non-security related
functional capabilities of the product, even those described in the ST, were not covered
by this evaluation.
4. This evaluation did not specifically search for, nor attempt to exploit, vulnerabilities that
were not “obvious” or vulnerabilities to objectives not claimed in the ST. The CEM
defines an “obvious” vulnerability as one that is easily exploited with a minimum of
understanding of the TOE, technical sophistication and resources.
7
5 Security Policy
The TOE implements the User Data Protection and Data Isolation security function policies of
the Protection Profile for Peripheral Sharing Switch as specified in the ST.
The TOE allows an individual user to utilize a single set of peripherals (or in the case of
KVM/Matrix models, an individual user to utilize one of several sets of keyboard/mouse
peripherals) to operate in an environment with several isolated computers (or in the case of the
isolator model, a single isolated computer). All TOE models switch keyboard/mouse input and
audio output from one isolated computer to another. KVM models additionally switch display
output. Some models (those with -UCAC in the model name) additionally switch USB/CAC
authentication devices. Consequently, the TOE security policy consists of data isolation policies
for the traffic that is transmitted to/from peripherals that are connected to the TOE and
computers that are connected to the TOE along with supporting audit, authentication,
management and self-protection policies.
5.1 Keyboard and Mouse Subsystem
The keyboard and mouse processor is programmed in firmware only to accept basic keyboard
and mouse USB devices (standard 108-key keyboard and 3-button mouse). Wireless keyboard
and mouse are not allowed by the TOE. Only USB host peripheral devices are allowed by TOE
keyboard and mouse host emulators. A secure peripheral switch (multiplexer) is used to assure
the selection of just one tied keyboard and mouse serial data stream during TOE operation. The
secure multiplexer has a third position, isolation, which is activated when the TOE has been
tampered with or self-test has failed to disable the keyboard and mouse stream.
5.2 TOE External Interfaces
The TOE only supports AC/DC power, USB keyboard and mouse, video out on supported
models (DVI in/DVI out, DP 1.2 in/DP 1.2 out, DP 1.2 in/HDMI 1.4 out, or VGA in/VGA out
via adapter), analog audio output, and USB authentication devices on supported models.
Docking protocols are not supported by the TOE. Analog microphone or audio line inputs are not
supported by the TOE. Unidirectional audio diodes are placed in parallel on both right and left
stereo channels to ensure unidirectional data flow from the connected computer to the user
peripheral device. Audio data from the connected peripheral devices to the connected computer
is blocked by the audio data diodes.
5.3 Audio Subsystem
Electrical isolation of the audio subsystem from all other TOE interfaces prevents data leakage to
and from the audio paths. The use of microphones or audio line input devices is prohibited. All
TOE devices support analog audio out switching and all TOE devices will prevent the use of
microphone devices. These microphones are stopped through the use of unidirectional audio
diodes on both left and right stereo channels (which force data flow from only the computer to
the connected audio device) and the analog output amplifier which enforces unidirectional audio
8
data flow. The TOE audio subsystem does not delay, store, or convert audio data flows. This
prevents any audio overflow during switching between isolated audio channels.
5.4 Video Subsystem (KVM/Matrix devices only)
Each connected computer has its own TOE isolated channel with its own Extended Display
Identification Data (EDID) emulator and video input port. Data flows from the input video
source through its respective EDID emulator and out of the monitor display port. Each video
input interface is isolated from one another using different EDID ICs, power planes, ground
planes, and electronic components in each independent channel. The TOE supports DVI/DP 1.2
video input, and DVI/HDMI 1.4 video output (depending on the TOE model).
5.5 TOE Administration and Security Management
Each TOE is equipped with an Administration and Security Management Tool that can be
initiated by running an executable file on a computer with keyboard connected to the same
computer via the TOE. The tool requires administrator or a user to be successfully identified and
authenticated by the TOE in order to gain access to any supported feature. Some features are
restricted to the Administrator role only, while other features can be performed by either the
Administrator or User role.
5.6 User Authentication Device Subsystem
TOE models that support USB authentication devices are shipped with default Device Filtration
for the CAC port. The filter is set at default to allow only standard smart-card reader, PIV/CAC
USB 1.1/2.0 token, or biometric reader. All devices must be bus powered only (no external
power source allowed). The TOE default settings accept standard smart-card reader, PIV/CAC
USB 1.1/2.0 token or biometric reader. Authenticated users and administrator can register
(whitelist) other USB devices. All other USB devices are prohibited (blacklisted).
5.7 User Control and Monitoring Security
User monitoring and control of the TOE is performed through the TOE front panel LED
illuminated push-buttons. These buttons are tied to the TOE system controller functionality. All
push-buttons for selecting computer channels are internally illuminated via LEDs. The current
selected channel is indicated by the illumination of the current channel push-button LED (the
other channel LEDs remain off). During operation, all front panel LED indications cannot be
turned off or dimmed by the user in any way including after Restore Factory Default (reset).
KM models of the TOE also support cursor control of selected channel. This identifies the
selected computer by visual position of the mouse cursor. KVM models of the TOE (though not
Matrix models) can also support this if configured to be in KM mode.
All features of the TOE front panel are tested during power up self-testing. From power up until
the termination of the TOE self-test, no channel is selected.
9
5.8 Tampering Protection
In order to mitigate potential tampering and replacement, the TOE is devised to ensure that any
replacement is be detected, any physical modification is evident, and any logical modification is
prevented. The TOE is designed so that access to the TOE firmware, software, or its memory via
its accessible ports is prevented. The TOE is designed to prevent any physical or logical access
its internal memory. There is a mechanical switch on the inside of the TOE that triggers the anti-
tampering state when the enclosure is manually opened. Once the anti-tampering state is
triggered, the TOE is permanently disabled.
5.9 Self-Testing and Security Audit
The TOE has a self-testing function that executes immediately after power is supplied including
Restore Factory Default (reset) and power reset. Self-testing must complete successfully before
normal operational access is granted to the TSF. The self-test function includes the following
activities:
 Basic integrity test of the TOE hardware (no front panel push buttons are jammed).
 Basic integrity test of the TOE firmware.
 Integrity test of the anti-tampering system and control function.
 Test the data traffic isolation between ports.
The TOE has a non-volatile memory event log which records all abnormal security events that
occur within TOE operation. This log can be accessed by the identified and authorized
administrator and dumped into a .txt file using a connected computer and the Administration and
Security Management tool that is provided by the TOE vendor.
10
6 Documentation
The guidance documentation examined during the course of the evaluation and delivered with the
TOE is as follows:
 Black Box Secure KVM Administration and Security Management Tool Guide
(KVM/Matrix and KM), Document ID ADG-2S0-ALL Version 1.1, May 11, 2018
 Advanced 4/8-Port Secure KM Switch User Manual, Document ID USM-2S0-1M0,
Version 1.1A, July 3, 2018
 Advanced 1/2/4-Port DVI-I Secure KVM Switch User Manual, Document ID USM-2S0-
MM1, Version 1.1A, July 3, 2018
 Advanced 2/4/8-Port DisplayPort Secure KVM Switch User Manual, Document ID
USM-2S0-MM3, Version 1.1A, July 3, 2018
 Advanced 8/16-Port DVI-I Secure KVM Switch User Manual, Document ID USM-2S0-
MM1, Version 1.1A, July 3, 2018
 Advanced 2/4-Port HDMI Secure KVM Switch User Manual, Document ID USM-2S0-
MM2, Version 1.1A, July 3, 2018
 Advanced 4/8-Port DVI-D Matrix Secure KVM Switch User Manual, Document ID
USM-2S0-3M1, Version 1.00, April 3, 2018
 4-Port Single-Head Secure Pro DVI-D KVM Switch with KB/Mouse USB Emulation,
CAC and Preview Screen User Manual, Document ID USM-2S0-M21, Version 1.1A,
July 3, 2018
The above documents are considered to be part of the evaluated TOE. The documentation is
delivered with the product and is also available by download from:
https://www.blackbox.com/NIAP3/documentation.
Any additional customer documentation delivered with the TOE or made available through
electronic downloads should not be relied upon for using the TOE in its evaluated configuration.
The Security Target used is:
 Black Box Secure KVM/Matrix and KM Switch Security Target, Document ID: SST-
2S0-ALL, Revision: 1.14, Release Date: May 10, 2018
11
7 Independent Testing
7.1 Evaluation team independent testing
This section describes the testing efforts of the evaluation team. It is derived from information
contained in the following proprietary document:
 Black Box Secure KVM Switch Series Common Criteria Test Report and Procedures,
Version 1.0, May 25, 2018
A non-proprietary summary of the test configuration, test tools, and tests performed may be
found in:
 Assurance Activities Report For Black Box Secure KVM/Matrix and KM Switches,
Version 1.0, June 4, 2018
The purpose of the testing activity was to confirm the TOE behaves in accordance with the TOE
security functional requirements as specified in the ST for a product claiming conformance to the
Protection Profile for Peripheral Sharing Switch, Version 3.0.
The evaluation team performed the independent testing activities to confirm the TOE operates to
the TOE security functional requirements as specified in the ST for a product claiming
conformance to the PSS. The evaluation team devised a Test Plan based on the Testing
Assurance Activities specified in PSS.
Independent testing took place at the vendor facility in North Hollywood, California from April
23, 2018 to April 27, 2018.
Prior to testing, the evaluation team performed an onsite evaluation per NIAP Labgram
#078/Valgram #098: CCTL Evaluation Test Requirements. The vendor site-controlled access to
the test facility. Only the employees who were involved in testing were allowed in the testing
facility. This ensured that testing was performed in an isolated environment to prevent
tampering. All test equipment was verified to be functioning properly before being used as part
of testing.
The evaluators received the TOE in the form that normal customers would receive it, installed
and configured the TOE in accordance with the provided guidance, and exercised the Team Test
Plan on equipment configured in the testing laboratory.
Given the complete set of test results from the test procedures exercised by the evaluators, the
testing requirements for Protection Profile for Peripheral Sharing Switch, Version 3.0 were
fulfilled.
7.2 Vulnerability analysis
A search of public domain sources for potential vulnerabilities in the TOE conducted in May of
2018 did not reveal any known vulnerabilities.
12
The evaluator conducted penetration testing based on the threat model defined in the claimed PP.
The testing did not exploit any vulnerability.
13
8 Results of the Evaluation
The evaluation was conducted based upon the assurance activities specified in Protection Profile
for Peripheral Sharing Switch, Version 3.0, in conjunction with version 3.1, revision 4 of the CC
and the CEM, and all applicable NIAP Technical Decisions, scheme policies, scheme
publications, and official responses to Technical Queries. A verdict for an assurance component
is determined by the resulting verdicts assigned to the corresponding evaluator action elements.
The validation team’s assessment of the evidence provided by the evaluation team is that it
demonstrates that the evaluation team performed the assurance activities in the claimed PPs, and
correctly verified that the product meets the claims in the ST.
The details of the evaluation are recorded in the Evaluation Technical Report (ETR), which is
controlled by the Leidos CCTL. The security assurance requirements are listed in the following
table.
Table 2: TOE Security Assurance Requirements
Assurance Component ID Assurance Component Name
ADV_FSP.1 Basic Functional Specification
AGD_OPE.1 Operational User Guidance
AGD_PRE.1 Preparative Procedures
ALC_CMC.1 Labeling of the TOE
ALC_CMS.1 TOE CM Coverage
ATE_IND.1 Independent Testing – Sample
AVA_VAN.1 Vulnerability Survey
14
9 Validator Comments/Recommendations
The validators suggest that the consumer pay particular attention to the evaluated configuration
of the device(s). The functionality evaluated is scoped exclusively to the security functional
requirements specified in the Security Target, and only the functionality implemented by the
SFR’s within the Security Target was evaluated. All other functionality provided by the devices,
to include software, firmware, or hardware that was not part of the evaluated configuration,
needs to be assessed separately and no further conclusions can be drawn about their
effectiveness.
NIAP established a Peripheral Sharing Switch Technical Rapid Response Team (PSS-TRRT) to
address questions and concerns related to evaluations claiming conformance to Protection
Profile for Peripheral Sharing Switch. A Technical Decision is an issue resolution statement that
clarifies or interprets protection profile requirements and assurance activities. PSS-TRRT has
formally posted six Technical Decisions related to Protection Profile for Peripheral Sharing
Switch: TD0083, TD0086, TD0136, TD0144, TD0251, and TD0298 (see https://www.niap-
ccevs.org/Documents_and_Guidance/view_tds.cfm). All six PSS-TRRT Technical Decisions
applied to this evaluation.
There was one TRRT decision made throughout the course of this evaluation. The TRRT
decision was captured in a modified version of TD0251.
Deprecated TD0141 addressed an issue where no Test F1 existed in the PSS PP; however,
TD0251, which superseded TD0141, did not incorporate that part of the Technical Decision. As
a result, the issue was raised to the PSS TRRT team. Upon review, the PSS Technical
Community (PSS TC) agreed to modify TD0251 to incorporate changes to FMT_MOF.1.1 and
FMT_SMF.1.1 as follows:
FMT_MOF.1.1
The TSF shall restrict the ability to [perform] the functions [selection: modify TOE user
authentication device filtering (CDF) whitelist and blacklist, [assignment: list of functions],
none] to [the authorized administrators].
Application Note: If there are additional management functions performed by the TOE
(including those specified in Section 4.2.4, FMT_SMF), they should be added in the assignment.
Test
The testing for this SFR is covered in Test 4.5, Part 5.
FMT_SMF.1.1a Test
The testing for this SFR is covered in: FMT_SMF.1.1 a - Test 4.5, Part 5
Test 4.5, Part 5
SFRs mapped to the following test steps:
CDF management: FMT_SMF.1.1 a and FMT_SMF.1.1 b
15
In addition to the items mentioned above, some additional product administration and usability
features are worth considering:
 The vendor provides an administrative tool to configure the product. This tool is a
software application that runs on a general-purpose Windows computer. The security of
the application was not separately assessed as part of the evaluation of the product.
Distribution of this tool should only be to systems that are required to perform
administrative functions.
 The product provides administrative functionality, but this is limited to role-based
administration with administrative accounts defined on the product itself. The
administrator must take care to ensure that the account credentials are provided to the
necessary individuals over secure channels.
 The product provides default passwords for its management accounts. The administrator
should ensure that these passwords are changed to secure values. When a credential is
changed the old credential is overwritten with the new credential. This applies to both the
username and password. Since there is no interface to change only the password, an
administrator can perform a similar action by inputting the previous username to the new
username prompt and inputting a different password to the new password prompt.
 An administrator mode is supported in the product, but its usability and features are
limited. The administrator should make sure they enable multiple users and change
default passwords.
 An audit feature is supported but is of a limited nature given the product.
 Different TOE models provide support for different peripheral interfaces. Vendor
guidance must be consulted to determine the interfaces that are supported for a given
TOE model. There is no difference in the underlying security architecture for each TOE
model, so for those interfaces that are shared across multiple models, the required
security functionality is implemented in the same manner.
 Some TOE models support matrix switching functionality (i.e., multiple sets of
keyboard/mouse peripherals can be connected to the TOE simultaneously). The security
policy enforced by the TSF prevents multiple port groups from being used
simultaneously, so this capability does not violate the claimed PP.
 The PSS PP requires that for compliant TOEs, wireless keyboards cannot be used and
that only authorized supported switched methods (e.g. push-buttons) can be used. This is
consistent with the PE-5 access controls for Output Devices as documented in the DoD
Joint Special Access Program (SAP) Implementation Guide (JSIG).
16
10 Security Target
Name Description
ST Title Black Box Secure KVM/Matrix and KM Switch Security Target
ST Version 1.14
Publication Date May 10, 2018
17
11 Abbreviations and Acronyms
Acronym Full Definition
CAC Common Access Card
CCTL Common Criteria Test Lab
CC Common Criteria
CCEVS Common Criteria Evaluation and Validation
Scheme
CCLT Common Criteria Testing Laboratory
DC Direct Current
DP DisplayPort
DVI Digital Visual Interface
EDID Extended Display Identification Data
ETR Evaluation Technical Report
HDMI High Definition Multimedia Interface
KM Keyboard, Mouse
KVM Keyboard, Video and Mouse
LED Light-Emitting Diode
NIAP National Information Assurance Program
NIST National Institute of Standards and Technology
NSA National Security Agency
PCL Product Compliance List
PC Personal Computer
PP Protection Profile
PS/2 IBM Personal System/2 series
PSS Peripheral Sharing Switch
SFR Security Functional Requirements
ST Security Target
TOE Target of Evaluation
TSF TOE Security Functions
USB Universal Serial Bus
VGA Video Graphics Array
VR Validation Report
18
12 Bibliography
The Validation Team used the following documents to produce this Validation Report:
 Common Criteria for Information Technology Security Evaluation Part 1: Introduction,
Version 3.1, Revision 4, September 2012.
 Common Criteria for Information Technology Security Evaluation Part 2: Security
Functional Requirements, Version 3.1 Revision 4, September 2012.
 Common Criteria for Information Technology Security Evaluation Part 3: Security
Assurance Components, Version 3.1 Revision 4, September 2012.
 Common Methodology for Information Technology Security Evaluation, Evaluation
Methodology, Version 3.1, Revision 4, September 2012.
 Common Criteria Evaluation and Validation Scheme - Guidance to CCEVS Approved
Common Criteria Testing Laboratories, Version 2.0, 8 Sep 2008.
 Black Box Secure KVM/Matrix and KM Switch Security Target, Document ID: SST-
2S0-ALL, Revision: 1.14, Release Date: May 10, 2018
 Evaluation Technical Report for Black Box Secure KVM/Matrix and KM Switch,
Version 0.4, June 4, 2018
 Black Box Secure KVM Switch Series Common Criteria Test Report and Procedures,
Version 1.0, May 25, 2018
 Black Box Secure KVM/Matrix and KM Switch Vulnerability Survey, Version 1.0, May
18, 2018
 Assurance Activities Report For Black Box Secure KVM/Matrix and KM Switches,
Version 1.0, June 4, 2018