GeNUGate Firewall 6.0 Security Target Version 242 22. August 2006 GeNUA mbH Domagkstr. 7, D-85551 Kirchheim, Germany Version 242 2 Table of Contents 1 ST INTRODUCTION.................................................................................................4 1.1 Identification............................................................................................................4 1.2 Overview..................................................................................................................4 1.3 ISO/IEC 15408 Conformance.................................................................................6 2 TOE DESCRIPTION.................................................................................................7 2.1 The Application Level Gateway.............................................................................7 2.2 The Packet Filter.....................................................................................................9 2.3 Physical Scope and Boundary..............................................................................9 2.4 Logical Scope and Boundary..............................................................................11 3 TOE SECURITY ENVIRONMENT..........................................................................13 3.1 Users and Assets..................................................................................................13 3.2 Assumptions.........................................................................................................14 3.3 Threats...................................................................................................................14 3.4 Organizational Security Policies.........................................................................15 4 SECURITY OBJECTIVES......................................................................................16 4.1 Security Objectives for the TOE..........................................................................16 4.2 Security Objectives for the Environment...........................................................16 5 IT SECURITY REQUIREMENTS............................................................................18 5.1 TOE Security Functional Requirements.............................................................18 5.1.1 Class FAU: Security audit....................................................................................18 5.1.2 Class FDP: User data protection.........................................................................20 5.1.3 Class FIA: Identification and authentication......................................................30 5.1.4 Class FMT: Security management......................................................................31 5.1.5 Class FPT: Protection of the TSF........................................................................36 5.2 Tailored or new SFR.............................................................................................36 5.2.1 Class FAU: Security audit....................................................................................36 5.2.2 Class FIA: Identification and authentication......................................................37 5.2.3 Class FPT: Protection of the TSF........................................................................37 5.3 TOE Security Assurance Requirements.............................................................38 5.4 Security Requirements for the IT Environment.................................................39 5.4.1 Class FPT: Protection of the TSF........................................................................40 6 TOE SUMMARY SPECIFICATION........................................................................41 6.1 TOE Security Functions.......................................................................................41 6.1.1 SF_SA: Security audit..........................................................................................41 6.1.2 SF_DF: Data flow control.....................................................................................41 6.1.3 SF_IA: Identification and Authentication...........................................................42 6.1.4 SF_SM: Security management............................................................................43 Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 3 6.1.5 SF_PT: Protection of the TSF..............................................................................44 6.1.6 Probabilistic or Permutational Security Functions...........................................44 6.2 Assurance Measures............................................................................................45 6.2.1 Configuration management.................................................................................45 6.2.2 Delivery and operation.........................................................................................45 6.2.3 Development..........................................................................................................45 6.2.4 Guidance documents...........................................................................................45 6.2.5 Life cycle support.................................................................................................45 6.2.6 Tests.......................................................................................................................45 6.2.7 Vulnerability assessment.....................................................................................45 7 PP CLAIMS.............................................................................................................46 8 RATIONALE...........................................................................................................47 8.1 Security Objectives Rationale.............................................................................47 8.2 Security Requirements Rationale.......................................................................49 8.2.1 Objectives..............................................................................................................49 8.2.2 New or tailored SFR..............................................................................................57 8.2.3 Dependencies between the SFR and SAR.........................................................58 8.3 Assurance Requirements Rationale...................................................................64 8.4 Strength of Function Rationale...........................................................................64 8.5 TOE Summary Specification Rationale..............................................................64 8.6 PP Claims Rationale.............................................................................................76 9 Appendix................................................................................................................77 9.1 Tailored or new SFR.............................................................................................77 9.1.1 Class FAU: Security audit....................................................................................77 9.1.2 Class FIA: Identification and authentication......................................................78 9.1.3 Class FPT: Protection of the TSF........................................................................79 10 Glossary.................................................................................................................82 11 Abbreviations........................................................................................................84 Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 1 ST INTRODUCTION 4 1 ST INTRODUCTION The introductory section presents the unique identifiers for the security target (ST) and the Target of Evaluation (TOE). A brief overview of the ST and the standards conformance claim follow. 1.1 Identification ST Title: GeNUGate Firewall 6.0 Security Target, Version 242 TOE Identification: GeNUGate Firewall 6.0 Product Identification: GeNUGate 6.0 Z Patchlevel 11 CC Version: Common Criteria for Information Technology Security Evaluation, Version 2.1, 1999 Assurance Level: EAL 4, augmented by AVA_VLA.4 and ALC_FLR.2 Keywords: Two-Tiered Firewall, Application Level Gateway, Packet filter, Proxy server, Network security, Information flow control, 1.2 Overview The TOE GeNUGate Firewall 6.0 is part of a larger product, the firewall GeNUGate 6.0 Z, which consists of hardware and software. The TOE GeNUGate Firewall 6.0 itself is part of the shipped software. The operating system is a modified OpenBSD. GeNUGate 6.0 Z is a combination of an application level gateway (ALG) and a packet filter (PFL), which are implemented on two different systems. It is thus a two-tiered firewall. Both systems are shipped in one case. The network connection between ALG and PFL is a cross cable. Besides the network interface to the PFL, the ALG has (at least) three more interfaces to connect to the external network, the administration network and the secure server network. The PFL has a second interface which is connected to the internal network. The aim of the firewall is to control the IP-traffic between the different connected networks. There- fore the ALG uses proxies that control all data transmitted between the different networks, while the PFL uses packet filtering as an additional means to control all data that is send to and from the internal network. The TOE, GeNUGate Firewall 6.0, consists of the software that implements the IP traffic control and related functionality of the firewall. This includes the proxies, the modified OpenBSD kernel modules IP-stack, packet filter, but also other supportive functionality as logging of security events (see the next section for a more accurate definition of the TOE scope and boundary). The TOE has a special maintenance mode. During normal operation IP packets are handled as usual and the file system is secured by the BSD flags. In maintenance mode, however, the BSD flags can be altered for maintenance operation. In this mode all IP packets are dropped for security reasons. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 1 ST INTRODUCTION 5 Figure 1: GeNUGate 6.0 Z overview The design of the GeNUGate product family includes the following security features: The ALG does not perform IP forwarding. The modified OpenBSD kernel performs extra spoofing checks. The source and destination address of the IP packet are checked against the IP address (and netmask) of the receiving interface. The modified OpenBSD kernel logs all events that occur while checking incoming IP packets. The filter rules of ALG and PFL cannot be modified during normal operation. Proxies that accept connections from the connected networks run in a restricted runtime environment. The log files are analysed online. The administrators are notified about security relevant events. File system flags prohibit the deletion of log messages. The internal network is protected by a two-tiers security architecture that filter on different levels of the network stack (ALG and PFL). Security Target GeNUGate Firewall 6.0 GeNUA mbH ALG PFL GeNUGate 6.0 Z external network cross network secure server network administrative network internal network dmz Version 242 1 ST INTRODUCTION 6 1.3 ISO/IEC 15408 Conformance The TOE is Part 2 extended and Part 3 conformant of the CC Version 2.1. [CC_1]: Common Criteria for Information Technology Security Evaluation, Part 1: Introduction and general model, Version 2.1, 1999. [CC_2]: Common Criteria for Information Technology Security Evaluation, Part 2: Security func- tional requirements, Version 2.1, 1999. [CC_3]: Common criteria for Information Technology Security Evaluation, Part 3: Security assur- ance requirements, Version 2.1, 1999. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 2 TOE DESCRIPTION 7 2 TOE DESCRIPTION The TOE GeNUGate Firewall 6.0 is used to control the connections and data transfer between different networks, where each network has different security needs and different threat levels for the other networks. GeNUGate 6.0 Z is a combination of an application level gateway (ALG) and a packet filter (PFL), which are implemented on two different systems. It is thus a two-tiered firewall. The network connection between ALG and PFL is a cross cable. The TOE can be configured in such a way that the security needs for each network are optimally met. A standard configuration consists of the following networks connected to the TOE: internal network: This is the network that has to be secured against attacks from the external network. Usually only a few services from the internal network are accessible from the external network, secured by user authentication. This is the network that is secured by both the ALG and the PFL, using filtering mechanisms at two different levels of the IP stack. This network is usually controlled by a defined security policy. external network: This is the most insecure network, e. g. the internet. In general, no security policy exists, and all kind of attacks can occur in this network. administration network: This network is used to allow a secure administration of the TOE. This network is isolated from all other networks and only administrators have access. secure server network: This network allows access to common services from the external network, without the need to open the internal network. Usually, Web- and FTP-servers are installed in this network. This network is usually controlled by a defined security policy. The TOE includes the following security features: The ALG does not perform IP forwarding. The modified OpenBSD kernel performs extra IP spoofing checks. The modified OpenBSD kernel logs all events that occur while checking incoming IP packets. The filter rules of ALG and PFL cannot be modified during normal operation. Proxies that accept connections from the connected networks run in a restricted runtime environment. The log files are analysed online. The administrators are notified about security relevant events. File configuration of the system flags prohibit the deletion of log messages. The internal network is protected by a two-tiers security architecture that filter on different levels of the network stack (ALG and PFL). 2.1 The Application Level Gateway The ALG uses relays to provide and control connections between the different networks. The re- lays, which are user-space proxies, are necessary, because the kernel of the ALG has no capabili- ties to forward IP packets. All IP traffic has to be reassembled and transferred to user space by Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 2 TOE DESCRIPTION 8 the kernel. The proxies examine the data and perform most of the filtering and controlling function. The protocol-specific proxies have enough knowledge about the respective protocol in order to fil- ter possible threatening or insecure protocol elements. The proxies implement several access con- trol lists that allow a fine grained control for the usage of services. All proxies can be transparent with respect to the source and/or destination address, so that the ALG can be configured transpar- ent with respect to IP addressing. The ALG checks for source or destination spoofing attacks. The TOE provides proxy support for the following services/protocols: IP: This relay can be used for all IP protocols (besides ICMP ECHO, UDP, or TCP, which are supported by their own proxies). It is a very generic proxy and has no knowledge about any application level protocol. PING: This relay is used if the ALG should transmit ICMP ECHO REQUEST and ICMP REPLY packets from one network into another. UDP: This relay is a generic proxy than can be used for almost any service that is based on UDP. TCP: This relay is a generic proxy that can be used for services based on TCP. It has no knowledge about application level protocols. NNTP: This relay is an application specific proxy for the NNTP protocol. All protocol commands are analysed and can be filtered. It has an interface to an optional virus scanner. POP: This relay is an application specific proxy for the POP protocol. All protocol commands are analysed and can be filtered. It has an interface to an optional virus scanner. FTP: This relay is an application specific proxy for the FTP protocol. All protocol commands are analysed and can be filtered. It has an interface to an optional virus scanner. HTTP: This relay is an application specific proxy for the HTTP protocol. All protocol commands are analysed and can be filtered. This proxy analyses only the protocol itself, but not the application data that is transported by the HTTP protocol. It is usu- ally used to allow access to a web server that is located in the secure server network from the other networks. WWW: This relay is an application specific proxy for the HTTP protocol and its ap- plication data. This proxy analyses the HTTP protocol headers and the application data. The content-type of the application data can be used to either filter text data or to scan binary data for viruses. It has an interface to an optional virus scanner. TELNET: This relay is an application specific proxy for the TELNET protocol. All protocol commands are analysed and can be filtered. SMTP: This relay is an application specific proxy for the SMTP protocol. All protocol commands are analysed and can be filtered. The mail header and bodies can be fil- tered. It contains functionality to filter SPAM mail. It has an interface to an optional virus scanner. All relays are highly configurable. The preferred configuration method is through HTML forms that are transported by secure https-connections in the administration network. User identification and authentication can be configured in two ways. Some relays have support for authentication in the respective protocol. These relays can authenticate their users against au- thentication servers. The side channel authentication allows the usage of special configured relays Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 2 TOE DESCRIPTION 9 after user identification at a special web form at the TOE. 2.2 The Packet Filter The internal network has high security needs and is therefore not directly connected to the ALG, but is connected to the PFL. The PFL has at least two network interfaces. One of them is connected to the ALG with a cross cable. The (small) network is called the cross network. The other interface connects to the internal network. The PFL works as packet filter with a set of filter rules. Only configured TCP connection requests from the cross network are allowed, but there is no restriction for TCP packets from the internal network. In order to allow UDP (and other protocols), extra rules have to be added to the filter rules by administrators. The PFL is a minimalistic system. It boots from a removable read-only medium (floppy or USB stick with mechanical write protection) and has no other permanent memory. The medium is configured and created at the ALG. Physical access is needed to write the medium at the ALG, transfer it from the ALG to the PFL, and reboot the PFL with the new configuration. The configuration of the PFL is done through the web based administration tool at the ALG. Table 1: Scope of delivery Type Name Release Date Medium Hardware GeNUGate 400, 600, 800 or 200 with fourth network interface N/A Software GeNUGate Firewall 6.0 21.08.2006 CD-ROM Software GeNUGate Platform 6.0 Z Patchlevel 11 21.08.2006 CD-ROM Documentation Administrator and user guidance manual 6.0 Z 21.08.2006 Manual and CD-ROM Hardware PFL floppy/USB stick N/A 2.3 Physical Scope and Boundary Both ALG and PFL run on Intel compatible hardware that works with OpenBSD. As the product GeNUGate 6.0 Z is a combination of hardware and software, the hardware components are selected by GeNUA. The end user has no need to check for compatibility. The scope of delivery can be seen in table 1. The TOE is located as software on the CD-ROM. The physical connections are: the network interfaces to the external, internal, secure server and administration networks connections for the keyboard, monitor, and serial interfaces at the ALG and PFL power supply Figure 2 gives a schematic overview on the TOE and its environment. It divides the software on Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 2 TOE DESCRIPTION 10 ALG and PFL into user and kernel space parts. On both systems, the user and the kernel space contain part of the TOE, and part of the environment. The following table lists the components in each part. The components for the parts A, B, C and D are part of the TOE. The components for E, F, G, and H are part of the environment. Figure 2: Scope and boundary A ALG TOE User space relays, logging, administration webserver, user webserver, configuration commands, system startup. B ALG TOE Kernel space network layer, logging, system call interface. C PFL TOE User space logging, system startup. D PFL TOE Kernel space network layer, logging, system call interface. E ALG Environment User space squid, sendmail, bind, ntpd, GeNUGate options: VPN , HA , GeNUAuth, URL filter, virus scanner; authentication methods, os environment. F ALG Environment Kernel space process management, memory management, device drivers, socket layer, tty driver, I/O system, IPC operation, file systems. G PFL Environment User space os environment. H PFL Environment Kernel space process management, memory management, device drivers, socket layer, tty driver, I/O system, IPC operation, file systems. Security Target GeNUGate Firewall 6.0 GeNUA mbH A E B F ALG Kernel User C D G H PFL Kernel User GeNUGate Firewall 6.0 A ALG TOE User space B ALG TOE Kernel space C PFL TOE User space D PFL TOE Kernel space GeNUGate 6.0 Z E ALG Environment User space F ALG Environment Kernel space G PFL Environment User space H PFL Environment Kernel space Version 242 2 TOE DESCRIPTION 11 The different parts have the following interfaces with one another: A B System call interface A E Interprocess communication (via system call interface) B F Kernel interfaces between the kernel components C D System call interface C G Interprocess communication (via system call interface) D H Kernel interfaces between the kernel components ALG PFL serial connection ALG PFL network connection Depending on their roles, the users interact with the product in the following ways: user: Relay usage (sending and receiving IP packets to and from the TOE) user: Authentication dialogues for protocols that allow for authentication. user: user web interface to change password user: user web interface for the side channel authentication to activate IP addresses administrator: administration web interface administrator: interactive access at the shell level at the console 2.4 Logical Scope and Boundary The TOE has the following logical scope: the kernel components `network', `packet filter', and `restricted runtime' for ALG and PFL. This components perform the spoofing checks, packet filtering and access control for incoming data. The spoofing checks contain detecting any mismatch between the source and destination address of the IP packet and the IP address and netmask of the receiving interface. the relays for IP, ICMP, PING, UDP, TCP, TELNET, FTP, NNTP, POP, SMTP, HTTP and WWW. These components perform the filtering on application level, ACL checks, and calls to the optional virus scanner. The virus scanning functionality is not part of the TOE. The TELNET- and FTP-relay allow for user authentication. The authentication methods themselves are not part of the TOE. system startup. This component performs the secure startup of the system and the conversion to maintenance mode. the logging and self-monitoring tools. These components perform the accounting and auditing functions. administration web server. This component allows the configuration by administrators. user web server. This component allows users to change their passwords. side channel webserver. This component allows users to activate IP addresses through the side channel mechanism. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 2 TOE DESCRIPTION 12 The TOE has the following logical boundaries: virus scanner interface: delivering the data to the virus scanner and obtaining the scanner result. The virus scanner itself is not part of the TOE. external authentication methods: interaction with the authentication service. The authentication methods themselves are not part of the TOE. configuration interface: sending forms to and receiving form data from a web brows- er The TOE excludes the following options or services from its logical scope: the high availability option for GeNUGate 6.0 Z the VPN option for GeNUGate 6.0 Z the Secure Proxy option for GeNUGate 6.0 Z the GeNUAuth option for GeNUGate 6.0 Z the URL filter option for GeNUGate 6.0 Z authentication services (password, radius, LDAP, S/Key, or cryptocard) either local or remote virus scanner engines the HTTP proxy squid the mail delivery program sendmail the bind domain name service the ntpd network time protocol daemon Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 3 TOE SECURITY ENVIRONMENT 13 3 TOE SECURITY ENVIRONMENT In order to clarify the nature of the security problem that the TOE is intended to solve, this section describes the following: Any assumptions about the security aspects of the environment and/or of the man- ner in which the TOE is intended to be used. Any known or assumed threats to the assets against which specific protection within the TOE or its environment is required. Any organizational security policy statements or rules with which the TOE must comply. 3.1 Users and Assets The following users and assets will be used in the description of the threats and policies. Table 2: Users Users user Any person or software agent sending IP packets to or receiving from the TOE. The assumed attack potential is high. The general term user is used when it does not matter whether the user did authenticate at the TOE or not. unauthenticated user Any person or software agent sending IP packets to or receiving from the TOE that did not authenticate at the TOE. The assumed attack potential is high. This term is used for users that did not (yet) authenticate at the TOE. authenticated user Any person or software agent sending IP packets to or receiving from the TOE that authenticated at the TOE. The assumed attack potential is high. administrator These are authenticated users that have the role of an administrator. This role authorises them to change the TOE configuration. Their assumed attack potential is undefined. auditor These are authenticated users that have the role of an auditor. This role authorises them to view the TOE configuration. Their assumed attack potential is undefined. Table 3: Assets Assets resources in the connected networks The resources in the connected networks that the TOE is supposed to protect. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 3 TOE SECURITY ENVIRONMENT 14 Assets security sensitive data on the TOE The data on the TOE that contains security sensitive data. 3.2 Assumptions Table 4: Assumptions Assumptions A.PHYSEC The TOE is physically secure. Only authorised persons have physical access to the TOE. A.NOEVIL Administrators are non-hostile and follow all administrator guidance; however, they are capable of error. They use passwords that are not easily guessable. A.ADMIN All administration is done only in the administration network. A.SINGEN Information can not flow among the internal, external, or secure server network, unless it passes through the TOE. A.POLICY The security policy of the internal network allows only the administrators access to the network components and the network configuration. A.TIMESTMP The environment provides reliable timestamps. 3.3 Threats Table 5: Threats Threats T.NOAUTH An unauthenticated user may attempt to bypass the security functions of the TOE and gain unauthenticated access to resources in other connected networks or read, modify or destroy security sensitive data on the TOE. The attack method is exploiting authentication protocol weaknesses. T.SPOOF A user may attempt to send spoofed IP packets to the TOE in order to gain unauthorised access to resources in other connected networks. Without spoofing checks the TOE would route a response to the spoofed IP packet into a connected network that the user is not authorised to access. T.MEDIAT A user may send non-permissible data through the TOE that result in gaining access to resources in other connected networks. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 3 TOE SECURITY ENVIRONMENT 15 Threats T.SELPRO A user may gain access to the TOE and read, modify or destroy security sensitive data on the TOE, by sending IP packets to the TOE and exploiting a weakness of the protocol used. 3.4 Organizational Security Policies Table 6: Policies Policies P.AUDIT All users must be accountable for their actions. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 4 SECURITY OBJECTIVES 16 4 SECURITY OBJECTIVES The purpose of the security objectives is to describe the planned response to a security problem or threat. Threats can be directed against the TOE or the security environment. The CC identifies two categories of security objectives: security objectives for the TOE security objectives for the operating environment 4.1 Security Objectives for the TOE Table 7: Objectives Objectives O.IDAUTH The TOE must identify all network packets from the connected networks. It must check the IP addresses of the packet with the receiving interface to recognize IP-spoofing. It must identify all users before granting access to the security functions of the TOE. It must authenticate the users where an authentication is required. O.MEDIAT The TOE must mediate the flow of all data between all connected networks. O.SECSTA On start-up, the TOE must not compromise its resources or those of the connected networks. O.SELPRO The TOE must have self-protection mechanisms that hinder attempts by users to bypass, deactivate or tamper with TOE security functions. O.AUDREC The TOE must provide an audit trail of security-related events, and a means to present a readable and searchable view to authorised users. O.ACCOUN The TOE must provide user accountability for data flows through the TOE and for the use of the security functions of administrators. O.SECFUN The TOE must allow administrators to use the TOE security functions and must ensure that only authorised administrators have access to the functionality. 4.2 Security Objectives for the Environment Table 8: Objectives for the environment Objectives for the environment OE.PHYSEC Those responsible for the TOE must assure that the TOE is placed at a secured place where only authorised people have access. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 4 SECURITY OBJECTIVES 17 Objectives for the environment OE.NOEVIL Those responsible for the TOE must assure that all administrators are competent, regularly trained and execute the administration in a responsible way. OE.ADMIN Those responsible for the TOE must assure that administration is only done in the administration network. OE.SINGEN Those responsible for the TOE must assure that the TOE is the only connection between the different networks. OE.POLICY Those responsible for the TOE must assure that the security policy for the internal network allows only administrators access to the network components and the network configuration. They must assure that the policy is maintained. OE.TIMESTMP The IT-environment must supply reliable timestamps for the TOE. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 18 5 IT SECURITY REQUIREMENTS All of the security functional requirements in subsection 5.1 have been drawn from the CC Part 2. The functional requirements in the subsection 5.2 (FPT_SST, FPT_RTE, FAU_GEN.1EX and FIA_UAU.5EX) are not drawn from CC Part 2. The SFRs are listed in the appendix. In the following, the unmodified text from the functional requirement templates is displayed in a sanserif font. The operation assignment is set in a bold italic serif font. The operations selection and refinement are set in an italic serif font. The operation assignment is set in a bold italic serif font. The iterations are done by repeating the requirements and adding a colon and a sequence number. In a few occasions, the text has been modified slightly. The replacement text is placed directly after the crossed-out original text, and is set in an italic serif font. 5.1 TOE Security Functional Requirements 5.1.1 Class FAU: Security audit Security audit automatic response (FAU_ARP) FAU_ARP.1 Security alarms FAU_ARP.1.1 The TSF shall take configurable actions (log, digest, wall, exec, mail, down, halt) upon detection of a potential security violation. Security audit analysis (FAU_SAA) FAU_SAA.1 Potential violation analysis FAU_SAA.1.1 The TSF shall be able to apply a set of rules in monitoring the audited events and based upon these rules indicate a potential violation of the TSP. FAU_SAA.1.2 The TSF shall enforce the following rules for monitoring audited events: a) Accumulation or combination of configurable events (packet filter violations, selected messages of daemons, selected messages of the relays, selected kernel messages and messages from the processes that implement the self-tests) known to indicate a potential security violation; b) none. Security audit review (FAU_SAR) FAU_SAR.1 Audit review FAU_SAR.1.1 The TSF shall provide administrators and auditors with the capability to read all audit information from the audit records. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 19 FAU_SAR.1 Audit review FAU_SAR.1.2 The TSF shall provide the audit records in a manner suitable for the user to interpret the information. FAU_SAR.2 Restricted audit review FAU_SAR.2.1 The TSF shall prohibit all users read access to the audit records, except those users that have been granted explicit read-access. FAU_SAR.3 Selectable audit review FAU_SAR.3.1 The TSF shall provide the ability to perform searches of audit data based on time, date, process id, additional log data (for relay audit data: relay type, connection state, IP addresses and ports, status of logged event, bytes transferred). Security audit event storage (FAU_STG) FAU_STG.2 Guarantees of audit data availability FAU_STG.2.1 The TSF shall protect the stored audit records from unauthorised deletion. FAU_STG.2.2 The TSF shall be able to prevent unauthorised modifications to the audit records in the audit trail. FAU_STG.2.3 The TSF shall ensure that a configurable amount (default 10%) of the total disc partition space available for audit records will be maintained when the following conditions occur: audit storage exhaustion, failure, attack. FAU_STG.4 Prevention of audit data loss FAU_STG.4.1 The TSF shall prevent auditable events, except those taken by the authorised user with special rights and execute a configurable action (default: inform the administrators) if the audit trail is full. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 20 5.1.2 Class FDP: User data protection Information flow control policy (FDP_IFC) FDP_IFC.1:1 Subset information flow control FDP_IFC.1.1:1 The TSF shall enforce the unauthenticated user SFP on a) subjects: users that send and receive information through the TOE to one another; b) information: traffic sent through the TOE from one subject to another; c) operation: pass information. FDP_IFC.1:2 Subset information flow control FDP_IFC.1.1:2 The TSF shall enforce the authenticated user SFP on a) subjects: users that send and receive FTP or TELNET information through the TOE to one another, only after the user initiating the information flow has authenticated at the TOE through the FTP or TELNET authentication mechanism; b) information: FTP and TELNET traffic sent through the TOE from one subject to another; c) operation: pass information. FDP_IFC.1:3 Subset information flow control FDP_IFC.1.1:3 The TSF shall enforce the identified side channel user SFP on a) subjects: users that send and receive information through the TOE to one another, only after identifying the user by IP address; b) information: traffic sent through the TOE from one subject to another; c) operation: pass information. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 21 FDP_IFC.1:4 Subset information flow control FDP_IFC.1.1:4 The TSF shall enforce the authenticated gui user SFP on a) subjects: users that send and receive information to /from the TOE; b) information: html form data for side channel authentication and user password changes; c) operation: pass information. FDP_IFC.1:5 Subset information flow control FDP_IFC.1.1:5 The TSF shall enforce the authenticated administrator SFP on a) subjects: administrators from the administration network that send and receive information to/from the TOE; b) information: html form data for administration; c) operation: pass information. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 22 Information flow control functions (FDP_IFF) FDP_IFF.1:1 Simple security attributes FDP_IFF.1.1:1 The TSF shall enforce the unauthenticated user SFP based on the following types of subject and information security attributes: The header information of network packets, depending on their type: a) TCP: IP and TCP header; b) UDP: IP and UDP header; c) ICMP: IP header and ICMP message; d) IP: IP header; The actual date and time. The incoming and outgoing interfaces. Additional information depending on the handling relay: a) IP-relay: none; b) PING-relay: none; c) UDP-relay: none; d) TCP-relay: none; e) NNTP-relay: protocol and application data; f) POP-relay: protocol and application data; g) SMTP-relay: protocol and application data; h) FTP-relay: protocol data; i) TELNET-relay: protocol data; j) HTTP-relay: protocol data; k) WWW-relay: protocol and application data. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 23 FDP_IFF.1:1 Simple security attributes FDP_IFF.1.2:1 The TSF shall permit an information flow between a controlled subject and controlled information via a controlled operation if the following rules hold: IP spoofing check pass. IP option check pass. The 'connection' is configured: a) PING-relay: source and destination IP are allowed; b) IP-relay: source and destination IP and protocol are allowed; c) UDP-relay: source and destination IP and port are allowed; d) TCP-relay: source and destination IP and port are allowed; e) all other relays: source and destination IP and port are allowed. The ALG packet filter rules pass. All ACL checks for the respective relay pass. For packets that have a source or destination address from the internal network: The PFL packet filter rules pass. FDP_IFF.1.3:1 The TSF shall enforce the none. FDP_IFF.1.4:1 The TSF shall provide the following none. FDP_IFF.1.5:1 The TSF shall explicitly authorise an information flow based on the following rules: none. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 24 FDP_IFF.1:1 Simple security attributes FDP_IFF.1.6:1 The TSF shall explicitly deny an information flow based on the following rules: The protocol data is filtered: NNTP-relay: configurable protocol elements from the client are discarded. POP-relay: configurable protocol elements from the client are discarded. SMTP-relay: configured checks for mail sender and recipient, greylisting, mail relay lead to the rejection of mail. FTP-relay: configurable protocol elements from the client are discarded. TELNET-relay: none HTTP-relay: The request URIs are blocked if they contain configurable string pattern. WWW-relay: configurable protocol elements from the client or server are discarded; configurable cookies are filtered. The application data is filtered: NNTP-relay: Application data of content-type text/html can be filtered for active contents, if configured. A virus scanner can check the application data. MIME-encoded messages are (recursively) parsed their parts checked like non encoded messages. POP-relay:Application data of content-type text/html can be filtered for active contents, if configured. A virus scanner can check the application data. MIME-encoded messages are (recursively) parsed their parts checked like non encoded messages. SMTP-relay: E-mail contents of content-type text/html can be filtered for active contents, if configured. A virus scanner can check the application data. MIME-encoded e-mails are (recursively) parsed their parts checked like non encoded e-mails. WWW-relay: Server replies of content-type text/html can be filtered for active contents, if configured. A virus scanner can check the application data. MIME-encoded replies are (recursively) parsed their parts checked like non encoded contents. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 25 FDP_IFF.1:2 Simple security attributes FDP_IFF.1.1:2 The TSF shall enforce the authenticated user SFP based on the following types of subject and information security attributes: The header information of network packets, depending on their type: a) TCP: IP and TCP header. The actual date and time. The interfaces from which the packets are received and to which they are delivered. Additional information depending on the configurable handling relay: a) FTP-relay: protocol data; b) TELNET-relay: protocol data. FDP_IFF.1.2:2 The TSF shall permit an information flow between a controlled subject and controlled information via a controlled operation if the following rules hold: IP spoofing check pass. IP option check pass. The 'connection' is configured: Source and destination IP and port are allowed. The ALG packet filter rules pass. All ACL checks for the relay pass. The user can be authenticated by the authentication data. For packets that have a source or destination address from the internal network: The PFL packet filter rules pass. FDP_IFF.1.3:2 The TSF shall enforce the none. FDP_IFF.1.4:2 The TSF shall provide the following none. FDP_IFF.1.5:2 The TSF shall explicitly authorise an information flow based on the following rules: none. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 26 FDP_IFF.1:2 Simple security attributes FDP_IFF.1.6:2 The TSF shall explicitly deny an information flow based on the following rules: The protocol data is filtered: FTP-relay: configurable protocol elements from the client are discarded. TELNET-relay: none. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 27 FDP_IFF.1:3 Simple security attributes FDP_IFF.1.1:3 The TSF shall enforce the identified side channel user SFP based on the following types of subject and information security attributes: The header information of network packets, depending on their type: a) TCP: IP and TCP header. The actual date and time. The interfaces from which the packets are received and to which they are delivered. FDP_IFF.1.2:3 The TSF shall permit an information flow between a controlled subject and controlled information via a controlled operation if the following rules hold: IP spoofing check pass. IP option check pass. The 'connection' is configured: TCP-relay: source and destination IP and port are allowed. The ALG packet filter rules pass. All ACL checks for the respective relay pass. For packets that have a source or destination address from the internal network: The PFL packet filter rules pass. The sender IP has been registered as a side channel IP address by a authenticated side channel user. FDP_IFF.1.3:3 The TSF shall enforce the none. FDP_IFF.1.4:3 The TSF shall provide the following none. FDP_IFF.1.5:3 The TSF shall explicitly authorise an information flow based on the following rules: none. FDP_IFF.1.6:3 The TSF shall explicitly deny an information flow based on the following rules: timeout: no data is transported on this connection for a configurable time (default 10 minutes). Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 28 FDP_IFF.1:4 Simple security attributes FDP_IFF.1.1:4 The TSF shall enforce the authenticated gui user SFP based on the following types of subject and information security attributes: The header information of network packets, depending on their type: a) TCP: IP and TCP header. The actual date and time. The interfaces from which the packets are received and to which they are delivered. The authentication data (cookie). FDP_IFF.1.2:4 The TSF shall permit an information flow between a controlled subject and controlled information via a controlled operation if the following rules hold: IP spoofing check pass. IP option check pass. The 'connection' is configured: TCP-relay: source and destination IP and port are allowed. The ALG packet filter rules pass. All ACL checks for the respective relay pass. For packets that have a source or destination address from the internal network: The PFL packet filter rules pass. The authentication data (cookie) is accepted as a valid. FDP_IFF.1.3:4 The TSF shall enforce the none. FDP_IFF.1.4:4 The TSF shall provide the following none. FDP_IFF.1.5:4 The TSF shall explicitly authorise an information flow based on the following rules: none. FDP_IFF.1.6:4 The TSF shall explicitly deny an information flow based on the following rules: timeout: no data is transported on this connection for a configurable time (default 10 minutes). Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 29 FDP_IFF.1:5 Simple security attributes FDP_IFF.1.1:5 The TSF shall enforce the authenticated administrator SFP based on the following types of subject and information security attributes: The header information of network packets, depending on their type: a) TCP: IP and TCP header. The actual date and time. The interfaces from which the packets are received and to which they are delivered. The authentication data (cookie). FDP_IFF.1.2:5 The TSF shall permit an information flow between a controlled subject and controlled information via a controlled operation if the following rules hold: IP spoofing check pass. IP option check pass. The 'connection' is configured: TCP-relay: source and destination IP and port are allowed. The ALG packet filter rules pass. All ACL checks for the respective relay pass. For packets that have a source or destination address from the internal network: The PFL packet filter rules pass. The request comes from the administration network. The authentication data (cookie) is accepted as a valid. FDP_IFF.1.3:5 The TSF shall enforce the none. FDP_IFF.1.4:5 The TSF shall provide the following none. FDP_IFF.1.5:5 The TSF shall explicitly authorise an information flow based on the following rules: none. FDP_IFF.1.6:5 The TSF shall explicitly deny an information flow based on the following rules: timeout: no data is transported on this connection for a configurable time (default 10 minutes). Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 30 5.1.3 Class FIA: Identification and authentication Authentication failures (FIA_AFL) FIA_AFL.1 Authentication failure handling FIA_AFL.1.1 The TSF shall detect when an administrator configurable positive integer within 1 to infinite (default 3) unsuccessful authentication attempts occur related to authentication for administration, FTP- and TELNET-relay and side channel authentication. FIA_AFL.1.2 When the defined number of unsuccessful authentication attempts has been met or surpassed, the TSF shall prevent the offending user from successfully authentication until an authorised administrator takes some action to make authentication possible for the user in question. User attribute definition (FIA_ATD) FIA_ATD.1 User attribute definition FIA_ATD.1.1 The TSF shall maintain the following list of security attributes belonging to individual users: a) administrative role (or none); b) user password. Specification of secrets (FIA_SOS) FIA_SOS.1 Verification of secrets FIA_SOS.1.1 The TSF shall provide a mechanism to verify that secrets meet the following metric: the user name is not part of the password; the minimal password length is 6 characters; it consists not exclusively of lower- or uppercase letters. The strength of function claim for FIA_SOS.1 is SOF-high. User authentication (FIA_UAU) FIA_UAU.2 User authentication before any action FIA_UAU.2.1 The TSF shall require each user to be successfully authenticated before allowing any other TSF-mediated actions on behalf of that user. The strength of function claim for FIA_UAU.2 is SOF-high. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 31 FIA_UAU.6 Re-authenticating FIA_UAU.6.1 The TSF shall re-authenticate the user under the conditions: a) administrator authentication: timeout after inactivity (default 10 minutes, can be configured by an administrator); b) user side channel authentication: after inactivity (default 10 minutes, can be configured by an administrator). User identification (FIA_UID) FIA_UID.2 User identification before any action FIA_UID.2.1 The TSF shall require each user to identify itself before allowing any other TSF-mediated actions on behalf of that user. 5.1.4 Class FMT: Security management Management of functions in TSF (FMT_MOF) FMT_MOF.1:1 Management of security functions behaviour FMT_MOF.1.1:1 The TSF shall restrict the ability to disable, enable, modify the behaviour of the functions a) the authentication methods for the side channel users, TELNET- and FTP-relays; b) the generation of audit trails; to the administrator. FMT_MOF.1:2 Management of security functions behaviour FMT_MOF.1.1:2 The TSF shall restrict the ability to determine the behaviour of the functions a) the authentication methods for the side channel users; b) the generation of audit trails; to the administrator and auditor. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 32 FMT_MOF.1:3 Management of security functions behaviour FMT_MOF.1.1:3 The TSF shall restrict the ability to determine the behaviour of, disable, enable, modify the behaviour of perform the functions start-up and shut-down, change to maintenance and normal operation mode; to the administrator. Management of security attributes (FMT_MSA) FMT_MSA.1:1 Management of security attributes FMT_MSA.1.1:1 The TSF shall enforce the authenticated administrator SFP to restrict the ability to change_default, modify, delete, the security attributes a) the administrative role to the administrator. FMT_MSA.1:2 Management of security attributes FMT_MSA.1.1:2 The TSF shall enforce the authenticated administrator SFP to restrict the ability to query the security attributes a) the administrative role to the administrator and the auditor. FMT_MSA.1:3 Management of security attributes FMT_MSA.1.1:3 The TSF shall enforce the authenticated gui user SFP to restrict the ability to modify the security attributes a) the user password to the user. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 33 FMT_MSA.1:4 Management of security attributes FMT_MSA.1.1:4 The TSF shall enforce the authenticated administrator SFP to restrict the ability to modify the security attributes a) the user passwords; b) the administrator password to the administrator. FMT_MSA.3:1 Static attribute initialisation FMT_MSA.3.1:1 The TSF shall enforce the authenticated user SFP to provide restrictive default values for security attributes that are used to enforce the SFP. FMT_MSA3.2:1 The TSF shall allow the administrator to specify alternative initial values to override the default values when an object or information is created. FMT_MSA.3:2 Static attribute initialisation FMT_MSA.3.1:2 The TSF shall enforce the authenticated gui user SFP to provide restrictive default values for security attributes that are used to enforce the SFP. FMT_MSA3.2:2 The TSF shall allow the administrator to specify alternative initial values to override the default values when an object or information is created. FMT_MSA.3:3 Static attribute initialisation FMT_MSA.3.1:3 The TSF shall enforce the authenticated administrator SFP to provide restrictive default values for security attributes that are used to enforce the SFP. FMT_MSA3.2:3 The TSF shall allow the administrator to specify alternative initial values to override the default values when an object or information is created. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 34 Management of TSF data (FMT_MTD) FMT_MTD.1:1 Management of TSF data FMT_MTD.1.1:1 The TSF shall restrict the ability to modify, delete, create the a) users; b) network configuration; c) relay configuration; d) name server configuration; e) mail server configuration; f) packet filter rules; g) http-proxy squid configuration; h) virus scanner configuration; i) audit configuration; to the administrator. FMT_MTD.1:2 Management of TSF data FMT_MTD.1.1:2 The TSF shall restrict the ability to query the a) users; b) network configuration; c) relay configuration; d) name server configuration; e) mail server configuration; f) packet filter rules; g) http-proxy squid configuration; h) virus scanner configuration; i) audit configuration; to the administrator and auditor. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 35 Specification of Management Functions (FMT_SMF) FMT_SMF.1 Specification of Management Functions FMT_SMF.1.1 The TSF shall be capable of performing the following security management functions: a) user configuration; b) network configuration; c) relay configuration; d) name server configuration; e) mail server configuration; f) packet filter rule configuration; g) http-proxy squid configuration; h) virus scanner configuration; i) audit configuration. Security management roles (FMT_SMR) FMT_SMR.2 Restrictions on security roles FMT_SMR.2.1 The TSF shall maintain the roles administrator, auditor, user. FMT_SMR.2.2 The TSF shall be able to associate users with roles. FMT_SMR.2.3 The TSF shall ensure that the conditions: The source IP addresses for traffic controlled by the authenticated administrator SFP is from the administration network. are satisfied. FMT_SMR.3 Assuming roles FMT_SMR.3.1 The TSF shall require an explicit request to assume the following roles: administrator, auditor. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 36 5.1.5 Class FPT: Protection of the TSF Trusted recovery (FPT_RCV) FPT_RCV.2 Automated recovery FPT_RCV.2.1 When automated recovery from a failure or service discontinuity is not possible, the TSF shall enter a maintenance mode where the ability to return to a secure state is provided. FPT_RCV.2.2 For configurable events (default: none), the TSF shall ensure the return of the TOE to a secure state using automated procedures. 5.2 Tailored or new SFR This chapter contains the extended or new Security Functional Requirements. See also the appendix for their description. 5.2.1 Class FAU: Security audit Security audit data generation (FAU_GEN) FAU_GEN.1EX Audit data generation FAU_GEN.1EX.1 The TSF shall be able to generate an audit record of the following auditable events: a) All auditable events for the not specified level of audit; and b) Starting and stopping of the system, changing operation modes, relay configuration, loading of packet filter rules; relay usage, administration, authentication. FAU_GEN.1EX.2 The TSF shall record within each audit record at least the following information: a) Date and time of the event, type of event, subject identity, and the outcome (success or failure) of the event; and b) For each audit event type, based on the auditable event definitions of the functional components included in the PP/ST, unspecified log data. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 37 5.2.2 Class FIA: Identification and authentication User authentication (FIA_UAU) FIA_UAU.5EX External authentication mechanisms FIA_UAU.5EX.1 The TSF shall provide password, radius, LDAP, S/Key, and cryptocard mechanisms to support user authentication by external means. FIA_UAU.5EX.2 The TSF shall authenticate any user's claimed identity according to the following list: a) administrator authentication: password authentication; b) user side channel authentication: password, radius, LDAP, S/Key, or cryptocard (as configured by the administrator); c) user authentication (FTP- and TELNET-relay): password, radius, LDAP, S/Key, or cryptocard (as configured by the administrator). The strength of function claim for FIA_UAU.5EX is SOF-high. 5.2.3 Class FPT: Protection of the TSF Simple Self Test (FPT_SST) FPT_SST.1 TOE testing FPT_SST.1.1 The TSF shall run a suite of self tests periodically during normal operation to perform the following checks: a) specified processes are running (default: all relays, named, xntpd, sendmail) b) the file system usage is below a threshold (default: 90%) c) the file system permissions and flags. FPT_SST.1.2 The TSF shall provide authorised users with the capability to query the results of the following checks: a) specified processes are running (default: all relays, named, xntpd, sendmail) b) the file system usage is below a threshold (default: 90%) c) the file system permissions and flags. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 38 Runtime Environment (FPT_RTE) FPT_RTE.1 Restricted Runtime Environment FPT_RTE.1.1 The restricted runtime environment implements the following restrictions: a) chroot environment; b) restricted system calls for (chroot, kill, strace, ptrace, mknod). FPT_RTE.1.2 The TSF shall maintain a restricted runtime environment for all TOE processes that accept connections from the connected interfaces. 5.3 TOE Security Assurance Requirements The TOE claims compliance to EAL4 level of assurance plus augmentations AVA_VLA.4 and ALC_FLR.2. For a complex product like the two-tiered firewall GeNUGate 6.0 Z, this is considered to be the highest possible level, when considering the drastically increasing efforts at higher levels of assurance. As part 3 of the CC describe it, the level EAL4 indicates that the product is methodically designed, tested, and reviewed. To counter the high threat of malicious attacks that firewalls must handle, the level EAL4 has been augmented with the vulnerability assurance requirement AVA_VLA.4 (Highly resistant), which is only mandatory for level EAL6 and higher. The assurance requirements for life cycle support has been augmented by ALC_FLR.2 (Flaw reporting procedures) to account for regular bug fixes for GeNUGate 6.0 Z. In the following table all security assurance requirement descriptions mandated by EAL4 are printed in normal weight. The descriptions for the augmented security assurance requirements are printed in bold text. The requirement AVA_VLA.2 has been left in parenthesis in the table to indicate that it is still required although only the stronger requirement AVA_VLA.4 should appear. Table 9: Security Assurance Requirements Security Assurance Requirement Configuration management ACM_AUT.1 Partial CM automation ACM_CAP.4 Generation support and acceptance procedures ACM_SCP.2 Problem tracking CM coverage Delivery and operation ADO_DEL.2 Detection of modification ADO_IGS.1 Installation, generation, and start-up procedures Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 39 Security Assurance Requirement Development ADV_FSP.2 Fully defined external interfaces ADV_HLD.2 Security enforcing high-level design ADV_IMP.1 Subset of the implementation of the TSF ADV_LLD.1 Descriptive low-level design ADV_RCR.1 Informal correspondence demonstration ADV_SPM.1 Informal TOE security policy model Guidance documents AGD_ADM.1 Administrator guidance AGD_USR.1 User guidance Life cycle support ALC_DVS.1 Identification of security measures ALC_LCD.1 Developer defined life-cycle model ALC_TAT.1 Well-defined development tools ALC_FLR.2 Flaw reporting procedures Tests ATE_COV.2 Analysis of coverage ATE_DPT.1 Testing: high-level design ATE_FUN.1 Functional testing ATE_IND.2 Independent testing - sample Vulnerability assessment AVA_MSU.2 Validation of analysis AVA_SOF.1 Strength of TOE security function evaluation (AVA_VLA.2 Independent vulnerability analysis) AVA_VLA.4 Highly resistant 5.4 Security Requirements for the IT Environment The security functional requirements have been drawn from the CC Part 2. In the following, the unmodified text from the functional requirement templates is displayed in a sanserif font. The operation assignment is set in a bold italic serif font. The operations selection and refinement are set in an italic serif font. The operation assignment is set in a bold italic serif font. The iterations are done by repeating the requirements and adding a colon and a sequence number. In a few occasions, the text has been modified slightly. The replacement text is placed directly after the crossed-out original text, and is set in an italic serif font. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 5 IT SECURITY REQUIREMENTS 40 5.4.1 Class FPT: Protection of the TSF Time stamps (FPT_STM) FPT_STM.1 Reliable time stamps FPT_STM.1.1 The TSFIT environment shall be able to provide reliable time stamps for its own usethe TOE use. Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 6 TOE SUMMARY SPECIFICATION 41 6 TOE SUMMARY SPECIFICATION 6.1 TOE Security Functions 6.1.1 SF_SA: Security audit SF_SA.1: The TOE generates log data whenever important events occur. This includes starting and stopping of the system, and changing from normal to the maintenance mode. Starting and stopping or reconfiguration of the relays generate log data. Creation and loading of packet filters for ALG and PFL generate log data. SF_SA.2: All relays generate log data when the connection state changes. Log data includes the IP address of source and destination, Ports for TCP and UDP-based protocols, the timestamps for connection and disconnection and the amount of data transferred in both directions for the source and the destination side. The protocol specific relays log part of the protocol data (e.g. URLs, SMTP-Envelope-lines, ...). The TELNET- and FTP-relay log information about authentication. All unsuccessful connection attempts are logged. SF_SA.3: All administration through the administration web generates log data. The administration action is logged together with the administrator Id. Successful and unsuccessful login attempts are logged. The log contains a time stamp. SF_SA.4: The log data is analysed by automated tools that look for pattern in the log data. The pattern include packet filter violations, daemon messages, relay messages, kernel messages, and messages from other processes, e.g. the processes that implement the self-tests. If a pattern matches, a security event is generated. The actions include logging of the event, adding the event to an event digest, use of `wall' to show the event on the consoles, mail the event to the administrators, shut down network interfaces, and system halt. The extracted log data is written to the audit log. In normal operation mode the audit log is protected by file system append-only flag. It can only be changed in maintenance mode (e.g. rotated). SF_SA.5: The log data can be transformed into a human readable form and can be searched by all administrators and auditors. Other roles are not allowed to read the log. The possible search criteria are: time, date, process id and additional log data. For relays the log data contains: the relay type, connection state, IP addresses and ports, bytes transferred. SF_SA.6: The system checks for available log space and notifies the administrator in a configurable way. Loss of log data is noticed and a configurable action is executed in that case. 6.1.2 SF_DF: Data flow control SF_DF.1: The packet filter at the ALG and PFL implement the flow control at the network layer (IP) and transport layer (TCP/UDP). The filter rules take the information from the IP and TCP/UDP-Header (where applicable) in order to apply the filter rules. Packets with spoofed source- or destination-IP addresses are dropped. Packets with source routing are dropped. Packets are not forwarded at the ALG; so that packets that cannot be transmitted to the socket layer are dropped. The packet filter of the PFL has a restrictive default filter set. Any TCP-connections (or UDP packets) from the ALG into the internal net have to be activated by a administrator. SF_DF.2: The relays check the following attributes: The header information of network packets, depending on their type: TCP: IP and TCP header; Security Target GeNUGate Firewall 6.0 GeNUA mbH Version 242 6 TOE SUMMARY SPECIFICATION 42 UDP: IP and UDP header; ICMP: IP header and ICMP message; IP: IP header; The actual date and time. The incoming and outgoing interfaces. Additional information depending on the handling relay: IP-relay: none; PING-relay: none; UDP-relay: none; TCP-relay: none; NNTP-relay: protocol and application data; POP-relay: protocol and application data; SMTP-relay: protocol and application data; FTP-relay: protocol data; TELNET-relay: protocol data; HTTP-relay: protocol data; WWW-relay: protocol and application data; A virus scanner can be used to scan the application data of SMTP-relay, POP-relay, NNTP-relay, FTP-relay and WWW-relay. SF_DF.3: The SMTP-relay can block mails depending on the mail data (virus, blocked extension type of a MIME part). The mail stays on the TOE and must be handled by an administrator. SF_DF.4: WWW-relay: For data of the content-type text/html a filter can remove the following tags that imply active content: , , ,