Lexmark Multi-Function Printers with Hard Drives Security Target
Lexmark CX622h, CX625h, CX921, CX922,
CX923, CX924, MX522, MX622h, MX721h,
MX722h, MX822, and MX826 Multi-Function
Printers Security Target
Version 1.11
January 23, 2019
Lexmark International, Inc.
740 New Circle Road
Lexington, KY 40550
Lexmark Multi-Function Printers with Hard Drives Security Target
2
DOCUMENT INTRODUCTION
Prepared By:
Common Criteria Consulting LLC
15804 Laughlin Lane
Silver Spring, MD 20906
http://www.consulting-cc.com
Prepared For:
Lexmark International, Inc.
740 New Circle Road
Lexington, KY 40550
http://www.lexmark.com
Various text from clauses 5, 7-9, and 12 reprinted with permission from IEEE, 445 Hoes Lane,
Piscataway, New Jersey 08855, from IEEE "2600.1™-2009 Standard for a Protection Profile in
Operational Environment A", Copyright © 2009 IEEE. All rights reserved.
REVISION HISTORY
Rev Description
1.0 August 31, 2017, Initial release
1.1 September 18, 2017, Addressed lab comments and updated models
1.2 November 9, 2017, Addressed lab ORs
1.3 March 7, 2018, Reduced the models being evaluated
1.4 April 3, 2017, Addressed certifier comments
1.5 April 29, 2018, Changed augmentation to ALC_FLR.3
1.6 June 10, 2018, Changes for releasing held print jobs
1.7 August 9, 2018, Updated final firmware versions
1.8 August 27, 2018, Updated firmware versions and eSF application information
1.9 August 29, 2018, Removed CX920 and updated Table 1 – Technical Characteristics of
the MFP Models
1.10 November 8, 2018, Addressed certifier ORs, added CAVP certs, and removed MX824.
1.11 January 23, 2019, Corrected SE part number
Lexmark Multi-Function Printers with Hard Drives Security Target
3
TABLE OF CONTENTS
1. SECURITY TARGET INTRODUCTION................................................................. 9
1.1 Security Target Reference.......................................................................................... 9
1.2 TOE Reference............................................................................................................ 9
1.3 Evaluation Assurance Level....................................................................................... 9
1.4 Keywords ..................................................................................................................... 9
1.5 TOE Overview............................................................................................................. 9
1.5.1 Usage and Major Security Features ........................................................................... 9
1.5.2 TOE type.................................................................................................................. 10
1.5.3 Required Non-TOE Hardware/Software/Firmware................................................. 10
1.6 TOE Description ....................................................................................................... 11
1.6.1 Users ........................................................................................................................ 12
1.6.2 Objects (Assets) ....................................................................................................... 13
1.6.2.1 User Data .............................................................................................................. 13
1.6.2.2 TSF Data............................................................................................................... 14
1.6.2.3 Functions............................................................................................................... 14
1.6.3 Operations................................................................................................................ 15
1.6.4 Channels................................................................................................................... 15
1.7 Physical Boundary .................................................................................................... 15
1.8 Logical Boundary...................................................................................................... 15
1.8.1 Audit Generation...................................................................................................... 15
1.8.2 Identification and Authentication ............................................................................ 16
1.8.3 Access Control......................................................................................................... 16
1.8.4 Management............................................................................................................. 16
1.8.5 Fax Separation ......................................................................................................... 16
1.8.6 Hard Disk Encryption .............................................................................................. 16
1.8.7 Disk Wiping............................................................................................................. 16
1.8.8 Secure Communication............................................................................................ 16
1.8.9 Self Test ................................................................................................................... 16
1.9 TOE Data................................................................................................................... 17
1.9.1 TSF Data.................................................................................................................. 17
1.9.2 Authentication Data ................................................................................................. 19
1.9.3 Security Attributes ................................................................................................... 19
1.9.4 User Data ................................................................................................................. 20
1.10 Evaluated Configuration........................................................................................ 20
2. CONFORMANCE CLAIMS..................................................................................... 24
2.1 Common Criteria Conformance.............................................................................. 24
2.2 Protection Profile Conformance.............................................................................. 24
2.3 Security Requirement Package Conformance ....................................................... 24
3. SECURITY PROBLEM DEFINITION ................................................................... 25
3.1 Introduction............................................................................................................... 25
3.2 Assumptions............................................................................................................... 25
3.3 Threats ....................................................................................................................... 26
3.4 Organisational Security Policies.............................................................................. 26
4. SECURITY OBJECTIVES........................................................................................ 27
Lexmark Multi-Function Printers with Hard Drives Security Target
4
4.1 Security Objectives for the TOE ............................................................................. 27
4.2 Security Objectives for the Operational Environment.......................................... 27
5. EXTENDED COMPONENTS DEFINITION ......................................................... 29
5.1 Extended Security Functional Components........................................................... 29
5.1.1 FPT_FDI_EXP Restricted forwarding of data to external interfaces ...................... 29
FPT_FDI_EXP.1............................................................................................................... 30
5.2 Extended Security Assurance Components............................................................ 30
6. SECURITY REQUIREMENTS................................................................................ 31
6.1 TOE Security Functional Requirements ................................................................ 31
6.1.1 Security Audit (FAU) .............................................................................................. 31
6.1.1.1 FAU_GEN.1 Audit Data Generation.................................................................... 31
6.1.1.2 FAU_GEN.2 User Identity Association ............................................................... 32
6.1.2 Cryptographic Support (FCS).................................................................................. 32
6.1.2.1 FCS_CKM.1 Cryptographic Key Generation....................................................... 32
6.1.2.2 FCS_CKM.4 Cryptographic Key Destruction...................................................... 33
6.1.2.3 FCS_COP.1 Cryptographic Operation ................................................................. 33
6.1.3 User Data Protection (FDP)..................................................................................... 33
6.1.3.1 FDP_ACC.1 Subset Access Control..................................................................... 33
6.1.3.2 FDP_ACF.1 Security Attribute Based Access Control ........................................ 34
6.1.3.3 FDP_RIP.1 Subset Residual Information Protection............................................ 35
6.1.4 Identification and Authentication (FIA) .................................................................. 36
6.1.4.1 FIA_AFL.1 Authentication Failure Handling....................................................... 36
6.1.4.2 FIA_ATD.1 User Attribute Definition ................................................................. 36
6.1.4.3 FIA_UAU.1 Timing of Authentication................................................................. 36
6.1.4.4 FIA_UAU.7 Protected Authentication Feedback ................................................. 36
6.1.4.5 FIA_UID.1 Timing of Identification .................................................................... 36
6.1.4.6 FIA_USB.1 User-Subject Binding ....................................................................... 37
6.1.5 Security Management (FMT) .................................................................................. 37
6.1.5.1 FMT_MSA.1 Management of Security Attributes............................................... 37
6.1.5.2 FMT_MSA.3 Static Attribute Initialisation.......................................................... 37
6.1.5.3 FMT_MTD.1 Management of TSF Data.............................................................. 37
6.1.5.4 FMT_SMF.1 Specification of Management Functions ........................................ 39
6.1.5.5 FMT_SMR.1 Security Roles ................................................................................ 39
6.1.6 Protection of the TSF (FPT) .................................................................................... 40
6.1.6.1 FPT_FDI_EXP.1 Restricted forwarding of data to external interfaces ................ 40
6.1.6.2 FPT_STM.1 Reliable Time Stamps...................................................................... 40
6.1.6.3 FPT_TST.1 TSF Testing....................................................................................... 40
6.1.7 TOE Access (FTA) .................................................................................................. 41
6.1.7.1 FTA_SSL.3 TSF-Initiated Termination................................................................ 41
6.1.8 Trusted Path/Channels (FTP)................................................................................... 41
6.1.8.1 FTP_ITC.1 Inter-TSF Trusted Channel................................................................ 41
6.2 TOE Security Assurance Requirements ................................................................. 41
6.3 CC Component Hierarchies and Dependencies..................................................... 42
7. TOE SUMMARY SPECIFICATION....................................................................... 43
7.1 Security Functions .................................................................................................... 43
Lexmark Multi-Function Printers with Hard Drives Security Target
5
7.1.1 Audit Generation...................................................................................................... 43
7.1.2 Identification and Authentication ............................................................................ 44
7.1.2.1 Active Directory.................................................................................................... 45
7.1.3 Access Control......................................................................................................... 45
7.1.3.1 Printing.................................................................................................................. 49
7.1.3.2 Scanning (to Fax or Email)................................................................................... 49
7.1.3.3 Copying................................................................................................................. 49
7.1.3.4 Incoming Fax ........................................................................................................ 49
7.1.3.5 Shared-medium Interface...................................................................................... 50
7.1.3.6 Postscript Access Control ..................................................................................... 50
7.1.4 Management............................................................................................................. 50
7.1.5 Fax Separation ......................................................................................................... 50
7.1.6 Hard Disk Encryption .............................................................................................. 50
7.1.7 Disk Wiping............................................................................................................. 51
7.1.8 Secure Communications .......................................................................................... 52
7.1.9 Self Test ................................................................................................................... 52
7.1.10 Deviations From Allowed Cryptographic Standards............................................. 52
7.1.11 Cryptographic Functionality Provided by the Operational Environment.............. 53
8. PROTECTION PROFILE CLAIMS........................................................................ 54
8.1 TOE Type Consistency............................................................................................. 54
8.2 Security Problem Definition Consistency............................................................... 54
8.3 Security Objectives Consistency.............................................................................. 54
8.4 Security Functional Requirements Consistency .................................................... 54
8.5 Security Assurance Requirements Consistency..................................................... 55
9. RATIONALE .............................................................................................................. 56
9.1 Rationale for IT Security Objectives....................................................................... 56
9.1.1 Rationale Showing Threats to Security Objectives ................................................. 57
9.1.2 Rationale Showing Policies to Security Objectives................................................. 57
9.1.3 Rationale Showing Assumptions to Environment Security Objectives................... 58
9.2 Security Requirements Rationale............................................................................ 59
9.2.1 Rationale for Security Functional Requirements of the TOE Objectives................ 59
9.2.2 Security Assurance Requirements Rationale........................................................... 62
9.3 TOE Summary Specification Rationale.................................................................. 63
Lexmark Multi-Function Printers with Hard Drives Security Target
6
LIST OF FIGURES
Figure 1 - TOE Model ................................................................................................... 12
LIST OF TABLES
Table 1 - Technical Characteristics of the MFP Models.............................................. 11
Table 2 - Notational prefix conventions....................................................................... 12
Table 3 - Users ............................................................................................................. 13
Table 4 - User Data ...................................................................................................... 13
Table 5 - TSF Data....................................................................................................... 14
Table 6 - Functions....................................................................................................... 14
Table 7 - TSF Data....................................................................................................... 17
Table 8 - Authentication Data ...................................................................................... 19
Table 9 - Security Attributes ........................................................................................ 19
Table 10 - User Data .................................................................................................. 20
Table 11 - Source-Destination Combinations ............................................................ 23
Table 12 - Assumptions.............................................................................................. 25
Table 13 - Threats....................................................................................................... 26
Table 14 - Organizational Security Policies for the TOE .......................................... 26
Table 15 - Security Objectives for the TOE............................................................... 27
Table 16 - Security Objectives of the Operational Environment............................... 27
Table 17 - Audit data requirements............................................................................ 31
Table 18 - Cryptographic Operations......................................................................... 33
Table 19 - Common Access Control SFP Rules ........................................................ 34
Table 20 - TSF Data................................................................................................... 38
Table 21 - FMT_SMR.1 Detail.................................................................................. 39
Table 22 - EAL3+ Assurance Requirements.............................................................. 41
Table 23 - TOE SFR Dependency Rationale ............................................................. 42
Table 24 - Access Control Items ................................................................................ 45
Table 25 - TOE Function Access Control SFP Rules ................................................ 48
Table 26 - Threats, Policies and Assumptions to Security Objectives Mapping ....... 56
Table 27 - Threats to Security Objectives Rationale.................................................. 57
Table 28 - Policies to Security Objectives Rationale................................................. 58
Lexmark Multi-Function Printers with Hard Drives Security Target
7
Table 29 - Assumptions to Security Objectives Rationale......................................... 58
Table 30 - SFRs to Security Objectives Mapping...................................................... 59
Table 31 - Security Objectives to SFR Rationale....................................................... 60
Table 32 - SFRs to TOE Security Functions Mapping .............................................. 63
Table 33 - SFR to SF Rationale.................................................................................. 64
ACRONYMS LIST
AD.............................................................................................................Active Directory
AES.................................................................................Advanced Encryption Standard
AIO..................................................................................................................... All In One
BSD..................................................................................Berkeley Software Distribution
CAC................................................................................................ Common Access Card
CAVP ....................................................Cryptographic Algorithm Validation Program
CBC...............................................................................................Cipher Block Chaining
CC...........................................................................................................Common Criteria
CM.........................................................................................Configuration Management
EAL .......................................................................................Evaluation Assurance Level
ESP .................................................................................Encapsulating Security Payload
FAC ............................................................................................ Function Access Control
FTP................................................................................................. File Transfer Protocol
GSSAPI ...............................Generic Security Services Application Program Interface
GUI............................................................................................ Graphical User Interface
HTTP..................................................................................HyperText Transfer Protocol
I&A................................................................................. Identification & Authentication
IPP............................................................................................Internet Printing Protocol
IPSec.........................................................................................Internet Protocol Security
IPv4......................................................................................... Internet Protocol version 4
IPv6......................................................................................... Internet Protocol version 6
ISO..........................................................................International Standards Orgaization
IT .................................................................................................Information Technology
KDC.............................................................................................Key Distribution Center
KDF............................................................................................Key Derivation Function
LAN................................................................................................... Local Area Network
LDAP.................................................................. Lightweight Directory Access Protocol
MB.......................................................................................................................MegaByte
MFD ................................................................................................Multi-Finction Device
MFP...............................................................................................Multi-Function Printer
NTP...............................................................................................Network Time Protocol
OSP...................................................................................Organizational Security Policy
PIV..................................................................................... Personal Identity Verification
PJL ..................................................................................................Printer Job Language
Lexmark Multi-Function Printers with Hard Drives Security Target
8
PP............................................................................................................Protection Profile
RFC ..............................................................................................Request For Comments
SASL.............................................................Simple Authentication and Security Layer
SFP ............................................................................................. Security Function Policy
SFR.............................................................................. Security Functional Requirement
SHA ..............................................................................................Secure Hash Algorithm
SMTP .............................................................................Simple Mail Transport Protocol
SNMP .................................................................Simple Network Management Protocol
ST................................................................................................................Security Target
TFTP ..................................................................................Trivial File Transfer Protocol
TOE...................................................................................................Target of Evaluation
TRNG......................................................................... True Random Number Generator
TSF ............................................................................................... TOE Security Function
UI..................................................................................................................User Interface
URL........................................................................................ Uniform Resource Locator
USB.................................................................................................... Universal Serial Bus
Lexmark Multi-Function Printers with Hard Drives Security Target
9
1. Security Target Introduction
This Security Target (ST) describes the objectives, requirements and rationale for the Lexmark
CX622h, CX625h, CX921, CX922, CX923, CX924, MX522, MX622h, MX721h, MX722h,
MX822, and MX826 Multi-Function Printers. The language used in this Security Target is
consistent with the Common Criteria for Information Technology Security Evaluation, Version
3.1 Revision 5. As such, the spelling of terms is presented using the internationally accepted
English.
1.1 Security Target Reference
Lexmark CX622h, CX625h, CX921, CX922, CX923, CX924, MX522, MX622h, MX721h,
MX722h, MX822, and MX826 Multi-Function Printers Security Target, Version 1.11, January
23, 2019.
1.2 TOE Reference
Lexmark Firmware versions:
 CXTMH.052.025: CX921, CX922, CX923, CX924
 CXTZJ.052.025: CX622h, CX625h
 MXTGM.052.025: MX522, MX622h
 MXTGW.052.025: MX721h, MX722h, MX822, MX826
1.3 Evaluation Assurance Level
Assurance claims conform to EAL3 (Evaluation Assurance Level 3) augmented with
ALC_FLR.3 from the Common Criteria for Information Technology Security Evaluation,
Version 3.1 Revision 5.
1.4 Keywords
Hardcopy, Paper, Document, Printer, Scanner, Copier, Facsimile, Fax, Document Server,
Document Storage and Retrieval, Nonvolatile storage, Residual data, Temporary data, Disk
overwrite, Network interface, Shared communications medium, Multifunction Device,
Multifunction Product, All-In-One, MFD, MFP
1.5 TOE Overview
1.5.1 Usage and Major Security Features
The MFPs are multi-functional printer systems with scanning, fax, and networked capabilities. Their
capabilities extend to walk-up scanning and copying, scanning to fax, scanning to email, and
servicing print jobs through the network. The MFPs feature an integrated touch-sensitive operator
panel.
The major security features of the TOE are:
1. All Users are identified and authenticated as well as authorized before being granted
permission to perform any restricted TOE functions.
2. Administrators authorize Users to use the functions of the TOE.
3. User Document Data are protected from unauthorized disclosure or alteration.
4. User Function Data are protected from unauthorized alteration.
Lexmark Multi-Function Printers with Hard Drives Security Target
10
5. TSF Data, of which unauthorized disclosure threatens operational security, are protected
from unauthorized disclosure.
6. TSF Data, of which unauthorized alteration threatens operational security, are protected
from unauthorized alteration.
7. Document processing and security-relevant system events are recorded, and such records
are protected from disclosure or alteration by anyone except for authorized personnel.
1.5.2 TOE type
The firmware of a Multi-Function Device
1.5.3 Required Non-TOE Hardware/Software/Firmware
The TOE is the firmware of an MFP. The MFP hardware must be one of the models supported
for the firmware versions specified for the TOE.
The optional Lexmark Secure Element (Part Number 57X0185) must be installed in the MFP.
The Secure Element incorporates an Infineon Smart Card IC M9900 (Release A22, Infineon Part
Number SLE97CSFX1M00PE). The M9900 provides a True Random Number Generator
(TRNG) used by the TOE for seeding of the random number generator in the TOE, and has
successfully completed a Common Criteria EAL5+ evaluation which included the TRNG
functionality. The associated Security Target is in strict conformance to the Security IC Platform
Protection Profile, Version 1.0, and dated 15.06.2007. The Secure Element also incorporates
firmware enabling communication between the MFP firmware and the M9900.
To be fully operational, any combination of the following items may be connected to the MFP:
1. A LAN for network connectivity. The TOE supports IPv4 and IPv6.
2. A telephone line for fax capability.
3. IT systems that submit print jobs to the MFP via the network using standard print
protocols.
4. IT systems that send and/or receive faxes via the telephone line.
5. An IT system acting as the remote syslog recipient of audit event records sent from the
TOE.
6. LDAP server to support Identification and Authentication (I&A). This component is
optional depending on the type(s) of I&A mechanisms used.
7. Card reader and cards to support Smart Card authentication using Common Access Card
(CAC), Personal Identity Verification (PIV) cards or Secret Internet Protocol Router
Network (SIPRNet) cards. This component is optional depending on the type(s) of I&A
mechanisms used. The supported card readers are:
a. Identiv uTrust 2700 F Contact Smart Card Reader & Identiv uTrust 2700 R
Contact Smart Card Reader
b. Omnikey 3121 SmartCard Reader,
c. Any other Omnikey SmartCard Readers that share the same USB Vendor IDs
and Product IDs with the Omnikey 3121 (example Omnikey 3021),
Lexmark Multi-Function Printers with Hard Drives Security Target
11
d. SCM SCR 331,
e. SCM SCR 3310v2.
1.6 TOE Description
The TOE provides the following functions related to MFPs:
1. Printing – producing a hardcopy document from its electronic form
2. Scanning – producing an electronic document from its hardcopy form
3. Copying – duplicating a hardcopy document
4. Faxing – scanning documents in hardcopy form and transmitting them in electronic form
over telephone lines, and receiving documents in electronic form over telephone lines and
printing them in hardcopy form
All of the MFP models referenced in the evaluation are complete MFPs in a single unit.
All of the firmware versions included in this evaluation provide the same security functionality.
Their differences are in the processor boards and the size of the display included in the
associated MFP model. The differences in the processor boards accommodate differences in the
speed of printing and support for color operations. The following tables summarize the technical
characteristics of the MFP models.
Table 1 - Technical Characteristics of the MFP Models
Model Processor Word Size Color/Mono Pages Per
Minute
CX622h Marvell 88PA6270 (G2) 64-bit Color 40
CX625h Marvell 88PA6270 (G2) 64-bit Color 40
CX921 Marvell 88PA6270 (G2) 32-bit Color 35
CX922 Marvell 88PA6270 (G2) 32-bit Color 45
CX923 Marvell 88PA6270 (G2) 32-bit Color 55
CX924 Marvell 88PA6270 (G2) 32-bit Color 65
MX522 Marvell 88PA6270 (G2) 32-bit Mono 46
MX622h Marvell 88PA6270 (G2) 32-bit Mono 50
MX721h Marvell 88PA6270 (G2) 64-bit Mono 65
MX722h Marvell 88PA6270 (G2) 64-bit Mono 70
MX822 Marvell 88PA6270 (G2) 64-bit Mono 55
MX826 Marvell 88PA6270 (G2) 64-bit Mono 70
The Target of Evaluation (TOE) is described using the standard Common Criteria terminology of
Users, Objects, Operations, and Interfaces. Two additional terms are introduced: Channel
describes both data interfaces and hardcopy document input/output mechanisms, and TOE
Owner is a person or organizational entity responsible for protecting TOE assets and establishing
related security policies. In this document, the terms User and Subject are used interchangeably.
Lexmark Multi-Function Printers with Hard Drives Security Target
12
Figure 1 - TOE Model
The following prefixes are used to indicate different entity types:
Table 2 - Notational prefix conventions
Prefix Type of entity
U. User
D. Data
F. Function
T. Threat
P. Policy
A. Assumption
O. Objective
OE. Environmental objective
+ Security Attribute
1.6.1 Users
Users are entities that are external to the TOE and which interact with the TOE. There may be
two types of Users: Normal and Administrator.
TSF
Input
Channel
Output
Channel
Common MFP Functions
User Data
User
Document
Data
User
Function
TSF Data
TSF
Protected
Data
TSF
Confidential
Data
Fax
Functions
Copy
Functions
Scan
Functions
Print
Functions
Shared
Medium
Functions
Lexmark Multi-Function Printers with Hard Drives Security Target
13
Table 3 - Users
Designation Definition
U.USER Any authorized User.
U.NORMAL A User who is authorized to perform User Document Data processing
functions of the TOE.
In the remainder of this document, the term “Normal User” is used
interchangeably with U.NORMAL.
The TOE provides user-level permissions to access specific document
processing functions (e.g. print, copy). When it is necessary to distinguish
the specific permission, that information is supplied. Otherwise the generic
terms identified above are used.
U.ADMINISTRATOR A User who has been specifically granted the authority to manage some
portion or all of the TOE and whose actions may affect the TOE security
policy (TSP).
In the remainder of this document, the terms “Administrator” and
“Authorized Administrator” are used interchangeably with
U.ADMINISTRATOR.
The TOE provides user-level permissions to access specific management
functions. When it is necessary to distinguish the specific permission, that
information is supplied. Otherwise the generic terms identified above are
used.
1.6.2 Objects (Assets)
Objects are passive entities in the TOE, that contain or receive information, and upon which
Subjects perform Operations. Objects are equivalent to TOE Assets. There are three categories of
Objects: User Data, TSF Data, and Functions.
1.6.2.1 User Data
User Data are data created by and for Users and do not affect the operation of the TOE Security
Functionality (TSF). This type of data is composed of two types of objects: User Document
Data, and User Function Data.
Table 4 - User Data
Designation Definition
D.DOC User Document Data consists of the information contained in a user’s document. This
includes the original document itself in either hardcopy or electronic form, image data,
or residually-stored data created by the hardcopy device while processing an original
document and printed hardcopy output.
For this TOE, D.DOC includes:
1. User data contained in jobs submitted from the network for printing
2. Scanned data to be printed (copying)
3. Scanned data to be faxed
4. Scanned data to be emailed
5. User data in received faxes
Lexmark Multi-Function Printers with Hard Drives Security Target
14
Designation Definition
D.FUNC User Function Data are the information about a user’s document or job to be processed
by the TOE.
For this TOE, D.FUNC includes:
1. Job information for network print jobs
2. Job information for scanned data to be printed (copying)
3. Job information for scanned data to be faxed
4. Job information for scanned data to be emailed
5. Job information for user data in received faxes
1.6.2.2 TSF Data
TSF Data are data created by and for the TOE and that might affect the operation of the TOE.
This type of data is composed of two types of objects: TSF Protected Data and TSF Confidential
Data.
Table 5 - TSF Data
Designation Definition
D.PROT TSF Protected Data are assets for which alteration by a User who is neither an
Administrator nor the owner of the data would have an effect on the operational
security of the TOE, but for which disclosure is acceptable.
D.CONF TSF Confidential Data are assets for which either disclosure or alteration by a User
who is neither an Administrator nor the owner of the data would have an effect on the
operational security of the TOE.
1.6.2.3 Functions
Functions perform processing, storage, and transmission of data that may be present in the TOE.
These functions are described in the following table.
Table 6 - Functions
Designation Definition
F.PRT Printing: a function in which electronic document input is converted to physical
document output
F.SCN Scanning: a function in which physical document input is converted to electronic
document output
F.CPY Copying: a function in which physical document input is duplicated to physical
document output
F.FAX Faxing: a function in which physical document input is converted to a telephone-based
document facsimile (fax) transmission, and a function in which a telephone-based
document facsimile (fax) reception is converted to physical document output
F.SMI Shared-medium interface: a function that transmits or receives User Data or TSF Data
over a communications medium which is or can be shared by other users, such as
wired or wireless network media and most radio-frequency wireless media
Lexmark Multi-Function Printers with Hard Drives Security Target
15
1.6.3 Operations
Operations are a specific type of action performed by a Subject on an Object. Five types of
operations are addressed: those that result in disclosure of information (Read), those that result in
alteration of information (Create, Modify, Delete), and those that invoke a function (Execute).
1.6.4 Channels
Channels are the mechanisms through which data can be transferred into and out of the TOE.
Private Medium Interface: mechanism for exchanging information that use (1) wired electronic
methods over a communications medium which, in conventional practice, is not accessed by
multiple simultaneous Users; or, (2) Operator Panel and displays that are part of the TOE. It is an
input-output channel. The touch panel and phone line are private medium interfaces.
Shared-medium Interface: mechanism for exchanging information that use wired network
electronic methods over a communications medium which, in conventional practice, is or can be
simultaneously accessed by multiple Users. It is an input-output channel. The standard network
interface is a shared-medium interface.
Original Document Handler: mechanism for transferring User Document Data in hardcopy
form into the TOE. It is an input channel. The scanner is an original document handler.
Hardcopy Output Handler: mechanism for transferring User Document Data out of the TOE in
hardcopy form. It is an output channel. The printer is a hardcopy output handler.
1.7 Physical Boundary
The physical boundary of the TOE is the firmware executing on the Main Processor Board of the
MFP. The hardware of the MFP is excluded from the TOE boundary.
The physical scope of the TOE also includes the following guidance documentation:
1. Lexmark Common Criteria Installation Supplement and Administrator Guide
2. Lexmark Embedded Web Server Administrator's Guide
3. Lexmark CX620 Series User's Guide
4. Lexmark CX920, CX921, CX922, CX923, CX924, CX927 User's Guide
5. Lexmark MX520 Series User's Guide
6. Lexmark MX620 Series User's Guide
7. Lexmark MX720 Series User's Guide
8. Lexmark MX820 Series User's Guide
1.8 Logical Boundary
The TOE supports the security functions documented in the following sections.
1.8.1 Audit Generation
The TOE generates audit event records for security-relevant events and transmits them to a
remote IT system using the syslog protocol.
Lexmark Multi-Function Printers with Hard Drives Security Target
16
1.8.2 Identification and Authentication
When a touch panel or web session is initiated, the user is implicitly assumed to be the Guest
(default) user. Per the evaluated configuration, the permissions for this user must be configured
such that no access to TSF data or functions is allowed other than print job submission (job
submission is authorized regardless of what user is logged in). Therefore, the user must
successfully log in as a different user before any TSF data or functions other than print job
submission may be accessed.
The TOE supports I&A with a per-user selection of Username/Password Accounts (processed by
the TOE) or integration with an external LDAP server (in the operational environment). Smart
Card authentication may also be specified for users of the touch panel.
1.8.3 Access Control
Access controls configured for functions (e.g. fax usage) and menu access are enforced by the
TOE.
1.8.4 Management
Through web browser and touch panel sessions, authorized administrators may configure access
controls and perform other TOE management functions.
1.8.5 Fax Separation
The TOE ensures that only fax traffic is sent or received via the attached phone line. Incoming
traffic is processed as fax data only; no management access or other data access is permitted. In
the evaluated configuration, the only source for outgoing faxes is the scanner.
1.8.6 Hard Disk Encryption
All user data submitted to the TOE and stored on the hard disk is encrypted to protect its
confidentiality in the event the hard drive was to be removed from the MFP.
1.8.7 Disk Wiping
In the evaluated configuration, the TOE automatically overwrites disk blocks used to store user
data as soon as the data is no longer required. The mechanism used to perform the overwrite
complies with NIST SP800-88 (dated September 2006), and the DSS "Clearing and Sanitization
Matrix" (C&SM) updated March 21, 2008 that is included in the Industrial Security Field
Operations (ISFO) Process Manual for the Certification and Accreditation of Classified Systems
under the National Industrial Security Program Operating Manual (NISPOM), Revision 3 (June
2011).
1.8.8 Secure Communication
The TOE protects the confidentiality and integrity of all information exchanged over the attached
network by using IPSec with ESP for all network communication. Cryptographic keys may be
generated by the TOE or pre-shared keys may be entered by the administrator.
1.8.9 Self Test
During initial start-up, the TOE performs self tests on its cryptographic components and the
integrity of the configuration data.
Lexmark Multi-Function Printers with Hard Drives Security Target
17
1.9 TOE Data
1.9.1 TSF Data
Table 7 - TSF Data
Item Description D.CONF D.PROT
Account Status Login status information is associated with all accounts
used to authenticate internally against a
Username/Password. For each Username/Password
account, the TOE tracks the number of login failures, time
of the earliest login failure, and lock status.
X
Active Directory
Configuration
Configuration information used to join an Active
Directory Domain. Once joined, machine credentials are
generated and the LDAP+GSSAPI Login Method
parameters for communication with the Domain
Controller are automatically populated.
X
Analog Fax - Cancel
Faxes
Specifies whether pending faxes can be canceled by users. X
Analog Fax - Driver to
fax
Specifies whether driver fax jobs are treated as PS jobs
and printed or sent as faxes.
X
Analog Fax - Enable
Fax Receive
Specifies whether incoming faxes may be received. X
Analog Fax - Fax
Forwarding
Specifies whether fax forwarding of incoming faxes to a
destination other than the printer is enabled.
X
Analog Fax - Holding
Faxes
Defines conditions for holding incoming faxes. X
Date and Time
Parameters
Controls whether the time is tracked internally or from a
remote NTP server. If an NTP server is used, it specifies
the parameters for communication with the server.
Internal and external time sources represent two distinct
modes of TOE operation.
X
Disk Encryption Specifies whether or not files stored on disk are
encrypted. This parameter must be set to “Enable” during
installation and is not accessible to administrators during
operation.
X
Disk Wiping -
Automatic Method
Specifies the method used for automatic disk wiping. X
Disk Wiping - Wiping
Mode
Controls the mode used for disk wiping. X
E-mail images sent
as
Specifies whether images forwarded via SMTP are sent as
an attachment or FTP’d to a file system and sent as a
URL.
X
Enable Audit Determines if the device records events in the secure audit
log and (if enabled) in the remote syslog.
X
Enable Fax Scans Specifies whether users can create faxes with the device’s
scanner.
X
Enable FTP/TFTP Enables FTP/TFTP server on the TOE. X
Enable HTTP Server Enables HTTP(S) server on the TOE. X
Enable Remote Syslog Determines if the device transmits logged events to a
remote server.
X
Fax Mode Specifies whether the fax function is operating in Analog
mode or as a Fax Server (outgoing faxes are forwarded to
a fax server via SMTP).
X
Lexmark Multi-Function Printers with Hard Drives Security Target
18
Item Description D.CONF D.PROT
Fax Server - Enable
Analog Receive
This parameter controls whether incoming faxes are
supported when operating in fax server mode
X
Fax Storage Location Specifies the storage location for faxes. This parameter
must be set to “Disk” during installation and is not
accessible to administrators during operation.
X
Groups The set of Groups may be used to configure permissions
for users. Each Group has a configured set of
permissions. Users may belong to any number of Groups,
and any User’s permissions are the union of the
permissions for each Group it is a member of.
X
Held Print Job
Expiration Timer
Specifies the amount of time a received print job is saved
for a user to release before it is automatically deleted.
X
IPSec Settings The configuration parameters for IPSec that require IPSec
with ESP for all network communication (IPv4 and/or
IPv6) with certificate validation or pre-shared keys.
X
Job Waiting Specifies whether a print job may be placed in the Held
Jobs queue if the required resources (e.g. paper type) are
not currently available, enabling subsequent print jobs to
be processed immediately
X
Kerberos Setup Defines the KDC Address, KDC Port, and Realm for
communication with the KDC. KDC communication is
required if the TOE is using the LDAP+GSSAPI
mechanism.
X
LDAP Certificate
Required
Specifies whether a valid certificate is required to be sent
by an LDAP server. Yes specifies that the server
certificate is requested; if no certificate is provided or if a
bad certificate is provided, the session is terminated
immediately. No indicates that a certificate is not
required; if a certificate is supplied and it is invalid, the
session is terminated immediately.
X
LDAP+GSSAPI –
MFP Credentials
Specifies the Username and password to be used when
performing LDAP queries.
X
LDAP+GSSAPI
Configuration
Specifies the configuration options for communicating
and exchanging information with an LDAP server using
GSSAPI.
X
LES Applications Specifies whether enhanced service Java applications may
be executed on the TOE. This parameter must be set to
“Enable” during installation and is not accessible to
administrators during operation.
X
Login Restrictions Determines how many failed authentications are allowed
within the “Failure time frame” value before the offending
Username/Password account is prevented from logging in
for the duration of the “Lockout time” value. The “Web
Login Timeout” determines how long the web sessions
can remain idle before the user is logged off
automatically.
X
Network Port Defines the parameters required for the TOE to
communicate via the standard network port
X
Lexmark Multi-Function Printers with Hard Drives Security Target
19
Item Description D.CONF D.PROT
Permissions Permissions specify the Function Access Control (FAC)
authorizations, which grant access to menus or functions
(e.g. Copy). Permissions are separately configurable for
the default Guest account (Public) and for each defined
Group. Users other than Guest inherent the union of
permissions for all Groups that they are a member of.
X
Remote Syslog
Parameters
Defines the communication to the remote syslog system X
Security Reset
Jumper
Specifies the behavior of the TOE when a position change
of the Security Rest Jumper is detected. No Effect
indicates the jumper should be ignored. “Enable Guest
Access” changes the permissions for the Guest account to
provide access to all functions and menus.
X
Smart Card
Authentication Client
Configuration
Specifies parameters for validating the certificate from the
card and retrieving information from Active Directory.
X
SMTP Setup Settings Define the SMTP server to be used to send email from the
TOE
X
SMTP Setup Settings -
User-Initiated E-mail
Specifies what credentials (if any) are used to authenticate
with an external SMTP server.
X
USB Buffer Disables all activity via the USB device ports (with the
exception of a Smart Card reader if Smart Card usage is
configured).
X
Username/Password
Accounts
Specify a list of accounts that are internally validated by
username and password. For each account, a list of Group
memberships are configured.
X
Visible Home Screen
Icons
Specifies what icons should be displayed on the touch
panel home screen.
X
1.9.2 Authentication Data
All the items described in the following table are D.CONF.
Table 8 - Authentication Data
Item Description
Username/Password
Account Usernames and
Passwords
The username and password for each defined Username/Password account
are used with Username/Password Account authentication performed
internally by the TOE.
1.9.3 Security Attributes
All the items described in the following table are D.CONF.
Table 9 - Security Attributes
Item Description
Permissions The permissions for the user session, determined from the union of
permissions from all the group memberships associated with the account
Username The username specified during a successful I&A interaction.
Lexmark Multi-Function Printers with Hard Drives Security Target
20
1.9.4 User Data
All the items described in the following table have both a D.DOC and D.FUNC component.
Table 10 - User Data
Item Description
Copy Job Data input to the TOE via the scanner and destined for the printer.
Held Faxes Data received via the fax interface and held until released by an authorized
administrator.
Held Jobs Data received via the network interface that is destined for the printer and
held until released at the touch panel by the submitter.
Incoming Fax Job Data received via the fax interface and destined for the printer.
Network Print Job Data received via the network interface and destined for the printer. All
network print jobs are held until released.
Scanned Job to be
Emailed
Data input to the TOE via the scanner and destined for the SMTP server
specified by an authorized administrator.
Scanned Job to be Faxed Data input to the TOE via the scanner and queued for transmission as a fax
via the phone line.
1.10 Evaluated Configuration
The following configuration options apply to the evaluated configuration of the TOE:
1. The B/W Print and Color Print permissions must be configured for the Public
permissions, which apply to all users including the Guest user. These permissions
authorize the MFP to accept print jobs from remote IT systems. No other permissions
may be configured for the Public permissions.
2. No optional network interfaces are installed on the MFPs.
3. No optional parallel or serial interfaces are installed on the MFPs. These are for legacy
connections to specific IT systems only.
4. All USB ports on the MFPs that perform document processing functions are disabled via
configuration. In the operational environments in which the Common Criteria evaluated
configuration is of interest, the users typically require that all USB ports are disabled. If
Smart Card authentication is used, the card reader is physically connected to a specific
USB port during TOE installation; in the evaluated configuration this USB port is limited
in functionality to acting as the interface to the card reader. A reader is shipped with the
MFP. If Smart Card authentication is not used, the card reader may be left unconnected.
5. Operational management functions are performed via browser sessions to the embedded
web server or via the management menus available through the touch panel.
6. Disk encryption is enabled.
7. Access controls are configured for all TSF data so that only authorized administrators are
permitted to manage those parameters.
8. All network communication is required to use IPSec with ESP to protect the
confidentiality and integrity of the information exchanged, including management
Lexmark Multi-Function Printers with Hard Drives Security Target
21
sessions that exchange D.CONF and D.PROT. Certificates presented by remote IT
systems are validated.
9. Because all network traffic is required to use IPSec with ESP, syslog records sent to a
remote IT system also are protected by IPSec with ESP. This is beyond IEEE Std.
2600.1™-2009 requirements for transmission of audit records.
10. I&A may use Username/Password Accounts and/or the LDAP+GSSAPI login method on
a per-user basis. Smart Card authentication may be used for touch panel users. No other
I&A mechanisms are included in the evaluation because they provide significantly lower
strength than the supported mechanisms.
11. LDAP+GSSAPI and Smart Card authentication require integration with an external
LDAP server such as Active Directory. This communication uses default certificates; the
LDAP server must provide a valid certificate to the TOE. Binds to LDAP servers for
LDAP+GSSAPI use device credentials (not anonymous bind) so that the information
retrieved from Active Directory can be restricted to a specific MFP. Binds to LDAP
servers for Smart Card authentication use user credentials from the card (not anonymous
bind) so that the information retrieved from Active Directory can be restricted to a
specific user.
12. Audit event records are transmitted to a remote IT system as they are generated using the
syslog protocol.
13. The severity level of audit events to log must be set to 5 (Notice).
14. Disk wiping functionality is performed with a multi-pass method. This approach is the
more secure form of disk wiping and is compliant with NIST SP800-88 and the DSS
"Clearing and Sanitization Matrix" (C&SM).
15. User data sent by the MFP in email messages is sent as an attachment (not as a web link).
16. No Java applications are required to be installed on the TOE. These applications are
referred to as eSF applications in end user documentation. The following eSF
applications may be installed by an administrator during TOE installation if smart-card
support is desired: “Smart Card Authentication”, "Smart Card Authentication Client",
"Display Customization", "Secure Email", "Secure Held Jobs", “PIV Smart Card Driver
“, “CAC Smart Card Driver”, and “SIPRNet Smart Card Driver”.
17. The following eSF applications may be installed by an administrator during TOE
installation and must be enabled if smart card authentication is used: “Smart Card
Authentication”, “Smart Card Authentication Client”, “PIV Smart Card Driver (if PIV
cards are used)”, “CAC Smart Card Driver (if CAC cards are used)” )”, and “SIPRNet
Smart Card Driver (if SIPRNet cards are used)”.
18. All other eSF applications installed by Lexmark before the TOE is shipped must be
disabled.
19. No option card for downloadable emulators is installed in the TOE.
20. All fax jobs are stored on disk (rather than NAND) to ensure their contents are wiped
upon completion of each job. Incoming faxes are always held until released by an
authorized administrator.
Lexmark Multi-Function Printers with Hard Drives Security Target
22
21. Fax forwarding is disabled to limit the destinations for incoming faxes to the local printer
only.
22. NPAP, PJL and Postscript have the ability to modify system settings. The capabilities
specific to modifying system settings via these protocols are disabled.
23. All administrators must be authorized for all of the document processing functions (print,
copy, scan, fax).
24. All network print jobs are held until released via the touch panel. Every network print
job must include a PJL SET USERNAME statement to identify the userid of the owner of
the print job. Held print jobs may only be released by an authenticated user with the
same userid as specified in the print job.
25. All incoming fax jobs are held until released via the touch panel. Held print jobs may
only be released by an authenticated user with the U.ADMINISTRATOR role.
26. Administrators are directed (through operational guidance) to specify passwords adhering
to the following composition rules for Username/Password Accounts:
 A minimum of 8 characters
 At least one lower case letter, one upper case letter, and one non-alphabetic
character
 No dictionary words or permutations of the user name
27. Simple Network Management Protocol (SNMP) support is disabled.
28. Internet Printing Protocol (IPP) support is disabled.
29. All unnecessary network ports are disabled.
30. The supported Diffie-Hellman groups for IKE are Group 14 (2048) and Group 24 (2048
w/ 256-bit POS).
31. The hard drives are only designed to be removed by authorized Lexmark service
personnel, and only upon failure of the hard drive as part of a replacement operation to
bring the TOE back into operational status. Under no circumstances are hard drives
reinserted into the same or a different printer after removal.
The following table defines the combinations of possible input sources and destinations that are
included in the evaluated configuration. In the table, the following meanings are used:
 “May Be Disabled Or Restricted” indicates that the functionality is included in
the evaluation but may be disabled or restricted to an authorized set of users at the
discretion of an administrator
 “Disabled” indicates the functionality exists within the TOE but is always
disabled by an administrator for the evaluated configuration
 “n/a” indicates the functionality does not exist in the TOE
Lexmark Multi-Function Printers with Hard Drives Security Target
23
Table 11 - Source-Destination Combinations
Source
Destination
Print Protocols (via
the Network
Interface)
Scanner Incoming Fax
Printer May Be Disabled Or
Restricted
May Be Disabled Or
Restricted
May Be Disabled Or
Restricted
Outgoing Fax Disabled May Be Disabled Or
Restricted
Disabled
Email (via the Network
Interface)
n/a May Be Disabled Or
Restricted
Disabled
FTP (via the Network
Interface)
n/a Disabled Disabled
Lexmark Multi-Function Printers with Hard Drives Security Target
24
2. Conformance Claims
2.1 Common Criteria Conformance
Common Criteria version: Version 3.1 Revision 5
Common Criteria conformance: Part 2 extended and Part 3 conformant
2.2 Protection Profile Conformance
PP Identification: 2600.1, Protection Profile for Hardcopy Devices, Operational Environment A,
version 1.0, dated January 2009
PP Conformance: “2600.1-PP, Protection Profile for Hardcopy Devices, Operational
Environment A,” “2600.1-PRT, SFR Package for Hardcopy Device Print Functions, Operational
Environment A,” “2600.1-SCN, SFR Package for Hardcopy Device Scan Functions, Operational
Environment A,” “2600.1-CPY, SFR Package for Hardcopy Device Copy Functions, Operational
Environment A,” “2600.1-FAX, SFR Package for Hardcopy Device Fax Functions, Operational
Environment A,” and “2600.1-SMI, SFR Package for Hardcopy Device Shared-medium
Interface Functions, Operational Environment A”
This Security Target claims demonstrable conformance to the Security Problem Definition
(APE_SPD), Security Objectives (APE_OBJ), Extended Components Definitions (APE_ECD),
and the Common Security Functional Requirements (APE_REQ) of the referenced PP.
This TOE performs the functions F.PRT, F.SCN, F.CPY, F.FAX, and F.SMI as defined in the
referenced PP and claims demonstrable conformance to the augmented SFR packages defined for
each of these functions.
Rationale for PP conformance is provided in chapter 8.
2.3 Security Requirement Package Conformance
Security assurance requirement package conformance: EAL3 augmented by ALC_FLR.3
Security functional requirement package conformance: The SFR packages itemized below from
the referenced PP with augmentations.
1. Common Security Functional Requirements
2. 2600.1-PRT, SFR Package for Hardcopy Device Print Functions, Operational
Environment A
3. 2600.1-SCN, SFR Package for Hardcopy Device Scan Functions, Operational
Environment A
4. 2600.1-CPY, SFR Package for Hardcopy Device Copy Functions, Operational
Environment A
5. 2600.1-FAX, SFR Package for Hardcopy Device Fax Functions, Operational
Environment A
6. 2600.1-SMI, SFR Package for Hardcopy Device Shared-medium Interface Functions,
Operational Environment A
Lexmark Multi-Function Printers with Hard Drives Security Target
25
3. Security Problem Definition
3.1 Introduction
This chapter defines the nature and scope of the security needs to be addressed by the TOE.
Specifically this chapter identifies:
A) assumptions about the environment,
B) threats to the assets and
C) organisational security policies.
This chapter identifies assumptions as A.assumption, threats as T.threat and policies as P.policy.
This chapter addresses threats posed by four categories of threat agents:
 Persons who are not permitted to use the TOE who may attempt to use the TOE.
 Persons who are authorized to use the TOE who may attempt to use TOE functions for
which they are not authorized.
 Persons who are authorized to use the TOE who may attempt to access data in ways for
which they are not authorized.
 Persons who unintentionally cause a software malfunction that may expose the TOE to
unanticipated threats.
The threats and policies defined in this chapter address the threats posed by these threat agents.
3.2 Assumptions
The specific conditions listed in the following subsections are assumed to exist in the TOE
environment. These assumptions include both practical realities in the development of the TOE
security requirements and the essential environmental conditions on the use of the TOE.
Table 12 - Assumptions
A.Type Description
A.ACCESS.MANAGED The TOE is located in a restricted or monitored environment that provides
protection from unmanaged access to the physical components and data
interfaces of the TOE.
A.ADMIN.TRAINING Administrators are aware of the security policies and procedures of their
organization, are trained and competent to follow the manufacturer’s
guidance and documentation, and correctly configure and operate the TOE
in accordance with those policies and procedures.
A.ADMIN.TRUST Administrators do not use their privileged access rights for malicious
purposes.
A.IPSEC IPSec with ESP is used between the TOE and all remote IT systems with
which it communicates over the network using IPv4 and/or IPv6.
A.USER.TRAINING TOE Users are aware of the security policies and procedures of their
organization, and are trained and competent to follow those policies and
procedures.
A.VIPER The Lexmark Secure Element provides entropy of adequate quality for
secure operation of the TOE’s DRBG.
Lexmark Multi-Function Printers with Hard Drives Security Target
26
3.3 Threats
The threats identified in the following subsections are addressed by the TOE and the Operational
Environment.
Table 13 - Threats
T.Type TOE Threats
T.CONF.ALT TSF Confidential Data may be altered by unauthorized persons
T.CONF.DIS TSF Confidential Data may be disclosed to unauthorized persons
T.DOC.ALT User Document Data may be altered by unauthorized persons
T.DOC.DIS User Document Data may be disclosed to unauthorized persons
T.FUNC.ALT User Function Data may be altered by unauthorized persons
T.PROT.ALT TSF Protected Data may be altered by unauthorized persons
3.4 Organisational Security Policies
This section describes the Organizational Security Policies (OSPs) that apply to the TOE. OSPs
are used to provide a basis for security objectives that are commonly desired by TOE Owners in
this operational environment but for which it is not practical to universally define the assets
being protected or the threats to those assets.
Table 14 - Organizational Security Policies for the TOE
Name Definition
P.AUDIT.LOGGING To preserve operational accountability and security,
records that provide an audit trail of TOE use and
security-relevant events will be created, maintained, and
protected from unauthorized disclosure or alteration,
and will be reviewed by authorized personnel
P.INTERFACE.MANAGEMENT To prevent unauthorized use of the external interfaces
of the TOE, operation of those interfaces will be
controlled by the TOE and its IT environment.
P.SOFTWARE.VERIFICATION To detect corruption of the executable code in the TSF,
procedures will exist to self-verify executable code in
the TSF.
P.USER.AUTHORIZATION To preserve operational accountability and security,
Users will be authorized to use the TOE only as
permitted by the TOE Owner
Lexmark Multi-Function Printers with Hard Drives Security Target
27
4. Security Objectives
This section identifies the security objectives of the TOE and the TOE’s Operational
Environment. The security objectives identify the responsibilities of the TOE and the TOE’s
Operational Environment in meeting the security needs. Objectives of the TOE are identified as
O.objective. Objectives that apply to the operational environment are designated as
OE.objective.
4.1 Security Objectives for the TOE
The TOE must satisfy the following objectives.
Table 15 - Security Objectives for the TOE
O.Type Security Objective
O.AUDIT.LOGGED The TOE shall create and maintain a log of TOE use and security-relevant
events and prevent its unauthorized disclosure or alteration.
O.CONF.NO_ALT The TOE shall protect TSF Confidential Data from unauthorized alteration.
O.CONF.NO_DIS The TOE shall protect TSF Confidential Data from unauthorized disclosure.
O.DOC.NO_ALT The TOE shall protect User Document Data from unauthorized alteration.
O.DOC.NO_DIS The TOE shall protect User Document Data from unauthorized disclosure.
O.FUNC.NO_ALT The TOE shall protect User Function Data from unauthorized alteration.
O.INTERFACE.MA
NAGED
The TOE shall manage the operation of external interfaces in accordance with
security policies.
O.I&A The TOE shall provide functionality to identify and authenticate users whose
accounts are defined internal to the TOE.
O.MANAGE The TOE will provide all the functions and facilities necessary to support the
administrators in their management of the security of the TOE, and restrict these
functions and facilities from unauthorized use.
O.PROT.NO_ALT The TOE shall protect TSF Protected Data from unauthorized alteration.
O.SOFTWARE.VER
IFIED
The TOE shall provide procedures to self-verify executable code in the TSF.
O.TIME_STAMP The TOE will provide reliable time stamps for accountability purposes when
internal clocks are configured by an administrator.
O.USER.AUTHORI
ZED
The TOE shall require identification and authentication of Users, and shall
ensure that Users are authorized in accordance with security policies before
allowing them to use the TOE.
4.2 Security Objectives for the Operational Environment
The TOE’s operational environment must satisfy the following objectives.
Table 16 - Security Objectives of the Operational Environment
OE.Type Operational Environment Security Objective
OE.ADMIN.TRAINED The TOE Owner shall ensure that TOE Administrators are aware of the
security policies and procedures of their organization; have the training,
competence, and time to follow the manufacturer’s guidance and
documentation; and correctly configure and operate the TOE in
accordance with those policies and procedures.
OE.ADMIN.TRUSTED The TOE Owner shall establish trust that TOE Administrators will not use
their privileged access rights for malicious purposes.
OE.AUDIT.REVIEWED The TOE Owner shall ensure that audit logs are reviewed at appropriate
intervals for security violations or unusual patterns of activity.
Lexmark Multi-Function Printers with Hard Drives Security Target
28
OE.Type Operational Environment Security Objective
OE.AUDIT_ACCESS.AU
THORIZED
If audit records generated by the TOE are exported from the TOE to
another trusted IT product, the TOE Owner shall ensure that those records
can be accessed in order to detect potential security violations, and only by
authorized persons.
OE.AUDIT_STORAGE.P
ROTECTED
If audit records are exported from the TOE to another trusted IT product,
the TOE Owner shall ensure that those records are protected from
unauthorized access, deletion and modifications.
OE.I&A The operational environment shall provide functionality to identify and
authenticate users whose accounts are defined external to the TOE.
OE.INTERFACE.MANA
GED
The IT environment shall provide protection from unmanaged access to
TOE external interfaces.
OE.IPSEC All remote IT system with which the TOE communicates over the network
using IPv4 and/or IPv6 shall support IPSec with ESP.
OE.PHYSICAL.MANAG
ED
The TOE shall be placed in a secure or monitored area that provides
protection from unmanaged physical access to the TOE.
OE.TIME_STAMP The Operational Environment will provide reliable time stamps for
accountability purposes when NTP is configured by an administrator.
OE.USER.AUTHORIZED The TOE Owner shall grant permission to Users to be authorized to use
the TOE according to the security policies and procedures of their
organization.
OE.USER.TRAINED The TOE Owner shall ensure that Users are aware of the security policies
and procedures of their organization and have the training and competence
to follow those policies and procedures.
OE.VIPER The Lexmark Secure Element provides entropy of adequate quality for
secure operation of the TOE’s DRBG.
Lexmark Multi-Function Printers with Hard Drives Security Target
29
5. Extended Components Definition
5.1 Extended Security Functional Components
5.1.1 FPT_FDI_EXP Restricted forwarding of data to external interfaces
Family behaviour:
This family defines requirements for the TSF to restrict direct forwarding of information from
one external interface to another external interface.
Many products receive information on specific external interfaces and are intended to transform
and process this information before it is transmitted on another external interface. However,
some products may provide the capability for attackers to misuse external interfaces to violate
the security of the TOE or devices that are connected to the TOE’s external interfaces. Therefore,
direct forwarding of unprocessed data between different external interfaces is forbidden unless
explicitly allowed by an authorized administrative role. The family FPT_FDI_EXP has been
defined to specify this kind of functionality.
Component leveling:
FPT_FDI_EXP.1 Restricted forwarding of data to external interfaces provides for the
functionality to require TSF controlled processing of data received over defined external
interfaces before these data are sent out on another external interface. Direct forwarding of data
from one external interface to another one requires explicit allowance by an authorized
administrative role.
Management:FPT_FDI_EXP.1
The following actions could be considered for the management functions in FMT:
a) Definition of the role(s) that are allowed to perform the management
activities
b) Management of the conditions under which direct forwarding can be
allowed by an administrative role
c) Revocation of such an allowance
Audit: FPT_FDI_EXP.1
The following actions should be auditable if FAU_GEN Security Audit Data Generation is
included in the PP/ST:
There are no auditable events foreseen.
Rationale:
FPT_FDI_EXP.1 Restricted forwarding of data to external interfaces 1
Lexmark Multi-Function Printers with Hard Drives Security Target
30
Quite often, a TOE is supposed to perform specific checks and process data received on one
external interface before such (processed) data are allowed to be transferred to another external
interface. Examples are firewall systems but also other systems that require a specific work flow
for the incoming data before it can be transferred. Direct forwarding of such data (i.e., without
processing the data first) between different external interfaces is therefore a function that—if
allowed at all—can only be allowed by an authorized role.
It has been viewed as useful to have this functionality as a single component that allows
specifying the property to disallow direct forwarding and require that only an authorized role can
allow this. Since this is a function that is quite common for a number of products, it has been
viewed as useful to define an extended component.
The Common Criteria defines attribute-based control of user data flow in its FDP class.
However, in this Protection Profile, the authors needed to express the control of both user data
and TSF data flow using administrative control instead of attribute-based control. It was found
that using FDP_IFF and FDP_IFC for this purpose resulted in SFRs that were either too
implementation-specific for a Protection Profile or too unwieldy for refinement in a Security
Target. Therefore, the authors decided to define an extended component to address this
functionality.
This extended component protects both user data and TSF data, and it could therefore be placed
in either the FDP or the FPT class. Since its purpose is to protect the TOE from misuse, the
authors believed that it was most appropriate to place it in the FPT class. It did not fit well in any
of the existing families in either class, and this led the authors to define a new family with just
one member.
FPT_FDI_EXP.1 Restricted forwarding of data to external interfaces
Hierarchical to: No other components
Dependencies: FMT_SMF.1 Specification of Management Functions
FMT_SMR.1 Security roles
FPT_FDI_EXP.1.1 The TSF shall provide the capability to restrict data received on [assignment: list of
external interfaces] from being forwarded without further processing by the TSF to [assignment:
list of external interfaces].
5.2 Extended Security Assurance Components
No extended security assurance requirements are defined.
Lexmark Multi-Function Printers with Hard Drives Security Target
31
6. Security Requirements
This section contains the functional requirements that are provided by the TOE.
The CC defines operations on security requirements. The font conventions listed below state the
conventions used in this ST to identify the operations.
Assignment: indicated in italics
Selection: indicated in underlined text
Assignments within selections: indicated in italics and underlined text
SFR operation completed or partially completed in the PP: Bold
Refinement: indicated with bold text
Iterations of security functional requirements may be included. If so, iterations are specified at
the component level and all elements of the component are repeated. Iterations are identified by
letters in parentheses following the component or element (e.g., FAU_ARP.1(A)).
6.1 TOE Security Functional Requirements
The functional requirements are described in detail in the following subsections. Additionally,
these requirements are derived verbatim from Part 2 of the Common Criteria for Information
Technology Security Evaluation with the exception of completed operations.
6.1.1 Security Audit (FAU)
6.1.1.1 FAU_GEN.1 Audit Data Generation
FAU_GEN.1.1 The TSF shall be able to generate an audit record of the following auditable
events:
a) Start-up and shutdown of the audit functions;
b) All auditable events for the not specified level of audit; and
c) All Auditable Events as each is defined for its Audit Level (if one is specified) for
the Relevant SFR in Table 17; the additional auditable events specified in Table 17.
FAU_GEN.1.2 The TSF shall record within each audit record at least the following information:
a) Date and time of the event, type of event, subject identity, and the outcome (success
or failure) of the event; and
b) For each audit event type, based on the auditable event definitions of the functional
components included in the PP/ST, for each Relevant SFR listed in Table 17: (1)
information as defined by its Audit Level (if one is specified), and (2) all
Additional Information (if any is required; the internal event number, ISO 8601
time of the event occurrence, severity, and process.
Table 17 - Audit data requirements
Auditable event Relevant
SFR
Audit level Additional
Information
SECURE AUDIT TURNED ON/OFF FAU_GEN.1 n/a Setting (ON or OFF)
Lexmark Multi-Function Printers with Hard Drives Security Target
32
Auditable event Relevant
SFR
Audit level Additional
Information
Job Started (Network print job with PJL SET
USERNAME statement)
FDP_ACF.1 Not specified Userid specified in
the PJL SET
USERNAME
statement, Job
identifier
Job Started (Network print job without PJL SET
USERNAME statement)
FDP_ACF.1 Not specified Userid displayed as
“Unknown”, Job
identifier
Job Completed FDP_ACF.1 Not specified Job identifier
Job Canceled (By user or via release expiration
period)
FDP_ACF.1 Not specified Job identifier
Authentication Failure FIA_UAU.1,
FIA_UID.1
Basic Login mechanism,
attempted user
identity
Successful Authentication FIA_UAU.1,
FIA_UID.1
Basic Login mechanism
Setting change FMT_MTD.1 Basic Parameter identifier
and old and new
values
Use of the management functions FMT_SMF.1 Minimum None
Modifications to the group of users that are part
of a role
FMT_SMR.1 Minimum None
Time changed FPT_STM.1 Minimum None
User logged out due to timeout FTA_SSL.3 Minimum None
Failure of the trusted channel FTP_ITC.1 Minimum None
Application Note: The audit for “Use of the management functions” is addressed by the “Setting change” audits. It is included
in the audit table above for conformance with the P2600 PP.
Application Note: The audit for “Modifications to the group of users that are part of a role” is addressed by the “Setting
change” audits. It is included in the audit table above for conformance with the P2600 PP.
6.1.1.2 FAU_GEN.2 User Identity Association
FAU_GEN.2.1 For audit events resulting from actions of identified users, the TSF shall be able
to associate each auditable event with the identity of the user that caused the event.
6.1.2 Cryptographic Support (FCS)
6.1.2.1 FCS_CKM.1 Cryptographic Key Generation
FCS_CKM.1.1(A) The TSF shall generate cryptographic keys in accordance with a specified
cryptographic key generation algorithm random number generator and specified cryptographic
key sizes 256 bits that meet the following: SP800-90A (CTR_DRBG (AES)).
Application Note: This instance of the SFR applies to the 256-bit AES key used for hard disk encryption.
FCS_CKM.1.1(B) The TSF shall generate cryptographic keys in accordance with a specified
cryptographic key generation algorithm RSA key generation and specified cryptographic key
sizes 2048 bits that meet the following: SP 800-56B.
Lexmark Multi-Function Printers with Hard Drives Security Target
33
Application Note: This instance of the SFR applies to the RSA public-private key pair generated for the default self-signed
certificate used for IKE.
Application Note: The asymmetric keys are used in the self-signed X.509 cert that can be used for IKE/IPsec exchanges. The
keys used to protect IPsec ESP traffic are determined using DH key agreement during SA establishment.
6.1.2.2 FCS_CKM.4 Cryptographic Key Destruction
FCS_CKM.4.1 The TSF shall destroy cryptographic keys in accordance with a specified
cryptographic key destruction method zeroization that meets the following: FIPS 140-2.
6.1.2.3 FCS_COP.1 Cryptographic Operation
FCS_COP.1.1 The TSF shall perform the operations listed in the table below in accordance with
a specified cryptographic algorithm multiple algorithms described below and cryptographic key
sizes as described below that meet the following: multiple standards as described below.
Table 18 - Cryptographic Operations
Algorithm
Operations Key/Hash
Size in Bits
Standards
AES (CBC mode) (CAVP cert.
5891/5931 (G2-32bit) and
5893/5933 (G2-64bit))
Encryption,
decryption
128, 256
FIPS 197
SP800-38A
ISO/IEC 18033-3
ISO/IEC 10116
SHA (CAVP cert. 4642/4686
(G2-32bit) and 4644/4688 (G2-
64bit))
Hashing 160, 256, 384 FIPS 180-4
HMAC (CAVP cert. 3866/3909
(G2-32bit) and 3868/3911 (G2-
64bit))
Secure hash 160, 256, 384
FIPS 198-1
FIPS 180-4
RSA (CAVP cert. 3112 (G2-
32bit) and 3114 (G2-64bit))
Digital signatures 2048 FIPS 186-4
Diffie-Hellman (CAVP cert.
2159 (G2-32bit) and 2163 (G2-
64bit))
IKE KDF
Group 14 (2048),
Group 24 (2048
w/ 256-bit POS)
SP800-135
DRBG (CTR_DRBG (AES))
(CAVP cert. 2484 (G2-32bit)
and 2486 (G2-64bit))
Random number
generation
256 SP 800-90A
Application Note: Hard Disk Encryption uses AES-CBC-256 (using the symmetric key generated when the system is configured)
and SHA-256. IKE/IPsec use all of the above algorithms. IKE exchanges using the X.509 cert or PSK
determine the key/hash sizes and key (via DH) used for IPsec ESP protection of the traffic.
6.1.3 User Data Protection (FDP)
6.1.3.1 FDP_ACC.1 Subset Access Control
FDP_ACC.1.1(A) The TSF shall enforce the Common Access Control SFP on
1. Subjects: Users (U.USER)
2. Objects: Copy Job, Incoming Fax Job, Network Print Job, Scanned Job to be Emailed,
Scanned Job to be Faxed
3. Operations: Create, View, Modify, Release, Delete
Lexmark Multi-Function Printers with Hard Drives Security Target
34
Application Note: “Release” refers to releasing held faxes or held jobs to be printed (at which time they can be read). “View”
refers the ability to see that the job exists (D.FUNC), not to view the user data inside the job. No
functionality exists to view the user data inside a job other than printing the document. “Modify” refers to
the ability to change job parameters (e.g. number of copies).
FDP_ACC.1.1(B) The TSF shall enforce the TOE Function Access Control SFP on
1. Subjects: Users (U.USER)
2. Objects: TOE Functions - F.PRT, F.SCN, F.CPY, F.FAX, F.SMI
3. Operations: Invoke
6.1.3.2 FDP_ACF.1 Security Attribute Based Access Control
FDP_ACF.1.1(A) The TSF shall enforce the Common Access Control SFP to objects based on
the following:
1. Subjects: Users (U.USER) – Username, Group memberships
2. Objects: Copy Job, Incoming Fax Job, Network Print Job, Scanned Job to be Emailed,
Scanned Job to be Faxed - owner
FDP_ACF.1.2(A) The TSF shall enforce the following rules to determine if an operation among
controlled subjects and controlled objects is allowed: the rules specified in the following table.
Table 19 - Common Access Control SFP Rules
Operation
Object
Create View Modify Release Delete
Copy Job Allowed if the user is
permitted to access the
Copy Function. The job
owner is the authenticated
user of the touch panel.
n/a n/a n/a n/a
Incoming Fax
Job
Allowed if the “Enable
Fax Receive” or “Enable
Analog Receive”
parameter is “On”. Note
that all incoming faxes
are held in the evaluated
configuration. Incoming
faxes are owned by any
user that is permitted to
access the Release Held
Faxes function.
n/a n/a Allowed if the
user is permitted
to access the
Release Held
Faxes function
n/a
Network Print
Job
Allowed if the submitted
job includes a userid in a
SET USERNAME PJL
statement and the user is
permitted to access the
Held Jobs Access
function. Note that all
Allowed
for jobs
owned by
the user if
the user is
permitted
to access
n/a Allowed for jobs
owned by the
user if the user
is permitted to
access the
Access Held
Jobs function
Allowed for jobs
owned by the
user if the user is
permitted to
access the
function
Lexmark Multi-Function Printers with Hard Drives Security Target
35
Operation
Object
Create View Modify Release Delete
incoming network print
jobs are held in the
evaluated configuration.
The job owner is the
userid specified in the
PJL SET USERNAME
statement.
the Access
Held Jobs
function
Scanned Job to
be Emailed
Allowed if the user is
permitted to access the E-
mail Function. The job
owner is the authenticated
user of the touch panel.
n/a n/a n/a n/a
Scanned Job to
be Faxed
Allowed if the user is
permitted to access the
Fax Function; the “Enable
Fax Scans” parameter is
On; and the “Fax Mode”
parameter is “Analog
Fax”. The job owner is
the authenticated user of
the touch panel.
n/a n/a n/a n/a
FDP_ACF.1.3(A) The TSF shall explicitly authorise access of subjects to objects based on the
following additional rules: no rules that explicitly authorise access.
FDP_ACF.1.4(A) The TSF shall explicitly deny access of subjects to objects based on the
following rules: no rules that explicitly deny access.
FDP_ACF.1.1(B) The TSF shall enforce the TOE Function Access Control SFP to objects based
on the following:
1. Subjects: Users (U.USER) – Group memberships
2. Objects: TOE Functions (F.PRT, F.SCN, F.CPY, F.FAX, F.SMI) - None
FDP_ACF.1.2(B) The TSF shall enforce the following rules to determine if an operation among
controlled subjects and controlled objects is allowed: the user is explicitly authorized by
U.ADMINISTRATOR to use a function.
FDP_ACF.1.3(B) The TSF shall explicitly authorise access of subjects to objects based on the
following additional rules: no rules that explicitly authorise access.
FDP_ACF.1.4(B) The TSF shall explicitly deny access of subjects to objects based on the
following rules: if a listed access control is “Disabled” access is denied.
6.1.3.3 FDP_RIP.1 Subset Residual Information Protection
FDP_RIP.1.1 The TSF shall ensure that any previous information content of a resource is made
unavailable upon the deallocation of the resource from the following objects: D.DOC.
Lexmark Multi-Function Printers with Hard Drives Security Target
36
6.1.4 Identification and Authentication (FIA)
6.1.4.1 FIA_AFL.1 Authentication Failure Handling
FIA_AFL.1.1 The TSF shall detect when an administrator configurable positive integer within
the range of 1 to 10 unsuccessful authentication attempts occur related to accounts within the
administratively configured failure time frame.
FIA_AFL.1.2 When the defined number of unsuccessful authentication attempts has been met,
the TSF shall disable the account for the administratively configured lockout time.
6.1.4.2 FIA_ATD.1 User Attribute Definition
FIA_ATD.1.1 The TSF shall maintain the following list of security attributes belonging to
individual users:
1. Username
2. Password
3. Associated groups
4. User permissions, as specified by associated groups
5. Number of consecutive authentication failures
6. Time of the earliest authentication failure (since the last successful login if any have
occurred)
7. Account lock status
6.1.4.3 FIA_UAU.1 Timing of Authentication
FIA_UAU.1.1 The TSF shall allow submission of network print jobs, incoming faxes (if
enabled), and usage of the touch panel and browser sessions to view MFP status on behalf of the
user to be performed before the user is authenticated.
FIA_UAU.1.2 The TSF shall require each user to be successfully authenticated before allowing
any other TSF-mediated actions on behalf of that user.
Application Note: The TOE only performs the authentication for users using Username/Password Accounts. When I&A uses
LDAP+GSSAPI or Smart Card, authentication is under the control of the LDAP server (and the Smart Card)
in the operational environment. For all mechanisms, the TOE restricts access to other functionality until
authentication is successful.
6.1.4.4 FIA_UAU.7 Protected Authentication Feedback
FIA_UAU.7.1 The TSF shall provide only asterisks (“*”) or dots (“●”) to the user while the
authentication is in progress.
6.1.4.5 FIA_UID.1 Timing of Identification
FIA_UID.1.1 The TSF shall allow incoming faxes (if enabled) and usage of the touch panel and
browser sessions to view MFP status on behalf of the user to be performed before the user is
identified.
FIA_UID.1.2 The TSF shall require each user to be successfully identified before allowing any
other TSF-mediated actions on behalf of that user.
Lexmark Multi-Function Printers with Hard Drives Security Target
37
Application Note: The TOE only performs the identification for users using Username/Password Accounts. When I&A uses
LDAP+GSSAPI or Smart Card, identification is under the control of the LDAP server (and the Smart Card)
in the operational environment. For all mechanisms, the TOE restricts access to other functionality until
identification is successful.
6.1.4.6 FIA_USB.1 User-Subject Binding
FIA_USB.1.1 The TSF shall associate the following user security attributes with subjects acting
on behalf of that user:
1. Username
2. Password
3. Associated groups (for Username/Password Accounts only)
4. User permissions
FIA_USB.1.2 The TSF shall enforce the following rules on the initial association of user security
attributes with subjects acting on the behalf of users:
1. The username and password are the values supplied by the user.
2. The associated groups are the values configured for the user account.
3. User permissions are determined by combining the configured permissions for each
associated group.
FIA_USB.1.3 The TSF shall enforce the following rules governing changes to the user security
attributes associated with subjects acting on the behalf of users: the security attributes do not
change during a session.
6.1.5 Security Management (FMT)
6.1.5.1 FMT_MSA.1 Management of Security Attributes
FMT_MSA.1.1 The TSF shall enforce the Common Access Control SFP and TOE Function
Access Control SFP to restrict the ability to query, modify, delete, create the security attributes
Username, associated groups and user permissions to administrators authorized for access to
the Security Menu.
6.1.5.2 FMT_MSA.3 Static Attribute Initialisation
FMT_MSA.3.1 The TSF shall enforce the Common Access Control SFP and TOE Function
Access Control SFP to provide restrictive default values for security attributes that are used to
enforce the SFP.
FMT_MSA.3.2 The TSF shall allow the no role to specify alternative initial values to override
the default values when an object or information is created.
6.1.5.3 FMT_MTD.1 Management of TSF Data
FMT_MTD.1.1 The TSF shall restrict the ability to query, modify, delete, create the data
identified in the following table to the authorized identified roles except U.NORMAL.
Application Note: The user permission for each TSF data item to determine “authorized identified roles” is identified in the
following table.
Lexmark Multi-Function Printers with Hard Drives Security Target
38
Table 20 - TSF Data
Item Authorization Menu Item Operations
Active Directory
Configuration
Security Menu Create
Analog Fax - Cancel
Faxes
Function Configuration Menus Query, Modify
Analog Fax - Driver to
fax
Function Configuration Menus Query, Modify
Analog Fax - Enable Fax
Receive
Function Configuration Menus Query, Modify
Analog Fax - Enable
Manual Fax
Function Configuration Menus Query, Modify
Analog Fax - Fax
Forwarding
Function Configuration Menus Query, Modify
Analog Fax - Holding
Faxes
Function Configuration Menus Query, Modify, Delete, Create
Date and Time
Parameters
Device Menu Query, Modify
Disk Encryption Security Menu Query, Modify
E-mail images sent
As
Function Configuration Menus Query, Modify
Enable Audit Security Menu Query, Modify
Enable Fax Scans Function Configuration Menus Query, Modify
Enable FTP/TFTP Network/Ports Menu Query, Modify
Enable HTTP Server Network/Ports Menu Query, Modify
Enable Remote Syslog Security Menu Query, Modify
Fax Mode Function Configuration Menus Query, Modify
Fax Server - Enable
Analog Receive
Function Configuration Menus Query, Modify
Groups Security Menu Query, Modify, Delete, Create
Held Print Job Expiration
Timer
Security Menu Query, Modify
IPSec Settings Network/Ports Menu Query, Modify
Job Waiting Device Menu Query, Modify
Kerberos Setup Security Menu Query, Modify
LDAP Certificate
Verification
Security Menu Query, Modify
LDAP+GSSAPI – MFP
Credentials
Security Menu Query, Modify
LDAP+GSSAPI
Configuration
Security Menu Query, Modify, Delete, Create
Login Restrictions Security Menu Query, Modify
Network Port Network/Ports Menu Query, Modify
Lexmark Multi-Function Printers with Hard Drives Security Target
39
Item Authorization Menu Item Operations
Permissions Security Menu Query, Modify
Remote Syslog
Parameters
Security Menu Query, Modify
Security Reset
Jumper
Security Menu Query, Modify
Smart Card
Authentication Client
Configuration
Security Menu Query, Modify
SMTP Setup Settings Network/Ports Menu Query, Modify
SMTP Setup Settings -
User-Initiated E-mail
Network/Ports Menu Query, Modify
USB Buffer Network/Ports Menu Query, Modify
Username/Password
Accounts
Security Menu Query, Modify, Delete, Create
Visible Home Screen
Icons
Device Menu Query, Modify
6.1.5.4 FMT_SMF.1 Specification of Management Functions
FMT_SMF.1.1 The TSF shall be capable of performing the following management functions:
1. User management
2. Access control management
3. Time management
6.1.5.5 FMT_SMR.1 Security Roles
FMT_SMR.1.1 The TSF shall maintain the roles defined by the security-relevant permissions in
the following table that can be configured in an operational TOE for users via group
memberships.
Table 21 - FMT_SMR.1 Detail
Item Description Administrators Only?
Copy Function Controls a user’s access to the Copy functionality No
Device Menu Controls access to the Device Menu Yes
E-mail Function Control’s a user’s access to the Email functionality
(scan to email)
No
Fax Function Control’s a user’s ability to perform a scan to fax job
When “Disabled”, all analog faxing (scan send,
receive, and driver send) and the fax server are
disabled. The fax icon is removed and the device does
not answer incoming calls nor print driver faxes.
The values of the “Enable Fax Scan”, “Driver to Fax”,
and “Enable Fax Receive” settings in the “Fax Settings
Menu” determine the behavior of Fax Receive and
Driver Fax.
No
Lexmark Multi-Function Printers with Hard Drives Security Target
40
Item Description Administrators Only?
Function Configuration
Menus
Controls access to the Print, Copy, Fax and E-mail
menus for configuration of those functions
Yes
Network/Ports Menu Controls access to the Network/ Ports Menu Yes
Release Held Faxes Controls access to the Held Faxes button and the
Release Held Faxes button on the Home screen
Yes
Reports Menu Controls access to the Reports Menu via the
Administration Menus. This includes information
about user jobs, which can’t be disclosed to non-
administrators.
Yes
Access Held Jobs In the evaluated configuration, controls which users
are permitted to access the Held Jobs menu.
No
Security Menu Controls access to the Security Menu Yes
Application Note: If any permission identified as “Administrators Only” in the table above is associated with a user account,
then that user account is implicitly an Administrator (U.ADMINISTRATOR). If no permission identified as
“Administrators Only” in the table above is associated with a user account but any permission not identified
as “Administrator Only” is, then that user account is implicitly a Normal User (U.NORMAL). The role
“Guest” applies to a defined user that has no permissions identified in the table above.
FMT_SMR.1.2 The TSF shall be able to associate users with roles, except for the role
“Nobody” to which no user shall be associated.
Refinement Rationale: The SFR is reproduced with the refinement included in the P2600 Protection Profile. In this TOE, the
Guest user corresponds to the role Nobody. Since the evaluated configuration requires that no permissions
are allocated to the Guest account, users must login before gaining access to any TSF data or functions.
6.1.6 Protection of the TSF (FPT)
6.1.6.1 FPT_FDI_EXP.1 Restricted forwarding of data to external interfaces
FPT_FDI_EXP.1.1 The TSF shall provide the capability to restrict data received on any
external Interface from being forwarded without further processing by the TSF to any Shared-
medium Interface.
Application Note: For this TOE, the network interface is the only shared-medium interface.
6.1.6.2 FPT_STM.1 Reliable Time Stamps
FPT_STM.1.1 The TSF shall be able to provide reliable time-stamps.
Application Note: This SFR only applies when the TOE is configured to use internal timestamps. If the TOE is configured to
obtain timestamps from an external NTP server, this functionality is provided by that external NTP server in
the operational environment.
6.1.6.3 FPT_TST.1 TSF Testing
FPT_TST.1.1 The TSF shall run a suite of self tests during initial start-up to demonstrate the
correct operation of the cryptographic components of the TSF.
FPT_TST.1.2 The TSF shall provide authorised users with the capability to verify the integrity of
the configuration data.
FPT_TST.1.3 The TSF shall provide authorised users with the capability to verify the integrity of
stored TSF executable code.
Lexmark Multi-Function Printers with Hard Drives Security Target
41
6.1.7 TOE Access (FTA)
6.1.7.1 FTA_SSL.3 TSF-Initiated Termination
FTA_SSL.3.1 The TSF shall terminate an interactive session after a period of time configured by
an authorized administrator for touch panel and web browser sessions.
6.1.8 Trusted Path/Channels (FTP)
6.1.8.1 FTP_ITC.1 Inter-TSF Trusted Channel
FTP_ITC.1.1 The TSF shall provide a communication channel between itself and another trusted
IT product that is logically distinct from other communication channels and provides assured
identification of its end points and protection of the channel data from modification or
disclosure.
FTP_ITC.1.2 The TSF shall permit the TSF, another trusted IT product to initiate
communication via the trusted channel.
FTP_ITC.1.3 The TSF shall initiate communication via the trusted channel for communication
of D.DOC, D.FUNC, D.PROT, and D.CONF over any Shared-medium Interface.
Application Note: For this TOE, the network interface is the only shared-medium interface. The TSF requires all IP datagrams
entering or leaving the box to use IPSec with ESP (other than the ISAKMP/IKE datagrams used to set up the
security associations). If an incoming IP datagram does not satisfy this rule, the TSF attempts to establish a
security association with the remote IT system that originated the datagram.
6.2 TOE Security Assurance Requirements
The TOE meets the assurance requirements for EAL3 augmented by ALC_FLR.3. These
requirements are summarized in the following table.
Table 22 - EAL3+ Assurance Requirements
Assurance Class Component ID Component Title
Development ADV_ARC.1 Security architecture description
ADV_FSP.3 Functional specification with
complete summary
ADV_TDS.2 Architectural design
Guidance Documents AGD_OPE.1 Operational user guidance
AGD_PRE.1 Preparative procedures
Life-Cycle Support ALC_CMC.3 Authorisation controls
ALC_CMS.3 Implementation representation
CM coverage
ALC_DEL.1 Delivery procedures
ALC_DVS.1 Identification of security
measures
ALC_FLR.3 Systematic flaw remediation
ALC_LCD.1 Developer defined life-cycle
model
Tests ATE_COV.2 Analysis of coverage
ATE_DPT.1 Testing: basic design
ATE_FUN.1 Functional testing
ATE_IND.2 Independent testing - sample
Vulnerability Assessment AVA_VAN.2 Vulnerability analysis
Lexmark Multi-Function Printers with Hard Drives Security Target
42
6.3 CC Component Hierarchies and Dependencies
This section of the ST demonstrates that the identified SFRs include the appropriate hierarchy
and dependencies. The following table lists the TOE SFRs and the SFRs each are hierarchical
to, dependent upon and any necessary rationale.
Table 23 - TOE SFR Dependency Rationale
SFR Hierarchical To Dependency Rationale
FAU_GEN.1 No other components. FPT_STM.1 Satisfied
FAU_GEN.2 No other components. FAU_GEN.1,
FIA_UID.1
Satisfied
Satisfied
FCS_CKM.1 No other components. [FCS_CKM.2
or
FCS_COP.1],
FCS_CKM.4
Satisfied
Satisfied
FCS_CKM.4 No other components. [FDP_ITC.1 or
FDP_ITC.2, or
FCS_CKM.1] Satisfied
FCS_COP.1 No other components. [FDP_ITC.1 or
FDP_ITC.2, or
FCS_CKM.1],
FCS_CKM.4
Satisfied
Satisfied
FDP_ACC.1 No other components. FDP_ACF.1 Satisfied
FDP_ACF.1 No other components. FDP_ACC.1,
FMT_MSA.3
Satisfied
Satisfied
FDP_RIP.1 No other components. None n/a
FIA_AFL.1 No other components. FIA_UAU.1 Satisfied
FIA_ATD.1 No other components. None n/a
FIA_UAU.1 No other components. FIA_UID.1 Satisfied
FIA_UAU.7 No other components. FIA_UAU.1 Satisfied
FIA_UID.1 No other components. None n/a
FIA_USB.1 No other components. FIA_ATD.1 Satisfied
FMT_MSA.1 No other components. [FDP_ACC.1
or FDP_IFC.1],
FMT_SMF.1
FMT_SMR.1
Satisfied
Satisfied
Satisfied
FMT_MSA.3 No other components. FMT_MSA.1,
FMT_SMR.1
Satisfied
Satisfied
FMT_MTD.1 No other components. FMT_SMF.1,
FMT_SMR.1
Satisfied
Satisfied
FMT_SMF.1 No other components. None n/a
FMT_SMR.1 No other components. FIA_UID.1 Satisfied
FPT_FDI_EXP.1 No other components. FMT_SMF.1,
FMT_SMR.1
Satisfied
Satisfied
FPT_STM.1 No other components. None n/a
FPT_TST.1 No other components. None n/a
FTA_SSL.3 No other components. None n/a
FTP_ITC.1 No other components. None n/a
Lexmark Multi-Function Printers with Hard Drives Security Target
43
7. TOE Summary Specification
7.1 Security Functions
7.1.1 Audit Generation
The TOE generates audit event records for security-relevant events. A severity level is
associated with each type of auditable event; only events at or below the severity level
configured by an administrator are generated.
Each record format follows the syslog format defined in the Berkeley Software Distribution
(BSD) Syslog Protocol (RFC 3164). The TOE supplies the PRI, HEADER, MSG/TAG, and
MSG/CONTENT fields for all messages. The CONTENT portion may contain the following
fields (in order, separated by commas):
 Event Number
 ISO 8601 time ([YYYY-MM-DD]T[hh:mm:ss])
 Severity
 Process (same as TAG)
 Remote IPv4 address
 Remote IPv6 address
 Remote Hostname
 Remote Port
 Local Port
 Authentication/Authorization method
 Username
 Setting ID
 Setting’s old and new values
 Event name
 Event data
The time field is supplied by the TOE if internal time is configured by an administrator or by an
NTP server if external time is configured.
Fields in the CONTENT section that are not relevant for specific events are blank. The remote
IPv4 address, remote IPv6 address, remote hostname, remote port, and local port fields are
always blank for events resulting from actions at the MFP (e.g. usage of the touch panel). The
events that cause audit records to be generated are specified in section 6.1.1.1 .
As audit event records are generated, they are forwarded to the remote syslog IT system
configured by an administrator.
Lexmark Multi-Function Printers with Hard Drives Security Target
44
7.1.2 Identification and Authentication
Users are required to successfully complete the I&A process before they are permitted to access
any restricted data or functionality. The set of restricted user functionality is under the control of
the administrators, with the exception of submission of network print jobs which is always
allowed.
A new session is established for the touch panel when the system boots and for web sessions
when the connection is established. All sessions are initially bound to the Guest (default) user.
In the evaluated configuration, the Guest user has no access to restricted functions or data.
Users must log in as a different user in order to gain access to TOE functionality. Multiple login
mechanisms are supported in the evaluated configuration: Smart Card authentication,
Username/Password Accounts and LDAP+GSSAPI.
For Smart Card authentication, no functions at the touch panel are allowed until I&A
successfully completes. The touch panel displays a message directing the user to insert a card
into the attached reader. Once a card is inserted, the user is prompted for a PIN. When the PIN
is entered, only asterisks (“*”) or dots (“●”) are displayed. Once the PIN is collected (indicated
by the user touching the Next button), the TOE passes the PIN to the card for validation. If it is
not valid, a message is displayed on the touch panel and the user is asked to re-enter the PIN.
After the card-configured number of consecutive invalid PINs, the card will lock itself until
unlocked by a card administrator.
Upon successful card validation, the TOE forwards the certificate from the card to the configured
Kerberos Key Distribution Center (Windows Domain Controller) for validation. If the certificate
validation is not successful, an error message is displayed on the touch panel until the current
card is removed from the reader. If the certificate validation is successful, the TOE binds the
username, account name, and email address (all obtained from the LDAP server to the user
session for future use. The group memberships for the user are also retrieved from the LDAP
server and, for each group that matches a configured group in the TOE, the permissions for the
group are merged to determine the overall permissions for the user session. An audit record for
the successful authentication is generated.
For Username/Password Accounts and LDAP+GSSAPI, the TOE collects a username and
password via the touch panel or via the browser session. When the password is entered, only
asterisks (“*”) are displayed. Once the username and password are collected, the next step in the
process depends on the I&A mechanism being used.
For Username/Password Accounts, the TOE performs the validation of the username and
password against the set of configured Username/Password Accounts. If the validation fails
because of an invalid password (for a valid username), the count of failed authentication attempts
is incremented for that account. If the threshold for failed attempts within a time period is
reached, then the account is marked as being locked for the configured amount of time to
mitigate against brute force password attacks. This information is tracked in memory and is not
maintained across a restart of the TOE.
For LDAP+GSSAPI, the TOE forwards the username and password to the configured LDAP
server for validation (using the configured machine credentials) and waits for the response. If no
response is received, the validation is considered to have failed.
Lexmark Multi-Function Printers with Hard Drives Security Target
45
In the case of failed validations, an error message is displayed via the touch panel or browser
session, and then the display returns to the previous screen for further user action. An audit
record for the failed authentication attempt is generated.
If validation is successful, the TOE binds the username, password, account name, and email
address to the user session for future use. An audit record for the successful authentication is
generated.
Permissions for the user session are determined from group memberships. For
Username/Password accounts, the permissions for each group that the user is a member of (as
specified in the account configuration) are combined. For Smart Cards and LDAP+GSSAPI, a
list of group memberships are retrieved from the LDAP server. For each of those groups that
match a group configured in the TOE, the permissions are combined.
The user session is considered to be active until the user explicitly logs off, removes the card or
the administrator-configured inactivity timer for sessions expires. If the inactivity timer expires,
an audit record is generated.
7.1.2.1 Active Directory
If Active Directory parameters are supplied and Join is selected, the parameter values are used to
join the Active Directory Domain. If successful, machine credentials are generated and the
LDAP+GSSAPI configuration parameters are automatically updated with the Domain and
machine information.
Once the Domain has been joined, subsequent I&A attempts may use the LDAP+GSSAPI
configuration to validate user credentials using the newly-created machine credentials as
described above. The credentials specified for Active Directory by an authorized administrator
are not saved.
7.1.3 Access Control
Access control validates the user access request against the user’s permissions configured by
administrators for specific FACs. Users of the TOE, whether accessing the TOE via the touch
panel or web interface, are considered to be in one or more of the following categories:
 Authorized Users – permitted to perform one or more of the MFP user functions defined
in section 1.6.2.3
 Authorized Administrators – permitted to access administrative functionality for control
and monitoring of the MFP operation
 Any Users – the Guest account as well as Authorized Users and Authorized
Administrators
Permissions may be configured for the following items:
Table 24 - Access Control Items
Item Description Comment
Address Book Controls the ability to manage the
Address Book contents.
Permission may only be granted to
authorized administrators in the evaluated
configuration
Lexmark Multi-Function Printers with Hard Drives Security Target
46
Item Description Comment
Apps Configuration Controls access to the configuration of
any installed applications
Permission may only be granted to
authorized administrators in the evaluated
configuration.
B/W Print Controls the ability to print black and
white jobs.
Permission may only be granted to
authorized users in the evaluated
configuration
Cancel Jobs at the device Controls access to the functionality to
cancel jobs via the touch panel.
Permission may only be granted to
authorized users in the evaluated
configuration
Change Language from
Home Screen
Controls access to the Change Language
button on the Home screen (when
displayed); this button is NOT displayed
by default but a user can activate it via
the “General Settings Menu”
Permission may be granted to any users,
including Guest
Color Dropout Controls a user’s ability to activate the
Color Dropout functionality as part of a
job; if protected and the user fails to
authenticate, then the device DOES NOT
use the color dropout functionality in the
job
Permission may only be granted to
authorized users in the evaluated
configuration
Color Print Controls the ability to print color jobs. Permission may only be granted to
authorized users in the evaluated
configuration
Copy Color Printing Controls a user’s ability to copy content
in color
Permission may only be granted to
authorized users in the evaluated
configuration
Copy Function Controls a user’s access to the Copy
functionality
Permission may only be granted to
authorized users in the evaluated
configuration
Create Profiles Controls the ability to create scan
profiles from remote systems.
Permission must not be specified for any
user
Device Menu Controls access to the Device
administrative menu
Permission may only be granted to
authorized administrators in the evaluated
configuration
E-mail Function Control’s a user’s access to the Email
functionality (scan to email)
Permission may only be granted to
authorized users in the evaluated
configuration
Fax Function Control’s a user’s ability to perform a
scan to fax job
Note that when “Disabled” via fax
configuration, all analog faxing (scan
send, receive, and driver send) and the
fax server are disabled. The fax icon is
never displayed.
Permission may only be granted to
authorized users in the evaluated
configuration
Firmware Updates Controls a user’s ability to update the
device’s firmware code via the network
Permission may only be granted to
authorized administrators in the evaluated
configuration
Flash Drive Color
Printing
Controls whether USB interfaces may be
used for color print operations
Permission must not be specified for any
user
Flash Drive Print Controls whether USB interfaces may be
used for black and white print operations
Permission must not be specified for any
user
Lexmark Multi-Function Printers with Hard Drives Security Target
47
Item Description Comment
Flash Drive Scan Controls whether USB interfaces may be
used for scan operations
Permission must not be specified for any
user
FTP Function Controls a user’s ability to access the
FTP button on the Home Screen (when
displayed).
Permission must not be specified for any
user
Function Configuration
Menus
Controls access to the configuration
menus for the print, copy, fax, e-mail
and FTP functions.
Permission may only be granted to
authorized administrators in the evaluated
configuration
Held Jobs Access Controls access to the Held jobs menu Permission may only be granted to
authorized users in the evaluated
configuration
Import/Export Settings Controls the ability to import and export
configuration files
Permission may only be granted to
authorized administrators in the evaluated
configuration
Internet Printing Protocol
(IPP)
Controls access to print job submission
via IPP
Permission must not be specified for any
user
Manage Bookmarks Controls access to the Delete Bookmark,
Create Bookmark, and Create Folder
buttons from both the bookmark list
screen and from the individual bookmark
screen
Permission must not be specified for any
user
Manage Shortcuts Controls access to the Manage Shortcuts
Menu
Permission must not be specified for any
user
Network/Ports Menu Controls access to the Network/ Ports
Menu
Permission may only be granted to
authorized administrators in the evaluated
configuration
New Apps Controls access to configuration
parameters for apps subsequently added
to the device.
Permission may only be granted to
authorized administrators in the evaluated
configuration
Operator Panel Lock Controls access to the “Lock Device”
and “Unlock Device” buttons
Permission may only be granted to
authorized users in the evaluated
configuration
Option Card Menu Controls a user’s ability to access the
“Option Card Menu” that displays menu
nodes associated with installed DLEs
Permission may only be granted to
authorized administrators in the evaluated
configuration
Out of Service Erase Controls the ability to wipe the storage
of the MFP when it is being taken out of
service.
Permission may only be granted to
authorized administrators in the evaluated
configuration
Paper Menu Controls access to the Paper Menu Permission may be granted to any users,
including Guest
Release Held Faxes Controls access to the Held Faxes button
and the Release Held Faxes button on
the Home screen
Permission may only be granted to
authorized administrators in the evaluated
configuration
Remote Management Controls whether or not management
functions may be invoked from remote
IT systems
Permission must not be specified for any
user
Reports Menu Controls access to the Reports Menu.
This includes information about user
jobs, which can’t be disclosed to non-
administrators.
Permission may only be granted to
authorized administrators in the evaluated
configuration
Lexmark Multi-Function Printers with Hard Drives Security Target
48
Item Description Comment
Search Address Book Controls access to the Search Address
Book button that appears as part of the
E-mail, FTP, and Fax functions that are
available from the panel’s Home screen
Permission may be granted to any users
Security Menus Controls access to the Security Menu Permission may only be granted to
authorized administrators in the evaluated
configuration
Supplies Menus Controls access to the Security Menu Permission may only be granted to
authorized administrators in the evaluated
configuration
Use Profiles Controls a user’s ability to execute any
profile
Permission must not be specified for any
user
Authorization is restricted by not associating a permission with a FAC.
When the FAC is a menu, access is also restricted to all submenus (a menu that is normally
reached by navigating through the listed item). This is necessary for instances where a shortcut
could bypass the listed menu. If a shortcut is used to access a sub-menu, the access control
check for the applicable menu item is still performed (as if normal menu traversal was being
performed).
When a function is restricted, the access control function determines if the user has permission to
access the function. Normally the icons for the functions the user is not permitted to access are
not displayed in the GUI.
The following table summarizes the access controls and configuration parameters used by the
TOE to control user access to the MFP functions provided by the TOE. Additional details for
each function are provided in subsequent sections.
Table 25 - TOE Function Access Control SFP Rules
Object Access Control Rules Configuration Parameter Rules
F.PRT Network print jobs can always be submitted.
The job is held until released by a user who
is authorized for the Access Held Jobs
function and has the same userid as was
specified in the SET USERNAME PJL
statement. Network print jobs without a PJL
SET USERNAME statement are
automatically deleted after the expiry period
for held jobs.
Allowed for incoming faxes if the user has
permission to access Release Held Faxes.
Allowed
Allowed if the “Enable Fax Receive” or
“Enable Analog Receive” parameter is “On”.
F.SCN Allowed for fax if the user has permission to
access Fax Function
Allowed for copying if the user has
permission to access Copy Function
Allowed if the “Enable Fax Scans”
parameter is On and the “Fax Mode”
parameter is “Analog Fax”
Allowed
Lexmark Multi-Function Printers with Hard Drives Security Target
49
Object Access Control Rules Configuration Parameter Rules
Allowed for emailing if the user has
permission to access Email Function
Allowed
F.CPY Allowed if the user has permission to access
Copy Function
In addition, B&W printing is allowed if the
user has permission to access B&W Printing;
color copying is allowed if the user has
permission to access Copy Color Printing
Allowed
Allowed
F.FAX Incoming faxes are not subject to access
control. All incoming faxes are held until
released by a user who has permission to
access Release Held Faxes
Allowed for outgoing fax if the user has
permission to access Fax Function
Allowed if the “Enable Fax Receive” or
“Enable Analog Receive” parameter is “On”.
Allowed
F.SMI Allowed provided the user has permission to
access the function
Allowed
7.1.3.1 Printing
Submission of print jobs from users on the network is always permitted. Jobs that do not contain
a PJL SET USERNAME statement are discarded after the configured held jobs expiry period.
Submitted jobs are always held on the TOE until released or deleted by a user authorized for the
appropriate access control and whose userid matches the username specified when the job was
submitted. Users are able to display the queue of their pending print jobs. If a held job is not
released within the configured expiration time, the job is automatically deleted.
7.1.3.2 Scanning (to Fax or Email)
Scanning may be performed as part of a fax or email function. Only authorized users may
perform scans.
The destination of the fax scan is determined by the setting of the “Fax Mode” configuration
parameter. If it is configured for “Analog Fax” then the scanned data is transmitted out the
phone line as a fax. If it is configured for “Fax Server” then the scanned data is forwarded to the
configured email server via SMTP.
Scanning for fax is allowed if the Enable Fax Scans configuration parameter is “On” and the user
is authorized for the Fax Function access control.
Scanning for email is allowed if the user is authorized for the E-mail Function access control.
7.1.3.3 Copying
Copying is allowed if the user is authorized for the Copy Function access control. A user may
view or delete their own copy jobs queued for printing.
7.1.3.4 Incoming Fax
Incoming faxes are allowed if the “Enable Fax Receive” (for analog fax mode) or “Enable Fax
Receive” (for fax server mode) configuration parameter is “On”.
Lexmark Multi-Function Printers with Hard Drives Security Target
50
Incoming faxes are always held in the queue (until released) in the evaluated configuration.
Only users authorized for the Release Held Faxes access control may release or delete the faxes.
7.1.3.5 Shared-medium Interface
The TOE supports scanning to an external SMTP server via the network interface. When fax
functionality is enabled and the “Fax Mode” is configured for “Fax Server” outgoing faxes are
converted to a file and attached to outgoing SMTP messages. Administrators require access to
the Security Menu to configure the Fax Function access control and the Device Menu to
configure the fax server parameters.
7.1.3.6 Postscript Access Control
In the evaluated configuration, the setdevparams, setsysparams and setuserparams Postscript
operators are made non-operational so that the Postscript DataStream can not modify
configuration settings in the TOE.
7.1.4 Management
The TOE provides the ability for authorized administrators to manage TSF data from remote IT
systems via a browser session or locally via the touch panel. Authorization is granular, enabling
different administrators to be granted access to different TSF data. When an administrator
modifies TSF data, an audit record is generated.
7.1.5 Fax Separation
The Fax Separation security function assures that the information on the TOE, and the
information on the network to which the TOE is attached, is not exposed through the phone line
that provides connectivity for the fax function. This function assures that only printable
documents are accepted via incoming fax connections, and that the only thing transmitted over
an outgoing fax connection (in the evaluated configuration) is a document that was scanned for
faxing.
In the evaluated configuration, the USB ports capable of being used for document input are
disabled and the ability to submit jobs via the network interface to be sent out the fax interface is
disabled. Therefore, the only source for outgoing fax transmissions is the scanner. Control of the
fax functionality is incorporated directly into the TOE’s firmware. The modem chip is in a mode
that is more restrictive than Class 1 mode (the fax modem will not answer a data call), and relies
on the TOE firmware for composition and transmission of fax data. The TOE firmware explicitly
disallows the transmission of frames in data mode and allows for the sending and receiving of
facsimile jobs only. There is no mechanism by which telnet, FTP, or other network protocols can
be used over the analog fax line.
The fax modem is on a separate card from the network adapter to provide separation between the
interfaces and is only capable of sending and receiving fax data. The modem and the network
adapter are incapable of communicating directly with one another. The modem is designed only
for fax communications, thus preventing any type of remote configuration or management of the
TOE over the fax line.
7.1.6 Hard Disk Encryption
All user data saved on the Hard Disk is encrypted using 256-bit AES. The types of data saved on
the Hard Disk (and therefore encrypted) include buffered job data, held jobs, images referenced
Lexmark Multi-Function Printers with Hard Drives Security Target
51
by other jobs, and macros. The contents of each file are automatically encrypted as they are
written to the Hard Disk and automatically decrypted when the contents are read. This security
function is intended to protect against data disclosure if a malicious agent is able to gain physical
possession of the Hard Disk. This security function operates transparently to users and is always
enabled in the evaluated configuration.
An RBG function conforming to NIST SP 800-90A using CTR_DRBG(AES) is used to generate
the 256-bit AES key for disk encryption. Entropy is provided by the Secure Element in the
operational environment.
A common key is used to encrypt all files. The key is generated using the internal random
number generator when this function is enabled during installation. The key is saved in internal
non-volatile random access memory (NVRAM), enabling information on the hard disk to be
decrypted across reboots. The key is zeroized by overwriting once with zeros if this function is
disabled.
The encryption key is specific to the MFP and hard disk. All user data files on the hard disk will
be lost as a result of the following actions:
1. Disabling the hard disk encryption feature - the encryption key is zeroized.
2. Enabling the hard disk encryption feature when it is already enabled - a new encryption
key is generated; the previous key is zeroized.
7.1.7 Disk Wiping
In the evaluated configuration, the TOE is configured to perform automatic disk wiping with a
multi-pass method. Files containing user data are stored on the internal hard drive until they are
no longer needed. At that time, they are logically deleted and marked as needing to be wiped.
Until the wiping occurs, the disk blocks containing the files are not available for use by any user.
Every 5 seconds, the TOE checks to see if any “deleted” files are present and begins the disk
wiping process.
The TOE overwrites each block associated with each deleted file (including bad and remapped
sectors) three times: first with “0x0F” (i.e. 0000 1111), then with “0xF0” (i.e. 1111 0000), and
finally with a block of random data (supplied by the internal random number generator). Each
time that the device wipes a different file, it selects a different block of random data. This
method is compliant with NIST SP800-88 and the DSS "Clearing and Sanitization Matrix"
(C&SM).
Once the disk wiping is complete, the disk blocks used for the deleted files are once again
available for use by the system. If the disk wiping process is interrupted by a power cycle or
reset, the status is remembered across the restart and the process resumes when operation
resumes.
If any error occurs during the disk wiping process, an audit record is generated and the file
system is considered to be corrupt and must be re-initialized.
The TOE also overwrites RAM with a fixed pattern upon deallocation of any buffer used to hold
user data.
Lexmark Multi-Function Printers with Hard Drives Security Target
52
7.1.8 Secure Communications
During TOE installation, a 2048-bit self-signed certificate for the device is generated in
accordance with NIST SP 800-56B (“Recommendation for Pair-Wise Key Establishment
Schemes Using Integer Factorization Cryptography” for RSA- based key establishment
schemes). An RBG function conforming to NIST SP 800-90A using CTR_DRBG(AES) is used
to generate the asymmetric key pair. Entropy is provided by the Secure Element that is part of
the operational environment.
IPSec with ESP is required for all network datagram exchanges with remote IT systems. IPSec
provide confidentiality, integrity and authentication of the endpoints. Supported encryption
options for ESP are AES-CBC-128 and AES-CBC-256. SHA-1, SHA-256 and SHA-384 are
supported for HMACs.
ISAKMP and IKE v1 or v2 are used to establish the Security Association (SA) and session keys
for the IPSec exchanges. Diffie-Hellman is used for IKE Key Derivation Function as specified
in RFC2409, using Oakley Groups 14 or 24. This session key is stored in RAM. During the
ISAKMP exchange, the TOE requires the remote IT system to provide a certificate and the RSA
signature for it is validated, or text-based Pre-Shared Keys (PSKs) may be configured by
administrators and validated between endpoints. PSKs configured in the system are conditioned
using SHA-1, SHA-256 or SHA-384. The key size specified in the SA exchange may be 128 or
256 bits, the encryption algorithm is AES-CBC, and the Hash Authentication Algorithm is SHA-
1, SHA-256 or SHA-384.
If an incoming IP datagram does not use IPSec with ESP, the datagram is discarded.
Since all incoming traffic must use IPsec, this mechanism also provides reliability for external
time sources if they are configured to be used.
If external accounts are defined, LDAP+GSSAPI is used for the exchanges with the LDAP
server. Kerberos v5 with AES encryption is supported for exchanges with the LDAP server.
All session keys are stored in dynamic RAM. The TOE zeroizes the session keys by overwriting
once with zeros when the sessions are terminated.
7.1.9 Self Test
During initial start-up, the TOE performs self tests on the cryptographic components. The
integrity of the configuration data is also verified. The integrity of the stored TSF executable
code is verified by calculating a hash of the executable code and comparing it to a saved value.
If any problems are detected with the hardware or stored TSF executable code, an appropriate
error message is posted on the touch screen and operation is suspended. If a problem is detected
with the integrity of the configuration data, the data is reset to the factory default, an audit log
record is generated, an appropriate error message is posted on the touch screen, and further
operation is suspended. In this case, a system restart will result in the system being operational
with the factory default settings for the data.
7.1.10 Deviations From Allowed Cryptographic Standards
The following deviations from the Allowed Cryptographic Standards in 188 Scheme Crypto
Policy are noted:
Lexmark Multi-Function Printers with Hard Drives Security Target
53
1. Hashing: SHA-1 is supported for backward compatibility with remote systems and for
conditioning of PSKs.
2. HMAC: 160 bit keys with SHA-1 is supported for backward compatibility with remote
systems.
7.1.11 Cryptographic Functionality Provided by the Operational Environment
The Secure Element incorporates an Infineon Smart Card IC M9900. The M9900 provides a
True Random Number Generator (TRNG) used by the TOE for seeding of the random number
generator in the TOE.
TOE firmware executing on the Main Processor Board of the MFP accesses a socket at
"/var/run/egd-pool" to obtain entropy bits. When the available data in this pool drops below 64
bytes, the TOE sends the Random Number Generate (CMD ID = 0x0001) command to the
Secure Element.
The command is processed by the Lexmark firmware executing on the Secure Element. When a
Random Number Generate command is received, the firmware uses the Infineon function call
IFX_ReadTrng to obtain more entropy data from the physical random number generator of the
M9900. The entropy data is returned to the Main Processor Board by the Lexmark firmware and is
then added to the data available from /var/run/egd-pool.
The average Shannon entropy per internal random bit of the TRNG exceeds 0.997.
Lexmark Multi-Function Printers with Hard Drives Security Target
54
8. Protection Profile Claims
This chapter provides detailed information in reference to the Protection Profile conformance
identification that appears in Chapter 2.
8.1 TOE Type Consistency
Both the PP and the TOE describe Hard Copy Devices.
8.2 Security Problem Definition Consistency
This ST claims demonstrable conformance to the referenced PP.
All of the assumptions, threats, and organizational security policies of the PP are included in the
ST. One additional assumption (A.IPSEC) is included in the ST, resulting in the ST being more
restrictive than the PP.
8.3 Security Objectives Consistency
This ST claims demonstrable conformance to the referenced PP.
All of the security objectives for the TOE and the operational environment (IT and non-IT) of the
PP are included in the ST. The following additional security objectives are included in the ST:
1. O.I&A
2. O.MANAGE
3. O.TIME_STAMP
4. OE.I&A
5. OE.IPSEC
6. OE.TIME_STAMP
Therefore, the ST is more restrictive than the PP.
8.4 Security Functional Requirements Consistency
This ST claims demonstrable conformance to the referenced PP.
All of the SFRs from the claimed SFR packages are included in the ST with any fully or partially
completed operations from the PP. Any remaining operations have been completed. The
following notes apply to conformance of the SFRs in the ST.
1. The auditable events listed in the table with FAU_GEN.1 have been enumerated to match
the specific events generated by the TOE. All of the events required by the PP are
represented along with additional events.
2. SFRs from the FCS class have been added to the ST to address cryptographic
functionality for IPSec and disk encryption, which are additions to the security
functionality required by the PP.
3. FDP_ACC.1(a) and FDP_ACF.1(a) have been integrated with the individual instances of
FDP_ACC.1 and FDP_ACF.1 from the applicable SFR packages of the PP into a single
instance of FDP_ACC.1 and FDP_ACF.1 (still named Common Access Control SFP)
that addresses all of the access control policies.
Lexmark Multi-Function Printers with Hard Drives Security Target
55
4. FIA_AFL.1 has been added to the ST to address to address authentication failure
handling per application note 36 in the PP.
5. FIA_UAU.7 has been added to the ST to address to address protected authentication
feedback per application note 36 in the PP.
6. FMT_MSA.1(a) and FMT_MSA.1(b) from the PP were combined into a single instance
of FMT_MSA.1 since all the completed operations were identical.
7. FMT_MSA.3(a) and FMT_MSA.3(b) from the PP were combined into a single instance
of FMT_MSA.3 since all the completed operations were identical.
8. FMT_MTD.1(a) and FMT_MTD.1(b) from the PP were combined into a single instance
of FMT_MTD.1. Users (U.NORMAL) do not have any access to TSF data, and it was
necessary to provide permission-level granularity of the administrator role for various
TSF data access. Given these conditions, it was simpler to combine the instances of
FMT_MTD.1 in the ST. In addition, Create was added as an operation in order to
distinguish between creation and modification of entities.
9. For FMT_SMR.1, the TOE provides greater granularity of roles (based on individual
permissions) than is required by the PP. The permission-based description has been
provided in the ST, and an application note with the SFR defines the relationship between
those permissions and the roles defined by the PP.
10. The instance of the FAU_GEN.1 in the SMI package has been integrated with the
instance of FAU_GEN.1 in the common requirements.
8.5 Security Assurance Requirements Consistency
The ST assurance claims are identical to the assurance claims of the PP.
Lexmark Multi-Function Printers with Hard Drives Security Target
56
9. Rationale
This chapter provides the rationale for the selection of the IT security requirements, objectives,
assumptions and threats. It shows that the IT security requirements are suitable to meet the
security objectives, Security Requirements, and TOE security functional.
9.1 Rationale for IT Security Objectives
This section of the ST demonstrates that the identified security objectives are covering all aspects
of the security needs. This includes showing that each threat, policy and assumption is addressed
by a security objective.
The following table identifies for each threat, policy and assumption, the security objective(s)
that address it.
Table 26 - Threats, Policies and Assumptions to Security Objectives Mapping
O.AUDIT.LOGGED
O.CONF.NO_ALT
O.CONF.NO_DIS
O.DOC.NO_ALT
O.DOC.NO_DIS
O.FUNC.NO_ALT
O.INTERFACE.MANAGED
O.I&A
O.MANAGE
O.PROT.NO_ALT
O.SOFTWARE.VERIFIED
O.TIME_STAMP
O.USER.AUTHORIZED
OE.ADMIN.TRAINED
OE.ADMIN.TRUSTED
OE.AUDIT.REVIEWED
OE.AUDIT_ACCESS.AUTHORIZED
OE.AUDIT_STORAGE.PROTECTED
OE.I&A
OE.IPSEC
OE.INTERFACE.MANAGED
OE.PHYSICAL.MANAGED
OE.TIME_STAMP
OE.USER.AUTHORIZED
OE.USER.TRAINED
OE.VIPER
A.ACCESS.MANAG
ED
X
A.ADMIN.TRAININ
G
X
A.ADMIN.TRUST X
A.IPSEC X
A.USER.TRAINING X
A.VIPER X
T.CONF.ALT X X X X X
T.CONF.DIS X X X X X
T.DOC.ALT X X X X X
T.DOC.DIS X X X X X
T.FUNC.ALT X X X X X
T.PROT.ALT X X X X X
P.AUDIT.LOGGING X X X X X X
P.INTERFACE.MA
NAGEMENT
X X
P.SOFTWARE.VERI
FICATION
X
P.USER.AUTHORIZ
ATION
X X X X X
Lexmark Multi-Function Printers with Hard Drives Security Target
57
9.1.1 Rationale Showing Threats to Security Objectives
The following table describes the rationale for the threat to security objectives mapping.
Table 27 - Threats to Security Objectives Rationale
T.TYPE Security Objectives Rationale
T.CONF.ALT O.CONF.NO_ALT – The objective addresses the threat by requiring the TOE to
protect against unauthorized alteration of TSF Confidential Data.
O.I&A and OE.I&A – The objectives help address the threat by requiring I&A
mechanisms so that appropriate authorizations may be associated with users.
O.USER.AUTHORIZED and OE.USER.AUTHORIZED – The objectives help
address the threat by requiring authorizations to be specified for users.
T.CONF.DIS O.CONF.NO_DIS - The objective addresses the threat by requiring the TOE to
protect against unauthorized disclosure of TSF Confidential Data.
O.I&A and OE.I&A – The objectives help address the threat by requiring I&A
mechanisms so that appropriate authorizations may be associated with users.
O.USER.AUTHORIZED and OE.USER.AUTHORIZED – The objectives help
address the threat by requiring authorizations to be specified for users.
T.DOC.ALT O.DOC.NO_ALT - The objective addresses the threat by requiring the TOE to
protect against unauthorized alteration of User Document Data.
O.I&A and OE.I&A – The objectives help address the threat by requiring I&A
mechanisms so that appropriate authorizations may be associated with users.
O.USER.AUTHORIZED and OE.USER.AUTHORIZED – The objectives help
address the threat by requiring authorizations to be specified for users.
T.DOC.DIS O.DOC.NO_DIS - The objective addresses the threat by requiring the TOE to
protect against unauthorized disclosure of User Document Data.
O.I&A and OE.I&A – The objectives help address the threat by requiring I&A
mechanisms so that appropriate authorizations may be associated with users.
O.USER.AUTHORIZED and OE.USER.AUTHORIZED – The objectives help
address the threat by requiring authorizations to be specified for users.
T.FUNC.ALT O.FUNC.NO_ALT - The objective addresses the threat by requiring the TOE to
protect against unauthorized alteration of User Function Data.
O.I&A and OE.I&A – The objectives help address the threat by requiring I&A
mechanisms so that appropriate authorizations may be associated with users.
O.USER.AUTHORIZED and OE.USER.AUTHORIZED – The objectives help
address the threat by requiring authorizations to be specified for users.
T.PROT.ALT O.PROT.NO_ALT - The objective addresses the threat by requiring the TOE to
protect against unauthorized alteration of TSF Protected Data.
O.I&A and OE.I&A – The objectives help address the threat by requiring I&A
mechanisms so that appropriate authorizations may be associated with users.
O.USER.AUTHORIZED and OE.USER.AUTHORIZED – The objectives help
address the threat by requiring authorizations to be specified for users.
9.1.2 Rationale Showing Policies to Security Objectives
The following table describes the rationale for the policy to security objectives mapping.
Lexmark Multi-Function Printers with Hard Drives Security Target
58
Table 28 - Policies to Security Objectives Rationale
P.TYPE Security Objectives Rationale
P.AUDIT.LOGGING O.AUDIT.LOGGED – The objective addresses the first part of the policy by
requiring the TOE to generate audit records for TOE usage and security-
relevant events, and to protect these records while they are inside the TSC.
O.TIME_STAMP – The objective supports the policy by requiring the TOE to
provide time stamps for the audit records when time is being tracked internally.
OE.AUDIT.REVIEWED – The objective addresses the audit review portion of
the policy by requiring timely review of the generated audit records.
OE.AUDIT_ACCESS.AUTHORIZED – The objective supports the policy by
requiring the operational environment to make the audit records available to
authorized personnel only.
OE.AUDIT_STORAGE.PROTECTED - The objective supports the policy by
requiring the operational environment to protect the stored audit records from
unauthorized access.
OE.TIME_STAMP - The objective supports the policy by requiring the TOE to
provide time stamps for the audit records when time is being supplied
externally.
P.INTERFACE.MA
NAGEMENT
O.INTERFACE.MANAGED – The objective addresses the policy by requiring
the TOE to enforce access to and usage of the TOE interfaces within the TSC.
OE.INTERFACE.MANAGED – The objective addresses the policy by
requiring the operational environment to control access to the TOE interfaces
within the operational environment.
P.SOFTWARE.VERI
FICATION
O.SOFTWARE.VERIFIED – The objective restates the policy.
P.USER.AUTHORIZ
ATION
O.I&A and OE.I&A – The objectives help address the policy by requiring I&A
mechanisms so that user authorizations may be restricted for users.
O.MANAGE – The objective addresses the policy by requiring the TOE to
provide management functions to administrators for configuration of user
authorizations.
O.USER.AUTHORIZED and OE.USER.AUTHORIZED – The objectives help
address the policy by requiring authorizations to be specified for users.
9.1.3 Rationale Showing Assumptions to Environment Security Objectives
The following table describes the rationale for the assumption to security objectives mapping.
Table 29 - Assumptions to Security Objectives Rationale
A.TYPE Security Objectives Rationale
A.ACCESS.MANAGED OE.PHYSICAL.MANAGED – The objective addresses the assumption by
requiring the TOE to be located in an area that restricts physical access.
A.ADMIN.TRAINING OE.ADMIN.TRAINED – The objective restates the assumption.
A.ADMIN.TRUST OE.ADMIN.TRUSTED – The objective addresses the assumption by
requiring trust to be established in the administrators.
A.IPSEC OE.IPSEC – All network systems with which the TOE communicates are
required to support IPSec with ESP.
A.USER.TRAINING OE.USER.TRAINED – The objective restates the assumption.
A.VIPER OE.VIPER – The objective restates the assumption.
Lexmark Multi-Function Printers with Hard Drives Security Target
59
9.2 Security Requirements Rationale
9.2.1 Rationale for Security Functional Requirements of the TOE Objectives
This section provides rationale for the Security Functional Requirements demonstrating that the
SFRs are suitable to address the security objectives.
The following table identifies for each TOE security objective, the SFR(s) that address it.
Table 30 - SFRs to Security Objectives Mapping
O.AUDIT.LOGGED
O.CONF.NO_ALT
O.CONF.NO_DIS
O.DOC.NO_ALT
O.DOC.NO_DIS
O.FUNC.NO_ALT
O.INTERFACE.MANAGED
O.I&A
O.MANAGE
O.PROT.NO_ALT
O.SOFTWARE.VERIFIED
O.TIME_STAMP
O.USER.AUTHORIZED
FAU_GEN.1 X
FAU_GEN.2 X
FCS_CKM.1(A) X X X X X X
FCS_CKM.1(B) X X X X X X
FCS_CKM.4 X X X X X X
FCS_COP.1 X X X X X X
FDP_ACC.1(A) X X X X
FDP_ACC.1(B) X X X
FDP_ACF.1(A) X X X X
FDP_ACF.1(B) X X X
FDP_RIP.1 X
FIA_AFL.1 X
FIA_ATD.1 X X
FIA_UAU.1 X X X
FIA_UAU.7 X
FIA_UID.1 X X X X X X X X X X
FIA_USB.1 X X
FMT_MSA.1 X X X X X
FMT_MSA.3 X X X X X
FMT_MTD.1 X X X X
FMT_SMF.1 X X X X X X X
FMT_SMR.1 X X X X X X X X
FPT_FDI_EXP.1 X X
FPT_STM.1 X X
FPT_TST.1 X
FTA_SSL.3 X X X
FTP_ITC.1 X X X X X X
The following table provides the detail of TOE security objective(s).
Lexmark Multi-Function Printers with Hard Drives Security Target
60
Table 31 - Security Objectives to SFR Rationale
Security
Objective
SFR and Rationale
O.AUDIT.LOGGED FAU_GEN.1 addresses the objective by requiring the TOE to generate audit
records for TOE usage and security relevant events.
FAU_GEN.2 helps address the objective by requiring the audit records to
include information associating a user with each event (if applicable).
FIA_UID.1 supports audit policies by associating user identity with events.
FPT_STM.1 supports audit policies by requiring time stamps associated with
events.
O.CONF.NO_ALT FCS_CKM.1(A), FCS_CKM.1(B), FCS_CKM.4 and FCS_COP.1 support the
objective by requiring the TOE to provide key management and cryptographic
functions to protect management interactions during network transmission.
FIA_UID.1 supports access control and security roles by requiring user
identification.
FMT_MTD.1 specifies the rules for altering TSF Confidential Data.
FMT_SMF.1 supports control of security attributes by requiring functions to
control attributes.
FMT_SMR.1 supports control of security attributes by requiring security roles.
FTP_ITC.1 addresses the objective by requiring the TOE to provide trusted
channels for the exchange of management traffic across the network.
O.CONF.NO_DIS FCS_CKM.1(A), FCS_CKM.1(B), FCS_CKM.4 and FCS_COP.1 support the
objective by requiring the TOE to provide key management and cryptographic
functions to protect management interactions during network transmission.
FIA_UID.1 supports access control and security roles by requiring user
identification.
FMT_MTD.1 specifies the rules for displaying TSF Confidential Data.
FMT_SMF.1 supports control of security attributes by requiring functions to
control attributes.
FMT_SMR.1 supports control of security attributes by requiring security roles.
FTP_ITC.1 addresses the objective by requiring the TOE to provide trusted
channels for the exchange of management traffic across the network.
O.DOC.NO_ALT FCS_CKM.1(A), FCS_CKM.1(B), FCS_CKM.4 and FCS_COP.1 support the
objective by requiring the TOE to provide key management and cryptographic
functions to protect the document data while transferred across the network.
FDP_ACC.1(A) and FDP_ACC.1(B) specify the subjects, objects and
operations that are controlled regarding User Document Data that must be
protected for unauthorized alteration.
FDP_ACF.1(A) and FDP_ACF.1(B) specify the security attributes and rules
used to determine whether access is permitted.
FIA_UID.1 supports access control and security roles by requiring user
identification.
FMT_MSA.1 and FMT_MSA.3 support the access control function by
enforcing control of security attributes and their defaults.
FMT_SMF.1 supports control of security attributes by requiring functions to
control attributes.
FMT_SMR.1 supports control of security attributes by requiring security roles.
FTP_ITC.1 addresses the objective by requiring the TOE to provide trusted
channels for the exchange of D.DOC across the network.
O.DOC.NO_DIS FCS_CKM.1(A), FCS_CKM.1(B), FCS_CKM.4 and FCS_COP.1 support the
objective by requiring the TOE to provide key management and cryptographic
functions to protect the document data while transferred across the network or
stored on the TOE’s hard disk.
Lexmark Multi-Function Printers with Hard Drives Security Target
61
Security
Objective
SFR and Rationale
FDP_ACC.1(A) and FDP_ACC.1(B) specify the subjects, objects and
operations that are controlled regarding User Document Data that must be
protected for unauthorized disclosure.
FDP_ACF.1(A) and FDP_ACF.1(B) specify the security attributes and rules
used to determine whether access is permitted.
FDP_RIP.1 supports the objective by requiring the TOE to make unavailable
any user document data when a user job completes.
FIA_UID.1 supports access control and security roles by requiring user
identification.
FMT_MSA.1 and FMT_MSA.3 support the access control function by
enforcing control of security attributes and their defaults.
FMT_SMF.1 supports control of security attributes by requiring functions to
control attributes.
FMT_SMR.1 supports control of security attributes by requiring security roles.
FTP_ITC.1 addresses the objective by requiring the TOE to provide trusted
channels for the exchange of D.DOC across the network.
O.FUNC.NO_ALT FCS_CKM.1(A), FCS_CKM.1(B), FCS_CKM.4 and FCS_COP.1 support the
objective by requiring the TOE to provide key management and cryptographic
functions to protect the function data while transferred across the network.
FDP_ACC.1(A) specifies the subjects, objects and operations that are controlled
regarding functions.
FDP_ACF.1(A) specifies the security attributes and rules used to determine
whether access is permitted.
FIA_UID.1 supports access control and security roles by requiring user
identification.
FMT_MSA.1 and FMT_MSA.3 support the access control function by
enforcing control of security attributes and their defaults.
FMT_SMF.1 supports control of security attributes by requiring functions to
control attributes.
FMT_SMR.1 supports control of security attributes by requiring security roles.
FTP_ITC.1 addresses the objective by requiring the TOE to provide trusted
channels for the exchange of D.FUNC across the network.
O.INTERFACE.MA
NAGED
FIA_UAU.1 enforces management of external interfaces by requiring user
authentication.
FIA_UID.1 enforces management of external interfaces by requiring user
identification.
FPT_FDI_EXP.1 specifies that the TOE restrict the flow of information
between the network and fax interfaces.
FTA_SSL.3 enforces management of external interfaces by terminating inactive
sessions.
O.I&A FIA_AFL.1 supports the objective by requiring the TOE to lock accounts that
experience an excessive number of failed authentication attempts, thereby
providing protection from brute force password attacks.
FIA_ATD.1 specifies the attributes associated with users, including information
about failed authentication attempts.
FIA_UAU.1 requires the TOE to provide I&A using Username/Password
Accounts.
FIA_UAU.7 protects the confidentiality of passwords by specifying that only
asterisks are echoed during password entry.
FIA_UID.1 requires the TOE to provide I&A using Username/Password
Accounts.
Lexmark Multi-Function Printers with Hard Drives Security Target
62
Security
Objective
SFR and Rationale
FIA_USB.1 specifies the attributes bound to a session upon successful
completion of the I&A process.
O.MANAGE FPT_FDI_EXP.1 requires the TOE to provide management of direct forwarding
from the original document handler input to the network interface.
FMT_MSA.1 specifies the rules for management of the security attributes used
in the access control decisions for user data.
FMT_MSA.3 requires the TOE to impose restrictive default values for security
attributes in all cases.
FMT_MTD.1specifies the rules for management of TSF data.
FMT_SMF.1 specifies the management functions that the TOE provides and
controls access to.
FMT_SMR.1 specifies the two roles supported by the TOE.
FTA_SSL.3 requires the TOE to automatically terminate idle sessions to
mitigate against users taking advantage of existing sessions to gain unauthorized
access.
O.PROT.NO_ALT FCS_CKM.1(A), FCS_CKM.1(B), FCS_CKM.4 and FCS_COP.1 support the
objective by requiring the TOE to provide key management and cryptographic
functions to protect the management data while transferred across the network.
FIA_UID.1 supports access control and security roles by requiring user
identification.
FMT_MTD.1 specifies the rules for displaying TSF Confidential Data.
FMT_SMF.1 supports control of security attributes by requiring functions to
control attributes.
FMT_SMR.1 supports control of security attributes by requiring security roles.
FTP_ITC.1 addresses the objective by requiring the TOE to provide trusted
channels for the exchange of management traffic across the network.
O.SOFTWARE.VER
IFIED
FPT_TST.1 addresses the objective by requiring the TOE to validate the TSF
data for configuration data.
O.TIME_STAMP FPT_STM.1 requires the TOE to provide a reliable time source when time is
configured to be supplied internally.
O.USER.AUTHORI
ZED
FIA_ATD.1 supports authorization by associating security attributes with
users.FIA_UID.1 and FIA_UAU.1 requires the TOE to successfully complete
the I&A process before allowing users to perform anything other than the
specified functions.
FIA_USB.1 specifies the attributes bound to a sessions (and used in access
control decisions) upon successful I&A.
The security policies defined in FDP_ACC.1(A), FDP_ACC.1(B),
FDP_ACF.1(A), FDP_ACF.1(B), FMT_MSA.1 and FMT_MSA.3 are required
to be enforced by the TOE based on the security attributes bound to the subject
(acting on behalf of the authenticated user).
FMT_SMR.1 supports authorization by requiring security roles.
FTA_SSL.3 enforces authorization by terminating inactive sessions.
9.2.2 Security Assurance Requirements Rationale
The TOE stresses assurance through vendor actions that are within the bounds of current best
commercial practice. The TOE provides, primarily via review of vendor-supplied evidence,
independent confirmation that these actions have been competently performed.
The general level of assurance for the TOE is:
Lexmark Multi-Function Printers with Hard Drives Security Target
63
A) Consistent with current best commercial practice for IT development and provides
a product that is competitive against non-evaluated products with respect to
functionality, performance, cost, and time-to-market.
B) The TOE assurance also meets current constraints on widespread acceptance, by
expressing its claims against EAL3 augmented with ALC_FLR.3 from part 3 of
the Common Criteria.
9.3 TOE Summary Specification Rationale
This section demonstrates that the TOE’s Security Functions completely and accurately meet the
TOE SFRs.
The following tables provide a mapping between the TOE’s Security Functions and the SFRs
and the rationale.
Table 32 - SFRs to TOE Security Functions Mapping
Audit
Generation
I&A
Access
Control
Management
Fax
Separation
Hard
Disk
Encryption
Disk
Wiping
Secure
Communication
Self
Test
FAU_GEN.1 X
FAU_GEN.2 X
FCS_CKM.1(A) X X
FCS_CKM.1(B) X
FCS_CKM.4 X X
FCS_COP.1 X X X
FDP_ACC.1(A) X
FDP_ACC.1(B) X
FDP_ACF.1(A) X
FDP_ACF.1(B) X
FDP_RIP.1 X
FIA_AFL.1 X
FIA_ATD.1 X
FIA_UAU.1 X
FIA_UAU.7 X
FIA_UID.1 X
FIA_USB.1 X
FMT_MSA.1 X X
FMT_MSA.3 X
FMT_MTD.1 X X
FMT_SMF.1 X
FMT_SMR.1 X
FPT_FDI_EXP.1 X X X
FPT_STM.1 X
FPT_TST.1 X
FTA_SSL.3 X
FTP_ITC.1 X
Lexmark Multi-Function Printers with Hard Drives Security Target
64
Table 33 - SFR to SF Rationale
SFR SF and Rationale
FAU_GEN.1 Audit Generation addresses the SFR by specifying the audit event records
that are generated and the content of the records.
FAU_GEN.2 Audit Generation addresses the SFR by specifying that the associated
Username (if applicable) is included in audit event records.
FCS_CKM.1(A) Hard Disk Encryption generates a key used to encrypt the files on the hard
disk when this function is enabled. Secure Communications requires
generation of keys for IKE exchanges involving pre-shared keys.
FCS_CKM.1(B) Secure Communications requires generation of a certificate with an RSA
public-private key pair.
FCS_CKM.4 Hard Disk Encryption requires the key used to encrypt the files on the hard
disk to be zeroized when the function is disabled.
Secure Communication requires zeroization of the session keys obtained by
DH IKE Key Derivation Function to be zeroized when the sessions
terminate.
FCS_COP.1 Hard Disk Encryption uses the random number generator and AES to
generate the key used to encrypt the files on the hard disk, and uses AES to
perform the encryption and decryption.
Disk Wiping uses the random number generator to obtain random data used
during disk sanitization.
Secure Communication requires the TOE to support TDES and AES for
encryption, SHA for HMAC, RSA signatures, Diffie Hellman for IKE Key
Derivation Function, and a pseudo-random number generator.
FDP_ACC.1(A) Access Control specifies the access controls placed on the user operations
(objects) performed by users to access user data in the TSC.
FDP_ACC.1(B) Access Control specifies the access controls placed on the user operations
(objects) performed by users to access user data in the TSC.
FDP_ACF.1(A) Access Control specifies the access controls placed on the user operations
(objects) performed by users to access user data in the TSC.
FDP_ACF.1(B) Access Control specifies the access controls placed on the user operations
(objects) performed by users to access user data in the TSC.
FDP_RIP.1 Disk Wiping requires the TOE to erase disk files and RAM buffers upon
their release that contain user data from incoming print, copy, scan and fax
jobs.
FIA_AFL.1 Identification and Authentication requires the TOE to track failed login
attempts for all authentication mechanisms. The limit on failed attempts that
triggers an account lock is specified via the Login Restrictions TSF data.
FIA_ATD.1 Identification and Authentication requires the TOE to maintain the
Username, Password, and Associated Groups security attributes for
Username/Password Accounts; and the failed authentication security
attributes for all users.
FIA_UAU.1 Identification and Authentication requires the TOE to prevent access to
restricted functions before the I&A process is successfully completed.
Printing is never a restricted function; other functions may be restricted
through access controls or enabling/disabling specific functions such as
incoming faxes. The TOE is solely responsible for I&A for
Username/Password Accounts.
FIA_UAU.7 Identification and Authentication requires the TOE to echo asterisks or dots
when a password is being entered for the I&A process for all mechanisms.
Lexmark Multi-Function Printers with Hard Drives Security Target
65
SFR SF and Rationale
FIA_UID.1 Identification and Authentication requires the TOE to prevent access to
restricted functions before the I&A process is successfully completed.
Printing is never a restricted function; other functions may be restricted
through access controls or enabling/disabling specific functions such as
incoming faxes. The TOE is solely responsible for I&A for
Username/Password Accounts.
FIA_USB.1 Identification and Authentication requires the TOE to bind the Username and
Password supplied during I&A with the subject upon successful I&A. The
TOE also binds the permissions based on the permissions of associated
groups.
FMT_MSA.1 Management requires the TOE to provide the management capabilities for
Usernames and Group memberships to the administrators that satisfy the
access controls associated with the menus that control access to the data
items.
Access Control specifies that access be restricted and states the required
configuration in the evaluated configuration.
FMT_MSA.3 Management requires the TOE to initially associate no group memberships
with Username/Password Accounts.
FMT_MTD.1 Management requires the TOE to provide the management capabilities
specified in the table to the administrators that satisfy the access controls
associated with the menus that control access to the data items.
Access Control specifies that access be restricted and states the required
configuration in the evaluated configuration.
FMT_SMF.1 Management requires the TOE to provide capabilities to manage the
specified functions.
FMT_SMR.1 Management requires the TOE to maintain the two specified roles.
Administrators are any users authorized access to management functionality,
while normal users are all the other defined users.
FPT_FDI_EXP.1 Access Control requires the TOE to prevent data from being forwarded from
the original document handler interfaces to the network interface in the
evaluated configuration unless authorized by an administrator.
Management provides an administrator with the ability to configure the TOE
for operation in this manner.
Fax Separation requires the TOE to prevent any forwarding of data between
the fax interface and the network port.
FPT_STM.1 Audit Generation requires the TOE to provide time stamps for audit records
when the TOE is configured for internal time.
FPT_TST.1 Self Test requires the TOE to perform tests on the cryptographic
components, validate the configuration data, and validates the integrity of the
executable code on each power up and reset.
FTA_SSL.3 Identification and Authentication states that sessions are automatically
terminated by the TOE when the Home menu is not accessed within the
configured timeout period.
FTP_ITC.1 Secure Communication requires the TOE to use a trusted channel for
network communication with all remote IT systems.