Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX- 8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target Version 1.3 Samsung Electronics Company @ This is proprietary information of Samsung Electronics. No part of the information contained in this document may be reproduced without the prior consent of Samsung Electronics Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 2 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Document History VERSION DATE DESCRIPTION OF CHANGE SECTIONS AFFECTED REVISED BY 1.0 2011-07-09 ­ Initial version ALL Seongil Park 1.1 2011-09-15 ­ 1st OR updated ALL Seongil Park 1.2 2011-09-30 ­ 2st OR updated ALL Seongil Park 1.3 2011-10-14 ­ 3nd OR updated ALL Seongil Park Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 3 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved CONTENTS 1 Introduction ...................................................................................................................................7 1.1 SECURITY TARGET REFERENCES .....................................................................................7 1.2 TOE REFERENCES............................................................................................................7 1.3 TOE OVERVIEW...............................................................................................................7 1.3.1 TOE Type, Usage and Security features........................................................................................7 1.3.2 General Specification for TOE......................................................................................................9 1.3.3 TOE Operational Environment .....................................................................................................9 1.3.4 Non-TOE Hardware/Software/Firmware required by the TOE..................................................11 1.4 TOE DESCRIPTION .........................................................................................................12 1.4.1 Users ...........................................................................................................................................12 1.4.2 Physical Scope.............................................................................................................................13 1.4.3 Guidance .....................................................................................................................................14 1.4.4 Logical Scope..............................................................................................................................14 1.5 CONVENTIONS................................................................................................................18 1.6 TERMS AND DEFINITIONS...............................................................................................20 1.7 ACRONYMS ....................................................................................................................23 1.8 ORGANIZATION ..............................................................................................................24 2 Conformance Claims...................................................................................................................25 2.1 CONFORMANCE TO COMMON CRITERIA ........................................................................25 2.2 CONFORMANCE TO PROTECTION PROFILES...................................................................25 2.3 CONFORMANCE TO PACKAGES ......................................................................................26 2.4 CONFORMANCE CLAIM RATIONALE ..............................................................................26 2.4.1 Security Problem Definition Related Conformance Claim Rationale .........................................26 2.4.2 Security Objectives Related Conformance Claim Rationale .......................................................27 2.4.3 Security Functional Requirements related Conformance Claim Rationale.................................28 2.4.4 Security Assurance Requirements related Conformance Claim Rationale .................................30 2.4.5 TOE type related Conformance Claim Rationale........................................................................30 3 Security Problem Definition .......................................................................................................31 3.1 THREATS AGENTS...........................................................................................................31 3.1.1 Objects (Assets)...........................................................................................................................31 3.1.2 Threats to TOE Assets .................................................................................................................34 3.2 ORGANIZATIONAL SECURITY POLICIES .........................................................................34 3.3 ASSUMPTIONS ................................................................................................................35 3.3.1 Assumptions for the TOE.............................................................................................................35 3.3.2 Assumptions for the TOE (Additional) ........................................................................................35 4 Security Objectives......................................................................................................................37 4.1 SECURITY OBJECTIVES FOR THE TOE............................................................................37 4.1.1 Security Objectives for the TOE..................................................................................................37 4.1.2 Security Objectives for the TOE (Additional)..............................................................................38 DEFINITION.......................................................................................................................................38 4.2 SECURITY OBJECTIVES FOR OPERATIONAL ENVIRONMENT..........................................38 4.2.1 Security Objectives for Operational Environment ......................................................................38 4.2.2 Security Objectives for Operational Environment (Additional) ..................................................39 4.3 SECURITY OBJECTIVES RATIONALE ..............................................................................39 5 Extended Component Definition................................................................................................44 5.1 FPT_FDI_EXP RESTRICTED FORWARDING OF DATA TO EXTERNAL INTERFACES ........44 Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 4 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 6 Security Requirements................................................................................................................46 6.1 SECURITY FUNCTIONAL REQUIREMENTS ......................................................................46 6.1.1 Class FAU: Security Audit ..........................................................................................................48 6.1.2 Class FCS: Cryptographic support.............................................................................................50 6.1.3 Class FDP: User data protection................................................................................................52 6.1.4 Class FIA: Identification and authentication ..............................................................................62 6.1.5 Class FMT: Security management ..............................................................................................64 6.1.6 Class FPT: Protection of the TSF ...............................................................................................68 6.1.7 Class FTA: TOE access...............................................................................................................69 6.1.8 Class FTP: Trusted path/channels ..............................................................................................70 6.2 SECURITY ASSURANCE REQUIREMENTS........................................................................70 6.2.1 Class ASE: Security Target evaluation .......................................................................................71 6.2.2 Class ADV: Development............................................................................................................75 6.2.3 Class AGD: Guidance documents...............................................................................................77 6.2.4 Class ALC: Life-cycle support ....................................................................................................78 6.2.5 Class ATE: Tests .........................................................................................................................81 6.2.6 Class AVA: Vulnerability assessment..........................................................................................83 6.3 SECURITY REQUIREMENTS RATIONALE.........................................................................84 6.3.1 Security Functional Requirements’ Rationale.............................................................................84 6.3.2 Security Assurance Requirements Rationale...............................................................................89 6.4 DEPENDENCY RATIONALE .............................................................................................90 6.4.1 SFR Dependencies.......................................................................................................................90 6.4.2 SAR Dependencies.......................................................................................................................93 7 TOE Summary Specification......................................................................................................94 7.1 TOE BASIC FUNCTIONS .................................................................................................94 7.2 TOE SECURITY FUNCTIONS...........................................................................................94 7.2.1 Identification & Authentication (TSF_FIA) ................................................................................94 7.2.2 Network Access Control (TSF_NAC) ..........................................................................................96 7.2.3 Security Management (TSF_FMT)..............................................................................................97 7.2.4 Security Audit (TSF_FAU) ..........................................................................................................99 7.2.5 Image Overwrite (TSF_IOW)......................................................................................................99 7.2.6 Data Encryption (TSF_NVE) ....................................................................................................100 7.2.7 Fax Data Control (TSF_FLW) ..................................................................................................100 7.2.8 Self Testing (TSF_STE) .............................................................................................................101 7.2.9 Secure Communication (TSF_SCO)..........................................................................................102 Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 5 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved LIST OF FIGURES Figure 1: Operational Environment of the TOE ........................................................................................................10 Figure 2: Physical Scope .............................................................................................................................................13 Figure 3: Logical Scope...............................................................................................................................................15 Figure 4: Information Flow Summary.......................................................................................................................101 Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 6 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved LIST OF TABLES Table 1: General Specification for TOE........................................................................................................................9 Table 2 : Non-TOE Hardware/Software/Firmware .....................................................................................................11 Table 3: Users..............................................................................................................................................................13 Table 4: Notational Prefix Conventions ......................................................................................................................18 Table 5: Acronyms ......................................................................................................................................................23 Table 6: Security Problem Definition Related Conformance Claim Rationale - Threats ............................................26 Table 7: Security Problems Definition Related Conformance Claim Rationale - Organizational Security Policies ...26 Table 8: Security Problems Definition Related Conformance Claim Rationale - Assumptions..................................27 Table 9: Security Objectives Related Conformance Claim Rationale – Security Objectives for the TOE..................27 Table 10: Security Objectives related Conformance Claim Rationale– Security Objectives for the Operational Environment.......................................................................................................................................................28 Table 11: Security Functional Requirements related Conformance Claim Rationale .................................................28 Table 12: Security Assurance Requirements related Conformance Claim Rationale..................................................30 Table 13: User Data.....................................................................................................................................................31 Table 14: TSF Data......................................................................................................................................................31 Table 15:Functions ......................................................................................................................................................32 Table 16:Attributes......................................................................................................................................................32 Table 17: External Entities ..........................................................................................................................................33 Table 18: Threats to User Data for the TOE................................................................................................................34 Table 19: Threats to TSF Data for the TOE ................................................................................................................34 Table 20: Organizational Security Policies..................................................................................................................34 Table 21: Assumptions for the TOE............................................................................................................................35 Table 22: Assumptions for the TOE (Additional) .......................................................................................................36 Table 23: Security Objectives for the TOE .................................................................................................................37 Table 24: Security Objectives for the TOE (Additional).............................................................................................38 Table 25: Security Objectives for Operational Environment.......................................................................................38 Table 26: Security Objectives for the IT Environment................................................................................................39 Table 27: Completeness of Security Objectives ..........................................................................................................40 Table 28: Sufficiency of Security Objectives ..............................................................................................................41 Table 29: Security Functional Requirements...............................................................................................................46 Table 30: Audit data ....................................................................................................................................................48 Table 31: Cryptographic Operations............................................................................................................................52 Table 32: Common Access Control SFP .....................................................................................................................54 Table 33: Service Access Control SFP........................................................................................................................54 Table 34: TOE Function Access Control SFP .............................................................................................................55 Table 35: Management of Security Functions Behavior .............................................................................................64 Table 36: Management of Security Attributes.............................................................................................................65 Table 37: Management of TSF data ............................................................................................................................67 Table 38: Management Functions ...............................................................................................................................67 Table 39: Security Assurance Requirements (EAL3 augmented by ALC_FLR.2) .....................................................70 Table 40: Completeness of security functional requirements......................................................................................84 Table 41: Security Requirements Rationale ................................................................................................................85 Table 42: Dependencies on the TOE Security Functional Components......................................................................90 Table 43 : Management of Security Functions Behavior ............................................................................................97 Table 44 : Management of Security Attributes............................................................................................................97 Table 45 : Management of TSF data ...........................................................................................................................98 Table 46: Security Audit Event ...................................................................................................................................99 Table 47 :Audit Event for TST..................................................................................................................................101 Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 7 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 1 Introduction This document describes the objectives, requirements and rationale for the Samsung SCX- 5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 for the Common Criteria EAL3+. 1.1 Security Target References Security Target Title Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX- 8540NX Control Software V2.00.03.00 Security Target Security Target Version Version 1.3 Publication Date October 14, 2011 Authors Samsung Electronics Certification body IT Security Certification Center (ITSCC) CC Identification Common Criteria for Information Technology Security (CC Version 3.1 Revision 3) Keywords Samsung Electronics, Multifunction Peripheral, Security, IEEE Std 2600.1-200 1.2 TOE References Developer Samsung Electronics Name Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX- 8540NX Control Software V2.00.03.00 Version SCX-5835NX (V2.00.03.00) SCX-6555NX (V2.00.03.00) SCX-6545NX (V2.00.03.00) CLX-8385NX (V2.00.03.00) CLX-8540NX (V2.00.03.00) Product SCX-5835NX, SCX-6555NX, SCX-6545NX, CLX-8385NX, CLX-8540NX 1.3 TOE Overview 1.3.1 TOE Type, Usage and Security features This TOE is MFP (Multi-Function Peripherals) as an IT product. It controls the operation of the entire MFP, including copy, print, scan, and fax functions on the MFP controller. The TOE provides the following basic features: ⎯ Printing—producing a hardcopy document from its electronic form ⎯ Scanning—producing an electronic document from its hardcopy form ⎯ Copying—duplicating a hardcopy document ⎯ Faxing—scanning documents in hardcopy form and transmitting them in electronic form over telephone lines and receiving documents in electronic form over telephone lines and printing them in hardcopy form ⎯ Document storage and retrieval—storing an electronic document during one document processing job for access during one or more subsequent document processing jobs, and retrieving an electronic document that was stored during a previous document processing job Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 8 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved ⎯ Shared-medium Interfaces—transmitting or receiving User Data or TSF Data between the HCD and external devices over communications media which, in conventional practice, is or can be simultaneously accessed by multiple users The TOE provides the following security features:  Identification & Authentication The TOE receives U.USER’s information (e.g. ID, password, domain, etc.) through either the LUI or the WEBUI, and performs identification & authentication functions using the acquired information. Then the TOE authorizes U.USER according to the identification & authentication result. The TOE also provides the Common Access Control & TOE Function Access Control based on the user role assigned to User ID by U.ADMINISTRATOR  Network Access Control The TOE provides a network access control function to control ports and protocols used in network protocol services provided by the MFP. Through this function, U.ADMINISTRATOR can control access from external network by enabling/disabling or altering port numbers of various protocols. And The TOE also provides IP filtering /Mac filtering functions to control access from external network.  Security Management The TOE provides a management function to manage security functions (e.g. security audit, image overwrite, etc.) provided by the TOE. Through this function, U.ADMINISTRATOR can enable/disable security functions, manage TSF data and the security attributes, and maintain security roles.  Security Audit The TOE stores and manages internal events occurring in the MFP. Audit logs are stored on the hard disk drive or SD Card and can be reviewed or deleted or viewed by U.ADMINISTRATOR through the remote user interface.  Image Overwrite The TOE provides an image overwrite function to securely delete temporary files and job files (e.g. printing, copying, scanning, and faxing jobs) and specific HDD partition. This function is classified as two functions: automatic image overwriting and manual image overwriting. U.ADMINISTRATOR can execute the image overwriting function only through the local user interface.  Data Encryption The TOE provides a data encryption function to protect data (e.g. job information, configuration information, audit logs, etc.) stored on the hard disk drive from unauthorized access.  Fax Data Control The TOE provides a fax data control function to examine fax image data formats (MMR, MR, or MH of T.4 specification) received via the PSTN port and check whether received data is suitable.  Self-testing The TOE provides a self-testing function to verify the TSF’s correct operation and the integrity of TSF data and executable code.  Secure Communication The TOE provides a trusted channel between itself and another trusted IT product to protect user data or TSF data that are transmitted or received over network. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 9 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 1.3.2 General Specification for TOE Table 1: General Specification for TOE Specifications SCX-5835NX SCX-6545NX SCX-6555NX CLX-8385NX CLX-8540NX LCD 800x480 7" WVGA Color Touch-Screen LCD 800x480 7" WVGA Color Touch-Screen LCD 800x480 7" WVGA Color Touch-Screen LCD 800x480 7" WVGA Color Touch-Screen LCD System Memory 256 MB 256 MB 256 MB 1 GB HDD 160 GB HDD 160 GB HDD 160 GB HDD 160 GB HDD SD Card 2 G 2 G 2 G 2 G F A X Compatibility ITU-T G3, Super G3 ITU-T G3, Super G3 ITU-T G3, Super G3 ITU-T G3, Super G3 Comm. System PSTN / PABX PSTN / PABX PSTN / PABX PSTN / PABX Modem Speed 33.6 Kbps 33.6 Kbps 33.6 Kbps 33.6 Kbps Interface Hi-Speed USB 2.0, Ethernet 10/100/1000 base TX, USB host 2.0 Hi-Speed USB 2.0, Ethernet 10/100/1000 base TX, USB host 2.0 Hi-Speed USB 2.0, Ethernet 10/100/1000 base TX, USB host 2.0 Hi-Speed USB 2.0, Ethernet 10/100/1000 base TX, USB host 2.0 Extra information Simplex :Up to 33 ppm in A4 (35 ppm in Letter) Simplex :Up to 43 ppm in A4 (45 ppm in Letter) Simplex :Up to 53 ppm in A4 (55 ppm in Letter) B&W: Up to 38 ppm in A4 (40 ppm in Letter) Color: Up to 38 ppm in A4 (40 ppm in Letter) 1.3.3 TOE Operational Environment In general, the MFP can be used in a wide variety of environments, which means each environment may place a different value on the assets, make different assumptions about security-relevant factors, face threats of differing approaches, and be subject to different policy requirements. Figure 1 shows the expected operational environment for the usage of an TOE. The TOE is operated in an internal network protected by a firewall. U.USER is connected to the TOE and may perform jobs that are allowed. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 10 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Figure 1: Operational Environment of the TOE The TOE is intended to operate in a network environment that is protected by a firewall from external malicious attacks (e.g., DoS attack), and with reliable PCs and authenticated servers. A user is able to access the TOE by using a local user interface, U.NORMAL PC from a remote user, or a Remote User Interface (Refer to Figure 1: Operational Environment of the TOE). The local user interface (LUI) is designed to be accessed by users and a local administrator. The users can operate copy, scan, and fax functions through the LUI. In the case of a scanning job, users can operate the scanning job using the LUI and transfer the scanned data to a certain destination by email addresses, server PCs, or client PCs. Users can also use their PCs to print out documents or to access the TOE through the internal network. The administrator can enable/disable Automatic Image Overwrite, start/stop Manual Image Overwrite, and change a Password via the LUI. The administrator can access TOE through the Remote User Interface (WEBUI) using a web browser (refer to Table 1) supporting SSL protocol. From there, they can add/change/delete user accounts, enable/disable the security audit service, and view the security audit report. The user account information that requires asking for internal authentication by TOE can be stored on the hard disk drive of the MFP. All of the information stored on the hard disk drive is protected by the TOE. In the case of external authentication by trusted authentication servers (Kerberos, LDAP, SMB server), all the account information stored on a network authentication server is assumed to be protected from external environmental space. The user’s fax image can be transferred to Public Switched telephone network.  Storage server The FTP, SMB, SMTP server as storage devices of received fax and scan data from the TOE. Scan- to-server is a relevant function.  Authentication server There are several authentication servers: Kerberos, LDAP, and SMB servers. The authentication server identifies and authenticates U.NORMAL if remote authentication mode is enabled. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 11 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 1.3.4 Non-TOE Hardware/Software/Firmware required by the TOE Table 2 : Non-TOE Hardware/Software/Firmware Items Objectives Specification Hardware PC for U.ADMINISTRATOR PC for Web U.ADMINISTRATOR (or telnet system U.ADMINISTRATOR) to access and manage TOE. • Windows 2000 - CPU: Pentium II 400 MHz or higher - Memory: 64 MB or higher - HDD: 0.6 GB or higher • Windows XP - CPU: Pentium III 933 MHz or higher - Memory: 128 MB or higher - HDD: 1.5 GB or higher • Windows 2003 Server - CPU: Pentium III 933 MHz or higher - Memory: 128 MB or higher - HDD: 1.25 GB or higher • Windows Vista - CPU: Pentium IV 3 GHz or higher - Memory: 512 MB or higher - HDD:15 GB or higher • Windows 7 - CPU: Pentium IV 1 GHz or higher - Memory: 1 GB or higher - HDD:16 GB or higher • Mac OS X - CPU: Power PC G4/G5, Intel Processors - Memory: 128 MB Macintosh based on Power PC - HDD: 1 GB or higher • Mac OS X 10.5 - CPU: 867 MHz or Power PC G4/G5 - Memory: 512 MB or higher - HDD: 1 GB or higher • Linux - CPU: Pentium IV 2.4 GHz or higher - Memory: 512 MB - HDD: 1 GB or higher PC for U.NORMAL PC for U.NORMAL to print or scan or copy with TOE Firewall system Firewall system to protect internal assets by blocking attacks from external networks. - LAN Internal network for TOE. - PSTN PSTN for translating fax image. - Software Operating system for PC Operating system for U.NORMAL or web U.ADMINISTRATOR • For SCX-5835NX, SCX-6555NX, SCX- 6545NX, CLX- 8540NX [Windows] - Windows 2000/XP(32/64 bit)/2003(32/64 bit)/Vista(32/64 bit)/2008/ Win 7(32,64bit) [Linux] - RedHat Enterprise Linux WS 4, 5 (32/64 bit) - Fedora Core 2~10 (32/64 bit) - SuSE Linux 9.1 (32 bit) - OpenSuSE 9.2, 9.3, 10.0, 10.1, 10.2 10.3, 11.0 11.1 (32/64 bit) - Mandrake 10.0, 10.1 (32/64 bit) - Mandriva 2005, 2006, 2007, 2008, 2009 Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 12 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Items Objectives Specification (32/64 bit) - Ubuntu 6.06, 6.10, 7.04, 7.10, 8.04 8.10 (32/64 bit) - SuSE Linux Enterprise Desktop 9, 10 (32/64 bit) - Debian 3.1, 4.0, 5.0 (32/64 bit) [Mac] - Mac OS X 10.3~10.5 Web browser that can serve SSL communication Web browser that serves SSL communication between U.NORMAL's PC or Web U.ADMINISTRATOR 's PC and the TOE Internet Explorer 6.0 or higher (~8.0) Printer driver Printer driver application software for U.NORMAL to install in their PC. User can configure properties and start printing jobs through this printer driver. • For SCX-5835NX SCX-6555NX SCX- 6545NX CLX-8385NX CLX-8540NX Linux 3.00.76 Unified Driver Mac OS 10.3 ~ 10.6, 1.00.01, Print Driver Win 2000/XP/2003/Vista/2008/Win 7(32,64bit), 3.05.06.00:08 Printer Driver SmarThru Office 2 SmarThru Office 2 is an integrated management application program. Users can install this program in their PC, then edit scanned images or send email through this program. • For SCX-5835NX, SCX-6555NX, SCX- 6545NX, CLX-8385NX CLX-8540NX Win 2000/XP/2003/Vista/2008/Win 7(32,64bit), 2.07.10, SmarThru office 2 Smart Panel Smart Panel monitors the state of the MFP connected to the user’s PC. When an event occurs, Smart Panel notifies the user of the event. • For SCX-5835NX, SCX-6555NX, SCX- 6545NX, CLX-8385NX CLX-8540NX Linux, 2.00.65, Smart Panel Mac OS 10.3 ~ 10.6, 2.02.06, Smart Panel Scan Driver Scan Driver receives scanned data from the MFP and stores it in the user’s PC. • For SCX-5835NX, SCX-6555NX, SCX- 6545NX, CLX-8385NX CLX-8540NX Mac OS 10.3 ~ 10.6, V1.00.08, Universal Scan Driver Win 2000/XP/2003/Vista/2008/Win 7(32,64bit), V1.02.05, Universal Scan Driver 1.4 TOE Description This section provides detailed information for the TOE evaluator and latent customer about TOE basic and security functions. It includes descriptions of the physical scope and logical scope of the TOE. 1.4.1 Users Users are entities that are external to the TOE and interact with the TOE. There may be two types of Users: Normal and Administrator. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 13 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Table 3: Users Designation Definition U.USER Any authorized User U.NORMAL A User who is authorized to perform User Document Data processing functions of the TOE U.ADMINISTRATOR A User who has been specifically granted the authority to manage some portion or all of the TOE and whose actions may affect the TOE security policy (TSP). Administrators may possess special privileges that provide capabilities to override portions of the TSP. 1.4.2 Physical Scope The physical scope of the TOE consists of the all of the MFP hardware and Software. The MFP consists of the System Board, Control Panel, DADF, Finisher, Engine Controller Board. Figure 2: Physical Scope System Board The device system board consists of CPU and ROM, RAM and it related unit. Control Panel Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 14 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Control Panel consists of LCD panel and its controlling unit and the buttons DADF DADF controls the document feeding for scanning data Finisher Finisher controls the document finishing such as staple Engine Engine board controls the image processing and mechanical units of printer engine 1.4.3 Guidance The following is the guidance document for the TOE. - Network Admin Guide_v3.00.pdf - Security Admin_v3.00.pdf - SCX-5835NX_5935NX Series User Guide_Eng.pdf - CLX-8385NX Series User Guide_Eng.pdf - SCX-6545NX Series User Guide_Eng.pdf - SCX-6555NX Series User Guide_Eng.pdf 1.4.4 Logical Scope Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 15 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Figure 3: Logical Scope The following basic functions are provided by the TOE: Printing Function The TOE can produce a hardcopy document from its electronic form such as PC print, print from document storage. Scanning Function The TOE can produce an electronic document from its hardcopy form such as PC Scan, Scan To E- mail, Scan To SMB, Scan To FTP. Copying Function The TOE can duplicate a hardcopy document Faxing Function The TOE can scan documents in hardcopy form and transmit them in electronic form over telephone lines and receive documents in electronic form over telephone lines and print them in hardcopy form Document storage and retrieval Function The TOE can store an electronic document during one document processing job for access during one or more subsequent document processing jobs, and retrieve an electronic document that was stored during a previous document processing job Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 16 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved The following security functions are provided by the TOE: Identification & Authentication (TSF_FIA) The TOE can restrict U.USER from accessing the machine or application. U.NORMAL and U.ADMINISTRATOR should be identified and authenticated by entering ID, Password to access to the TOE management functions. U. ADMINISTRATOR can configure Identification & Authentication Policy by using LUI or WEBUI. U. ADMINISTRATOR can also give specific permission for U.NORMAL to use certain features of the machine. Network Access Control (TSF_NAC) The MFP(TOE) has a network interface card (network card) connected to an external network. The MFP system can send/receive data and MFP configuration information and thus is able to configure MFP settings. There are a couple of methods to access and communicate with the MFP from outside of the TOE through the network, and the TOE manages all incoming packets via a network interface. 1) Protocol and Port Control: The TOE can only allow protocols and ports configured by U.ADMINISTRATOR. U.ADMINISTRATOR can configure this information via the WEBUI. 2) IP and Mac address filtering: U.ADMINISTRATOR can make filtering rules for IPv4/IPv6 addresses and MAC addresses. After that, specific packets are allowed as per the IP filtering rule registered by U.ADMINISTRATOR. Packets via MAC addresses registered by U.ADMINISTRATOR are not allowed. Security Management (TSF_FMT) The TOE accomplishes security management for the security function, TSF data, and security attribute. Only U.ADMINISTRATOR can manage the security functions: security functions can be activated and deactivated by U.ADMINISTRATOR. TSF data and their possible operations are specified by U.ADMINISTRATOR. Security attributes can be operated by U.ADMINISTRATOR. Security Audit Data (TSF_FAU) The TOE creates an audit record security audit event including job log, security event log, and operation log. Job log includes print, scan, copy, fax, and document storage and retrieval jobs. Security event log includes authentication, log data access, and deletion and self testing. Operation log includes enablement of each log function (job log, security event log) except for the operation log. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 17 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved The audit data consist of the type of event, date and time of the event, success or failure, log out, access and deletion of log data, and enablement and disablement of the log function. Only U.ADMINISTRATOR is authorized to view (or delete) the audit data selectively. The TOE protects Security Audit Data stored on the SD Card. It prevents any unauthorized alteration to the Security Audit Data. Image Overwrite (TSF_IOW) The TOE implements a hard disk drive image overwrite security function to overwrite temporary files created during the printing, network scan, scan-to-email, or scan-to-server process. Immediately after the job has been completed, the files on the hard disk drive are overwritten using 3passes DoD Standard 5200.28-M method for the overwrite procedure. Image Overwrite provides two kinds of functions: automatic image overwrite and manual image overwrite Automatic Image Overwrite automatically overwrites temporary image files created as a result of the processing of copying/printing/scanning and Manual Image Overwrite overwrites the preserved files on a reserved section of the hard disk drive of the main controller by the U.NORMAL. The image overwrite security function can also be invoked manually by the U.ADMINISTRATOR (Manual Image Overwrite). Once invoked, the Manual Image Overwrite overwrites the contents of the reserved section on the hard disk drive. Data Encryption (TSF_NVE) The TOE encrypts image data and configuration data on the HDD. After that, the TOE stores the data on the HDD and it decrypts the stored data to use it. The TOE generates cryptographic keys when the TOE is initialized at the first setout. The cryptographic algorithm used by the TOE is AES algorithm with 256-bit key size. Also TOE encrypts audit data on the SD Card. The cryptographic algorithm used by TOE is AES algorithm with 128-bit key size. Each product has its unique value and nobody (including the administrator) can leak the key value to the outside. Fax Data Control (TSF_FLW) In the TOE, the memory areas for the fax board and for the network port on the main controller board are separated. The TOE inspects whether the received fax image is standardized with MMR, MR, or MH of T.4 specification or not before forwarding the received fax image to e-mail or SMB/FTP. When the data is considered to be safe, the memory copy continues from the fax memory area to network memory area. The fax data in network memory is transmitted using SMTP, SMB, FTP servers through the internal network. When non-standardized format data are discovered, the TOE destroys the fax image Self Testing (TSF_STE) The TOE goes through self testing procedure on each initial system boot examining. Self testing executes TSF function to verify the correct And the TOE verifies the integrity of TSF data and all of TSF executable code by the self testing. Secure Communication (TSF_SCO) The TOE provides secure communication between the TOE and all of other trusted IT products to protect communicated data from modification or disclosure by IPSEC. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 18 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Evaluated Configuration No additional Java applications are loaded into the MFP by Administrators. These applications are referred to as XOA applications in end user documentation. 1.5 Conventions This section describes the conventions used to denote Common Criteria (CC) operations on security functional components and to distinguish text with special meaning. The notation, formatting, and conventions used in this ST are largely consistent with those used in the CC. Four presentation choices are discussed here. Refinement The refinement operation is used to add detail to a requirement, and, thus, further restricts a requirement. Refinement of security requirements is denoted by bold text. The SFR which is completely describe on Protection Profile IEEE Std 2600.1-2009 Version 1.0 is included. Selection The selection operation is used to select one or more options provided by the CC in stating a requirement. Selections are denoted by underlined italicized text. Assignment The assignment operation is used to assign a specific value to an unspecified parameter such as the length of a password. Showing the value in square brackets [assignment_value(s)] indicates an assignment. Iteration Iterated functional components are given unique identifiers by appending to the component name, short name, and functional element name from the CC an iteration number inside parenthesis, for example, FIA_AFL.1 (1) and FIA_AFL.1 (2). The following is notational conventions used by the PP: Thefollowing prefixesinTable4areusedtoindicatedifferententitytypes: Table 4: Notational Prefix Conventions Prefix Type of Entity Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 19 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Prefix Type of Entity U. User D. Data F. Function T. Threat P. Policy A. Assumption O. Objective OE. Environmental objective + Security attribute The following is an additional convention used to denote this Security Target: Application Note Application note clarifies the definition of requirement. It also can be used when an additional statement except for the four presentations previously mentioned. Application notes are denoted by underlined text. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 20 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 1.6 Terms and Definitions Basically, this security target shall follow the terms and definitions specified in common criteria and the protection profile. They will not be additionally described in this document. Network Scan Service This is a service that transmits scanned data to a PC on an internal network, email, or FTP server through the network. It includes scan-to-email, scan-to-FTP, scan-to-SMB. LUI, Local User Interface Interface for U.NORMAL or U.ADMINISTRATOR to access, use, or manage the MFP directly. Fax-to-email This is a function that transmits received fax images to email through an internal network. This function is enabled only when a mail server and address are configured. Secure printing When a user stores files in an MFP from a remote client PC, the user must set secure printing configuration and assign a PIN to the file. Then the user can access to the file by entering the PIN through the LUI of the MFP. Preserved file To store a file on the hard disk drive of TOE, two types are provided: Public and Secured. When a user stores a document as Public, all users can access and use the file. A file stored as Secured can only be accessed by the user who stored the file. When storing a file as Secured, the user must set a PIN required to access the file. Then the file can only be accessed by entering the PIN. Multi-Function Printer, MFP MFP is a machine that incorporates the functionality of multiple devices (copy, print, scan, or fax) in one. Human User User who only refers to a human being Manual Image Overwrite Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 21 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved The Manual Image Overwrite function overwrites all stored files, including image files and preserved files on the hard disk drive, and the function should only be manually performed by a local administrator through the LUI. The image data is completely overwritten 3 times by using DoD 5200.28-M. Scan-to-server This is a function that transmits scanned data to a remote server from the LUI. Only authorized U.NORMAL can use this function. Scan-to-email This is a function that transmits scanned data to a remote email server from the LUI. Only authorized U.NORMAL can use this function. Image Overwrite This is a function to delete all stored files on the hard disk drive. There are two kinds of image overwriting: Automatic Image Overwrite and Manual Image Overwrite. WEBUI, Web UI, Web User Interface Interface for U.NORMAL or U.ADMINISTRATOR to access, use, or manage the MFP through a web service. Image file Temporarily stored file that is created during print, scan, copy, or fax job processing. Stored file Every file stored on the hard disk drive. It includes image files and preserved files. Public Print The print option that prints out a user stored documents using the Public option. It is open to every user. Automatic Image Overwrite The Automatic Image Overwrite automatically carries out overwriting operations on temporary image files at the end of each job such as print, copy, scan, scan-to-email, scan-to-FTP, scan-to- Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 22 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved SMB. Or the Automatic Image Overwrite overwrites the files on the hard disk drive when a user initiates a delete operation. FAX Job for receiving or transmitting fax images through a fax line Fax image The data received or transmitted through a fax line DoD 5200.28-M DoD 5200.28-M is an image overwriting standard that Department of Defense recommends. The image data in storage device is completely overwritten three times. Embedded FAX A fax job that transmits data scanned in the MFP through a fax line and receives fax data directly from a fax line on the MFP. PC FAX A fax function sends fax data from a client PC to an MFP first, and then transmits the fax data through a fax line. T.4 Data compression specification for fax transmission by ITU-T (International Telecommunication Union) MH Abbreviation of Modified Huffman coding This is an encoding method to compress for storing TIFF type files. It is mainly used for fax transmission. MR Abbreviation of Modified Relative Element Address Designate MH coding Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 23 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved MMR Abbreviation of Modified Modified Relative Element Address Designate MH coding. More advanced type than MR coding. AES Block cryptography developed by Belgium’s mathematicians, J.Daemen and V.Rijmen in 2000. AES has a block size and key size of 128, 192, or 256 bits. 1.7 Acronyms This section defines the meanings of acronyms used throughout this Security Target (ST) document. Table 5: Acronyms Definition CC Common Criteria for Information Technology Security Evaluation CEM Common Methodology for Information Technology Security Evaluation EAL Evaluation Assurance Level HDD Hard Disk Drive SD Card Secure Digital Card ISO International Standards Organization IT Information Technology LUI Local User Interface MFP Multi-Function Peripheral OSP Organizational Security Policy PP Protection Profile PPM Pages Per Minute PSTN Public Switched Telephone Network SAR Security Assurance Requirement SFP Security Function Policy SFR Security Functional Requirement ST Security Target TOE Target of Evaluation TSF TOE Security Functionality UI User Interface WEBUI Web User Interface MMR Modified Modified READ coding MR Modified READ Coding Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 24 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved MH Modified Huffman coding JSSE Java Secure Socket Extension 1.8 Organization Chapter 1 introduces the overview of Security Target, which includes references of Security Target, reference of the TOE, the TOE overview, and the TOE description. Chapter 2 includes conformance claims on the Common Criteria, Protection Profile, package, and provides a rationale on the claims. Chapter 3 defines security problems based on the TOE, security threats, security policies of the organization, and assumptions from the TOE or the TOE operational environment point of view. Chapter 4 describes TOE security objectives for corresponding with recognized threats, performing the security policy of the organization, and supporting the assumptions. It also describes security objectives about the TOE operational environment. Chapter 5 describes the extended component definition. Chapter 6 describes security functional requirements and security assurance requirements that satisfy the security objectives. Chapter 7 describes how the TOE satisfies the security functional requirements. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 25 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 2 Conformance Claims This chapter describes how the Security Target conforms to the Common Criteria, Protection Profile and Package. 2.1 Conformance to Common Criteria This Security Target conforms to the following Common Criteria:  Common Criteria Identification - Common Criteria for information Technology Security Evaluation, Part 1: Introduction and general model, version 3.1r3, 2009. 7, CCMB-2009-07-001 - Common Criteria for Information Technology Security Evaluation, Part 2: SFR (Security Functional Requirement), version 3.1r3, 2009. 7, CCMB-2009-07-002 - Common Criteria for Information Technology Security Evaluation, Part 3: SAR (Security Assurance Requirement), version 3.1r3, 2009. 7, CCMB-2009-07-003  Common Criteria Conformance - Common Criteria for Information Technology Security Evaluation, Part 2 extended - Common Criteria for Information Technology Security Evaluation, Part 3 conformant 2.2 Conformance to Protection Profiles This Security Target conforms to the following Protection Profile:  Protection Profile Identification - IEEE Std 2600.1-2009 Version 1.0 (CCEVS-VR-VID10340-2009, June 12, 2009) as known as U.S. Government Protection Profile for Hardcopy Devices in Basic Robustness Environments [PP]  Protection Profile Conformance - IEEE Std 2600.1-2009 Version 1.0 “demonstrable conformance”  2600.1-PP, Protection Profile for Hardcopy Devices, Operational Environment A  2600.1-PRT, SFR Package for Hardcopy Device Print Functions, Operational Environment A  2600.1-SCN, SFR Package for Hardcopy Device Scan Functions, Operational Environment A  2600.1-CPY, SFR Package for Hardcopy Device Copy Functions, Operational Environment A  2600.1-FAX, SFR Package for Hardcopy Device Fax Functions, Operational Environment A  2600.1-DSR, SFR Package for Hardcopy Device Document Storage and Retrieval (DSR) Functions, Operational Environment A  2600.1-SMI, SFR Package for Hardcopy Device Shared-medium Interface Functions, Operational Environment A Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 26 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 2.3 Conformance to Packages This Security Target conforms to the following Package.  Assurance Package: EAL3 augmented by ALC_FLR.2  2600.1-PRT, SFR Package conformant  2600.1-SCN, SFR Package conformant  2600.1-CPY, SFR Package conformant  2600.1-FAX, SFR Package conformant  2600.1-DSR, SFR Package conformant  2600.1-SMI, SFR Package conformant 2.4 Conformance Claim Rationale Protection Profile conformance method: “Demonstrable Conformance to the Security Problem Definition (APE_SPD), Security Objectives (APE_OBJ), Extended Components Definitions (APE_ECD), and the Common Security Functional Requirements (APE_REQ)” [Note] This ST must provide adequate rationale to demonstrate that the ST is “equivalent or more restrictive” than the PP to which this ST is claiming conformance. The PP conformance claim rationale is as follows: 2.4.1 Security Problem Definition Related Conformance Claim Rationale The security problem related conformance claim rationale is as shown in Table 6, Table 7 and Table 8 below: Table 6: Security Problem Definition Related Conformance Claim Rationale - Threats Threat Rationale T.DOC.DIS Equal to the PP: the threats in this ST are defined the same as the PP. Therefore, it satisfies the “demonstrable conformance”. T.DOC.ALT T.FUNC.ALT T.PROT.ALT T.CONF.DIS T.CONF.ALT Table 7: Security Problems Definition Related Conformance Claim Rationale - Organizational Security Policies Organizational Security Policy Rationale P.USER.AUTHORIZATION Equal to the PP: the security policies in this ST are defined the same as the PP. Therefore, it satisfies the P.SOFTWARE.VERIFICATION Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 27 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Organizational Security Policy Rationale P.AUDIT.LOGGING “demonstrable conformance”. P.INTERFACE.MANAGEMENT Table 8: Security Problems Definition Related Conformance Claim Rationale - Assumptions Assumption Rationale A.ACCESS.MANAGED Equal to the PP: the assumptions in this ST are defined the same as the PP. Therefore, it satisfies the “demonstrable conformance”. A.USER.TRAINING A.ADMIN.TRAINING A.ADMIN.TRUST A.NETWORK.TRUST The assumptions that should be satisfied in this TOE environment are additionally defined in this ST. It satisfies the “demonstrable conformance” because it includes equivalent or more restrictive environment and assumption compare with Protection Profile. A.AUTH_SERVER.SECURE A.EXT_SERVER.SECURE A.SSL_CERT.INSTALL A.IPSEC_EXT.SERVER A.SSL_CLIENT.PC 2.4.2 Security Objectives Related Conformance Claim Rationale The security objectives related conformance claim rationale is as shown in Table 9 and Table 10 below: Table 9: Security Objectives Related Conformance Claim Rationale – Security Objectives for the TOE Security Objectives for TOE Rationale O.DOC.NO_DIS Equal to the PP: the security objectives in this ST are defined the same as the PP. Therefore, it satisfies the “demonstrable conformance”. O.DOC.NO_ALT O.FUNC.NO_ALT O.PROT.NO_ALT O.CONF.NO_DIS O.CONF.NO_ALT O.USER.AUTHORIZED O.INTERFACE.MANAGED O.SOFTWARE.VERIFIED O.AUDIT.LOGGED O.DATA.ENCRYPTED The security objectives are additionally defined in this ST. Therefore, it enforces the equivalent or more restrictive security functionality of the TOE. It satisfies the “demonstrable conformance”. O.DATA.OVERWRITTEN O.AUDIT_STORAGE.PROTECTE D The security objectives are replaced in this ST. It prevents unauthorized disclosure and alteration by protecting storage. Therefore, it enforces the O.AUDIT_ACCESS.AUTHORIZE Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 28 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Security Objectives for TOE Rationale D equivalent or more restrictive security functionality of the TOE. It satisfies the “demonstrable conformance” O.FAX_DATA.FORMAT The security objectives are additionally defined in this ST. Therefore, it enforces the equivalent or more restrictive security functionality of the TOE. It satisfies the “demonstrable conformance”. O.INFO.FLOW_CONTROLED O.TIME_STAMP.RELIABLE Table 10: Security Objectives related Conformance Claim Rationale– Security Objectives for the Operational Environment Security Objectives for Operational Environment Rationale OE.PHYSICAL.MANAGED Equal to the PP: the security objectives in this ST are defined the same as the PP. Therefore, it satisfies the “demonstrable conformance”. . OE.USER.AUTHORIZED OE.USER.TRAINED OE.ADMIN.TRAINED OE.ADMIN.TRUSTED OE.AUDIT.REVIEWED OE.INTERFACE.MANAGED OE.NETWORK.TRUST Additionally defined in this ST and these security objectives for operational environment enhanced the security of the operational environment of the TOE. It satisfies the “demonstrable conformance” because it defines the equivalent or more restrictive environment to support TSF OE.AUTH_SERVER.SECURE OE.EXT_SERVER.SECURE OE.SSL_CERT.INSTALL OE.IPSEC_EXT.SERVER OE.SSL_CLIENT.PC 2.4.3 Security Functional Requirements related Conformance Claim Rationale The security functional requirements related conformance claim rationale is as shown in Table 11 below: Table 11: Security Functional Requirements related Conformance Claim Rationale Category PP SFR ST SFR Rationale Common Requirem ents from the PP FAU_GEN.1 FAU_GEN.1 Equal to the PP: in this ST, the operations allowed in the PP on SFR were performed. It satisfies the “demonstrable conformance”. FAU_GEN.2 FAU_GEN.2 FDP_ACC.1(a) FDP_ACC.1(1) FDP_ACC.1(b) FDP_ACC.1(2) FDP_ACF.1(a) FDP_ACF.1(1) FDP_ACF.1(b) FDP_ACF.1(2) FDP_RIP.1 FDP_RIP.1 FIA_ATD.1 FIA_ATD.1 FIA_UAU.1 FIA_UAU.1 Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 29 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Category PP SFR ST SFR Rationale FIA_UID.1 FIA_UAU.1 Equal to the PP: in this ST, the operations allowed in the PP on SFR were performed. It satisfies the “demonstrable conformance”. FIA_USB.1 FIA_USB.1 FMT_MSA.1(a)(b) FMT_MSA.1(1)(2) FMT_MSA.3(a)(b) FMT_MSA.3(1)(2) FMT_MTD.1 FMT_MTD.1 FMT_SMF.1 FMT_SMF.1 FMT_SMR.1 FMT_SMR.1 FPT_TST.1 FPT_TST.1 FTA_SSL.3 FTA_SSL.3 FPT_STM.1 FPT_STM.1 PRT Package Requirem ents from the PP FDP_ACC.1 FDP_ACC.1(1)(2)(3) Equal to the PP: in this ST, the operations allowed in the PP on SFR were performed. It satisfies the “demonstrable conformance”. FDP_ACF.1 FDP_ACF.1(1)(2)(3) SCN Package Requirem ents from the PP FDP_ACC.1 FDP_ACC.1(1)(2)(3) FDP_ACF.1 FDP_ACF.1(1)(2)(3) CPY Package Requirem ents from the PP FDP_ACC.1 FDP_ACC.1(1)(2)(3) FDP_ACF.1 FDP_ACF.1(1)(2)(3) FAX Package Requirem ents from the PP FDP_ACC.1 FDP_ACC.1(1)(2)(3) FDP_ACF.1 FDP_ACF.1(1)(2)(3) DSR Package Requirem ents from the PP FDP_ACC.1 FDP_ACC.1(1)(2)(3) FDP_ACF.1 FDP_ACF.1(1)(2)(3) SMI Package Requirem ents from the PP FAU_GEN.1 FAU_GEN.1 FPT_FDI_EXP.1 FPT_FDI_EXP.1 FTP_ITC.1 FTP_ITC.1 Addition - FAU_SAR.1 These SFRs do not exist in PP. We added SFRs. Therefore, it satisfies the “demonstrable conformance” since we enforce the equivalent or more restrictive SFRs. - FAU_SAR.2 - FAU_SEL.1 - FAU_STG.1 - FAU_STG.4 FCS_CKM.1(1) FCS_CKM.1(2) Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 30 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Category PP SFR ST SFR Rationale - FCS_CKM.4(1)(2) - FCS_COP.1(1)(2) - FIA_AFL.1 - FIA_UAU.7 - FDP_ETC.1 - FDP_IFC.1(1)(2)(3)(4)(5 ) - FDP_IFF.1(1)(2)(3)(4)(5 ) 2.4.4 Security Assurance Requirements related Conformance Claim Rationale The security assurance requirements related conformance claim rationale is as shown in Table 12 below: Table 12: Security Assurance Requirements related Conformance Claim Rationale PP SAR ST SAR Rationale Assurance Package: EAL3 augmented by ALC_FLR.2 Assurance Package: EAL3 augmented by ALC_FLR.2 Equal to the PP. Therefore, it satisfies the “demonstrable conformance”. 2.4.5 TOE type related Conformance Claim Rationale This section demonstrates that the TOE type is consistent with the TOE type in the PPs for which conformance is being claimed. TOE Type [PP] TOE Type Rationale This TOE is MFPs (Multi-Function Peripherals) as an IT product. It controls the operation of the entire MFP, including copy, print, scan, and fax functions on the MFP controller. This TOE is MFP (Multi-Function Peripherals) as an IT product. It controls the operation of the entire MFP, including copy, print, scan, and fax functions on the MFP controller. The TOE controls the operation of the whole MFP including copy, print, scan, and fax jobs on the MFP controller. Therefore, the TOE type is consistent with the PP, and satisfies the “demonstrable conformance”. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 31 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 3 Security Problem Definition This chapter defines assumptions, organizational security policies, and threats intended for the TOE and TOE operational environments to manage. 3.1 Threats agents The threats agents are users that can adversely access the internal asset or harm the internal asset in an abnormal way. The threats have an attacker possessing a basic attack potential, standard equipment, and motive. The threats that are described in this chapter will be resolved by security objectives in chapter 4. The following are the threat agents defined in this ST: - Persons who are not permitted to use the TOE who may attempt to use the TOE. - Persons who are authorized to use the TOE who may attempt to use TOE functions for which they are not authorized. - Persons who are authorized to use the TOE who may attempt to access data in ways for which they are not authorized. - Persons who unintentionally cause a software malfunction that may expose the TOE to unanticipated threats. 3.1.1 Objects (Assets) Objects are passive entities in the TOE, that contain or receive information, and upon which Subjects perform Operations. In this ST, Objects are equivalent to TOE Assets. There are three types of Objects: User Data, TSF Data, and Functions. User Data User Data are data created by and for Users and do not affect the operation of the TOE Security Functionality (TSF). This type of data is composed of two objects: User Document Data and User Function Data. Table 13: User Data Designation Definition D.DOC User Document Data consist of the information contained in a user’s document. This includes the original document itself (in either hardcopy or electronic form), image data, or residually-stored data created by the hardcopy device while processing an original document and printed hardcopy output. D.FUNC User Function Data are the information about a user’s document or job to be processed by the TOE. TSF Data TSF Data are data created by and for the TOE and that might affect the operation of the TOE. This type of data is composed of two objects: TSF Protected Data and TSF Confidential Data. Table 14: TSF Data Designation PP Definition Asset Under Protection Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 32 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved D.PROT TSF Protected Data are assets for which alteration by a User who is neither an Administrator nor the owner of the data would have an effect on the operational security of the TOE but for which disclosure is acceptable. None D.CONF TSF Confidential Data are assets for which neither disclosure nor alteration by a User who is neither an Administrator nor the owner of the data would have an effect on the operational security of the TOE. The setting information that shall be only set and by U.ADMINISTRATOR which are system security, network security, user access control listed on Table 33, Table 34, Table 35, Table 36. Functions Functions perform processing, storage, and transmission of data that may be present in the MFP products. : Table 15:Functions Definition F.PRT Printing: a function in which electronic document input is converted to physical document output F.SCN Scanning: a function in which physical document input is converted to electronic document output F.CPY Copying: a function in which physical document input is duplicated to physical document output F.FAX Faxing: a function in which physical document input is converted to a telephone-based document facsimile (fax) transmission, and a function in which a telephone-based document facsimile (fax) reception is converted to physical document output F.DSR Document storage and retrieval: a function in which a document is stored during one job and retrieved during one or more subsequent jobs F.SMI Shared-medium interface: a function that transmits or receives User Data or TSF Data over a communications medium which, in conventional practice, is or can be simultaneously accessed by multiple users, such as wired network media and most radio-frequency wireless media Attributes When a function is performing processing, storage, or transmission of data, the identity of the function is associated with that particular data as a security attribute. This attribute in the TOE model makes it possible to distinguish differences in Security Functional Requirements that depend on the function being performed. Table 16:Attributes Designation Definition +PRT Indicates data that are associated with a print job. +SCN Indicates data that are associated with a scan job. +CPY Indicates data that are associated with a copy job. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 33 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Designation Definition +PRT Indicates data that are associated with a print job. +SCN Indicates data that are associated with a scan job. +CPY Indicates data that are associated with a copy job. +FAXIN Indicates data that are associated with an inbound (received) fax job. +FAXOUT Indicates data that are associated with an outbound (sent) fax job. +DSR Indicates data that are associated with a document storage and retrieval job. +SMI Indicates data that are transmitted or received over a shared-medium interface. Operations Operations are a specific type of action performed by a Subject on an Object. In this ST, five types of operations are considered: those that result in disclosure of information (Read), those that result in alteration of information (Create, Modify, Delete), and those that invoke a function (Execute). External Entities Table 17: External Entities Designation Definition Kerberos Server It is the authentication server via Kerberos. The authentication servers identify and authenticate U.NORMAL if remote authentication mode is enabled LDAP Server It is the authentication server via LDAP. The authentication servers identify and authenticate U.NORMAL if remote authentication mode is enabled SMB Server It is the authentication server via SMB. The authentication servers identify and authenticate U.NORMAL if remote authentication mode is enabled The MFP send received fax and scan data from the TOE to a server via SMB FTP Server The MFP send received fax and scan data from the TOE to a server via FTP Mail Server The MFP send received fax and scan data from the TOE to a server via a Mail server Channels Channels are the mechanisms through which data can be transferred into and out of the TOE. - Private Medium Interface: mechanisms for exchanging information that use (1) wired or wireless electronic methods over a communications medium which, in conventional practice, is not accessed by multiple simultaneous Users; or, (2) Operator Panel and displays that are part of the TOE. It is an input-output channel. - Original Document Handler: mechanisms for transferring User Document Data into the TOE in hardcopy form. It is an input channel. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 34 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved - Hardcopy Output Handler: mechanisms for transferring User Document Data out of the TOE in hardcopy form. It is an output channel. - Shared-medium Interface: User Data or TSF Data between the HCD and external devices over communications media which, in conventional practice, is or can be simultaneously accessed by multiple users 3.1.2 Threats to TOE Assets The threats taken from the PP to which this Security Target conforms are as shown in Table 18 and Table 19 (Refer to chapter 5 about affected asset): Table 18: Threats to User Data for the TOE Threats Affected Asset Description T.DOC.DIS D.DOC User Document Data may be disclosed to unauthorized persons T.DOC.ALT D.DOC User Document Data may be altered by unauthorized persons T.FUNC.ALT D.FUNC User Function Data may be altered by unauthorized persons Table 19: Threats to TSF Data for the TOE Threats Affected Asset Description T.PROT.ALT D.PROT TSF Protected Data may be altered by unauthorized persons T.CONF.DIS D.CONF TSF Confidential Data may be disclosed to unauthorized persons T.CONF.ALT D.CONF TSF Confidential Data may be altered by unauthorized persons 3.2 Organizational Security Policies This chapter describes the Organizational Security Policies (OSPs) that apply to the TOE. OSPs are used to provide a basis for Security Objectives that are commonly desired by TOE Owners in this operational environment but for which it is not practical to universally define the assets being protected or the threats to those assets. This Security Target conforms to all organizational security policies mentioned in the PP. There are no additional organizational security policies in this Security Target. Table 20: Organizational Security Policies Name Definition P.USER.AUTHORIZATION To preserve operational accountability and security, Users will be authorized to use the TOE only as permitted by the TOE Owner. P.SOFTWARE.VERIFICATION To detect corruption of the executable code in the TSF, procedures will exist to self-verify executable code in Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 35 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Name Definition the TSF. P.AUDIT.LOGGING To preserve operational accountability and security, records that provide an audit trail of TOE use and security-relevant events will be created, maintained, and protected from unauthorized disclosure or alteration, and will be reviewed by authorized personnel. P.INTERFACE.MANAGEMENT To prevent unauthorized use of the external interfaces of the TOE, operation of those interfaces will be controlled by the TOE and its IT environment. 3.3 Assumptions The following conditions are assumed to exist in the operational environment of the TOE. This Security Target conforms to all assumptions in the PP. 3.3.1 Assumptions for the TOE The assumptions taken from the PP to which this Security Target conforms are as shown in the following Table 2121 Table 21: Assumptions for the TOE Assumption Definition A.ACCESS.MANAGED The TOE is located in a restricted or monitored environment that provides protection from unmanaged access to the physical components and data interfaces of the TOE. A.USER.TRAINING TOE Users are aware of the security policies and procedures of their organization and are trained and competent to follow those policies and procedures. A.ADMIN.TRAINING Administrators are aware of the security policies and procedures of their organization, are trained and competent to follow the manufacturer’s guidance and documentation, and to correctly configure and operate the TOE in accordance with those policies and procedures. A.ADMIN.TRUST Administrators do not use their privileged access rights for malicious purposes. 3.3.2 Assumptions for the TOE (Additional) The assumptions for the TOE additionally defined are as follows: Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 36 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Table 22: Assumptions for the TOE (Additional) Objective Definition A.NETWORK.TRUST A firewall is installed between the internal network and the external network to protect the TOE from intrusion from outside. A.AUTH_SERVER.SECURE The authentication servers (i.e. LDAP, Kerberos, and SMB Server) provide a secure remote authentication for U.NORMAL. A.EXT_SERVER.SECURE The FTP, SMB server, and mail servers that store fax and scan data transmitted from the TOE are managed securely. A.SSL_CERT.INSTALL Certificate for SSL communication is installed by U.ADMINISTRATOR and the TOE is managed through the secure channel. A.IPSEC_EXT.SERVER All of the external servers(Storage, Authentication Server) that connected with the TOE via network supports IPSEC. A. SSL_CLIENT.PC All of the client PCs that connected with the TOE via network supports SSL. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 37 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 4 Security Objectives The security objectives are categorized into two parts: - The security objectives for the TOE are to meet the goal to counter all threats and enforce all organizational security policies defined in this ST. - The security objectives for the operational environment are based on technical/ procedural measures supported by the IT environment and the non-IT environment for the TOE to provide the security functionalities correctly. 4.1 Security Objectives for the TOE This section identifies and describes the security objectives for the TOE. This Security Target takes all the security objectives for the TOE from the PP. 4.1.1 Security Objectives for the TOE This section describes the Security Objectives that the TOE shall fulfill. They are completely the same as the PP. Table 23: Security Objectives for the TOE Objective Definition O.DOC.NO_DIS The TOE shall protect User Document Data from unauthorized disclosure. O.DOC.NO_ALT The TOE shall protect User Document Data from unauthorized alteration. O.FUNC.NO_ALT The TOE shall protect User Function Data from unauthorized alteration. O.PROT.NO_ALT The TOE shall protect TSF Protected Data from unauthorized alteration. O.CONF.NO_DIS The TOE shall protect TSF Confidential Data from unauthorized disclosure. O.CONF.NO_ALT The TOE shall protect TSF Confidential Data from unauthorized alteration. O.USER.AUTHORIZED The TOE shall require identification and authentication of Users and shall ensure that Users are authorized in accordance with security policies before allowing them to use the TOE. O.INTERFACE.MANAGED The TOE shall manage the operation of external interfaces in accordance with security policies. O.SOFTWARE.VERIFIED The TOE shall provide procedures to self-verify executable code in the TSF. O.AUDIT.LOGGED The TOE shall create and maintain a log of TOE use and security-relevant events and prevent its unauthorized disclosure or alteration. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 38 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 4.1.2 Security Objectives for the TOE (Additional) The security objectives for the TOE additionally defined are as follows: Table 24: Security Objectives for the TOE (Additional) Objective Definition O.AUDIT_STORAGE.PROTECTED The TOE shall protect audit records from unauthorized access, deletion and modification. O.AUDIT_ACCESS.AUTHORIZED The TOE shall allow access to audit records only by authorized persons. O.DATA.ENCRYPTED The TOE shall encrypt the data to be stored on the HDD so that they cannot be analyzed even if retrieved. O.DATA.OVERWRITTEN The TOE shall provide image overwrite to protect the used document data on the HDD from being recovered. O.INFO.FLOW_CONTROLED The TOE shall control inflowing information data that are not allowed from external networks. O.TIME_STAMP.RELIABLE The TOE shall provides a reliable time stamp for recording correct security audit log entries 4.2 Security Objectives for Operational Environment This section describes the Security Objectives that must be fulfilled by technical and procedural measures in the operational environment of the TOE. This Security Target conforms to the security objectives for the operational environment included in the PP. 4.2.1 Security Objectives for Operational Environment The security objectives for the operational environment taken from the PP to which this Security Target conforms are as shown in the following Table 25 (they are completely the same as the PP): Table 25: Security Objectives for Operational Environment Objective Definition OE.INTERFACE.MANAGED The IT environment shall provide protection from unmanaged access to TOE external interfaces. OE.PHYSICAL.MANAGED The TOE shall be placed in a secure or monitored area that provides protection from unmanaged physical access to the TOE. OE.USER.AUTHORIZED The TOE Owner shall grant permission to Users to be authorized to use the TOE according to the security policies and procedures of their organization. OE.USER.TRAINED The TOE Owner shall ensure that TOE Administrators are aware of the security policies and procedures of their organization and have the training and competency to Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 39 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Objective Definition follow those policies and procedures. OE.ADMIN.TRAINED The TOE Owner shall ensure that TOE Administrators are aware of the security policies and procedures of their organization; have the training, competency, and time to follow the manufacturer’s guidance and documentation; and correctly configure and operate the TOE in accordance with those policies and procedures. OE.ADMIN.TRUSTED The TOE Owner shall establish trust that TOE Administrators will not use their privileged access rights for malicious purposes. OE.AUDIT.REVIEWED The TOE Owner shall ensure that audit logs are reviewed at appropriate intervals for security violations or unusual patterns of activity. 4.2.2 Security Objectives for Operational Environment (Additional) The security objectives for operational environments additionally defined are as follows: Table 26: Security Objectives for the IT Environment Objective Definition OE.NETWORK.TRUST A firewall system shall be installed between the internal network and external networks to protect the TOE from intrusion from outside. OE.AUTH_SERVER.SECURE The authentication servers (i.e. LDAP, Kerberos, and SMB Servers) shall provide secure remote authentication for U.NORMAL. OE.EXT_SERVER.SECURE FTP server, and mail servers that store fax and scan data transmitted from the TOE shall be managed securely. OE.SSL_CERT.INSTALL U.ADMINISTRATOR shall manage TOE through a secure channel after the certificate for SSL communication is installed in the TOE. OE.IPSEC_EXT.SERVER All of the external servers(NTP, Storage, Authentication Server) that connected with the TOE via network shall provide secure channel via IPSEC. OE.SSL_CLIENT.PC All of the client pc that connected with the TOE via network shall provide secure channel via SSL. 4.3 Security Objectives Rationale This section demonstrates that each threat, organizational security policy, and assumption is mitigated by at least one security objective and that those security objectives counter the threats, enforce the policies, and uphold the assumptions. Table 27 shows the correspondences of security objectives, Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 40 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved assumptions, threats, and organizational security policies. Table 28 shows that each security problem is covered by the defined security objectives. Table 27: Completeness of Security Objectives Threats/ Policies/ Assumptions O.DOC.NO_DIS O.DOC.NO_ALT O.FUNC.NO_ALT O.PROT.NO_ALT O.CONF.NO_DIS O.CONF.NO_ALT O.USER.AUTHORIZED OE.USER.AUTHORIZED O.SOFTWARE.VERIFIED O.AUDIT.LOGGED O.AUDIT_STORAGE.PROTECTED O.AUDIT_ACCESS.AUTHORIZED O.DATA.ENCRYPTED O.DATA.OVERWRITTEN O.INFO.FLOW_CONTROLED O.TIME_STAMP.RELIABLE OE.AUDIT.REVIEWED O.INTERFACE.MANAGED OE.PHYSICAL.MANAGED OE.INTERFACE.MANAGED OE.ADMIN.TRAINED OE.ADMIN.TRUSTED OE.USER.TRAINED OE.NETWORK.TRUST OE.AUTH_SERVER.SECURE OE.EXT_SERVER.SECURE OE.SSL_CERT.INSTALL OE.IPSEC_EXT.SERVER OE.SSL_CLIENT.PC T.DOC.DIS      T.DOC.ALT    T.FUNC.ALT    T.PROT.ALT    T.CONF.DIS      T.CONF.ALT    P.USER.AUTHORI ZATION   P.SOFTWARE.VE RIFICATION  P.AUDIT.LOGGIN G      P.INTERFACE. MANAGEMENT    A.ACCESS.MANA GED  A.ADMIN.TRAINI NG  A.ADMIN.TRUST  A.USER.TRAININ G  A.NETWORK.TRU ST  A.AUTH_SERVER. SECURE  A.EXT_SERVER.S ECURE  A.SSL_CERT.INST ALL  A.IPSEC_EXT.SER VER  A.SSL_CLIENT. PC  Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 41 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Table 28: Sufficiency of Security Objectives Threats, Policies, and Assumptions Summary Objectives and Rationale T.DOC.DIS User Document Data may be disclosed to unauthorized persons O.DATA.ENCRYPTED protects D.DOC from unauthorized disclosure O.DATA.OVERWRITTEN protects D.DOC from unauthorized disclosure O.DOC.NO_DIS protects D.DOC from unauthorized disclosure O.USER.AUTHORIZED establishes user identification and authentication as the basis for authorization OE.USER.AUTHORIZED establishes responsibility of the TOE Owner to appropriately grant authorization T.DOC.ALT User Document Data may be altered by unauthorized persons O.DOC.NO_ALT protects D.DOC from unauthorized alteration O.USER.AUTHORIZED establishes user identification and authentication as the basis for authorization OE.USER.AUTHORIZED establishes responsibility of the TOE Owner to appropriately grant authorization T.FUNC.ALT User Function Data may be altered by unauthorized persons O.FUNC.NO_ALT protects D.FUNC from unauthorized alteration O.USER.AUTHORIZED establishes user identification and authentication as the basis for authorization OE.USER.AUTHORIZED establishes responsibility of the TOE Owner to appropriately grant authorization T.PROT.ALT TSF Protected Data may be altered by unauthorized persons O.PROT.NO_ALT protects D.PROT from unauthorized alteration O.USER.AUTHORIZED establishes user identification and authentication as the basis for authorization OE.USER.AUTHORIZED establishes responsibility of the TOE Owner to appropriately grant authorization T.CONF.DIS TSF Confidential Data may be disclosed to unauthorized persons O.DATA.ENCRYPTION protects TSF data from unauthorized disclosure O.DATA.OVERWRITTEN protects D.DOC from unauthorized disclosure. O.CONF.NO_DIS protects D.CONF from unauthorized disclosure. O.USER.AUTHORIZED establishes user identification and authentication as the basis for authorization. OE.USER.AUTHORIZED establishes Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 42 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Threats, Policies, and Assumptions Summary Objectives and Rationale responsibility of the TOE Owner to appropriately grant authorization. T.CONF.ALT TSF Confidential Data may be altered by unauthorized persons O.CONF.NO_ALT protects D.CONF from unauthorized alteration. O.USER.AUTHORIZED establishes user identification and authentication as the basis for authorization. OE.USER.AUTHORIZED establishes responsibility of the TOE Owner to appropriately grant authorization. P.USER.AUTHOR IZATION Users will be authorized to use the TOE O.USER.AUTHORIZED establishes user identification and authentication as the basis for authorization to use the TOE. OE.USER.AUTHORIZED establishes responsibility of the TOE Owner to appropriately grant authorization P.SOFTWARE.VE RIFICATION Procedures will exist to self- verify executable code in the TSF O.SOFTWARE.VERIFIED provides procedures to self-verify executable code in the TSF. P.AUDIT.LOGGI NG An audit trail of TOE use and security-relevant events will be created, maintained, protected, and reviewed O.AUDIT.LOGGED creates and maintains a log of TOE use and security- relevant events, and prevents unauthorized disclosure or alteration O.AUDIT_STORAGE.PROTEDTED protects audit records from unauthorized access, deletion, and modification. O.AUDIT_ACCESS.AUTHORIZED allows the access of audit records only by authorized persons, O.TIME_STAMP.RELIABLE allows the reliable time stamp for recording correct security audit log entries OE.AUDIT.REVIEWED establishes responsibility of the TOE Owner to ensure that audit logs are appropriately reviewed. P.INTERFACAE. MANAGEMENT Operation of external interfaces will be controlled by the TOE and its IT environment O.INTERFACE.MANAGED manages the operation of external interfaces in accordance with security policies. OE.INTERFACE.MANAGED establishes a protected environment for TOE external interfaces O.INFO.FLOW_CONTROLED protects Malicious data through network. A.ACCESS.MAN AGED The TOE environment provides protection from OE.PHYSICAL.MANAGED establishes a protected physical environment for the Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 43 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Threats, Policies, and Assumptions Summary Objectives and Rationale unmanaged access to the physical components and data interfaces of the TOE TOE. A.ADMIN.TRAIN ING Administrators are aware of and trained to follow security policies and procedures OE.ADMIN.TRAINED establishes responsibility of the TOE Owner to provide appropriate Administrator training. A.ADMIN.TRUST Administrators do not use their privileged access rights for malicious purposes OE.ADMIN.TRUST establishes responsibility of the TOE Owner to have a trusted relationship with Administrators. A.USER.TRAINI NG TOE Users are aware of and trained to follow security policies and procedures OE.USER.TRAINED establishes responsibility of the TOE Owner to provide appropriate user training. A.NETWORK.TR UST A firewall system is installed between internal network and external network to protect the TOE from inward intrusion from outside. OE.NETWORK.TRUST ensures that a firewall system is installed between the internal network and external networks. A.AUTH_SERVE R.SECURE The authentication servers (i.e. LDAP, Kerberos, and SMB Server) provide a secure remote authentication for U.NORMAL. OE.AUTH_SERVER.SECURE ensures that the authentication servers (i.e. LDAP, Kerberos, and SMB Servers) provide a secure remote authentication for U.NORMAL. A.EXT_SERVER. SECURE FTP server and mail server which store fax and scan data transmitted from the TOE are managed securely. OE.EXT_SERVER.SECURE ensures that FTP and SMB server and mail servers that store fax and scan data transmitted from the TOE are managed securely. A.SSL_CERT.INS TALL Certificate for SSL communication is installed by U.ADMINISTRATOR and the TOE is managed through the secure channel. OE.SSL_CERT.INSTALL ensures that U.ADMINISTRATOR shall manage the TOE through a secure channel after the certificate for SSL communication is installed in the TOE. A.IPSEC_EXT.SE RVER All of the external servers that communicates with the TOE support IPSEC. OE.IPSEC_EXT.SERVER ensures that all of the external servers that communicates with the TOE support IPSEC. A.SSL_CLIENT.P C All of the client PCs that communicates with the TOE support SSL. OE. SSL_CLIENT.PC ensures that all of the client PCs that communicates with the TOE support SSL. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 44 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 5 Extended Component Definition 5.1 FPT_FDI_EXP Restricted forwarding of data to external interfaces Family behaviour: This family defines requirements for the TSF to restrict direct forwarding of information from one external interface to another external interface. Many products receive information on specific external interfaces and are intended to transform and process this information before it is transmitted on another external interface. However, some products may provide the capability for attackers to misuse external interfaces to violate the security of the TOE or devices that are connected to the TOE’s external interfaces. Therefore, direct forwarding of unprocessed data between different external interfaces is forbidden unless explicitly allowed by an authorized administrative role. The family FPT_FDI_EXP has been defined to specify this kind of functionality. Component leveling: FPT_FDI_EXP.1 Restricted forwarding of data to external interfaces provides for the functionality to require TSF controlled processing of data received over defined external interfaces before these data are sent out on another external interface. Direct forwarding of data from one external interface to another one requires explicit allowance by an authorized administrative role. Management: FPT_FDI_EXP.1 The following actions could be considered for the management functions in FMT: a) Definition of the role(s) that are allowed to perform the management activities b) Management of the conditions under which direct forwarding can be allowed by an administrative role c) Revocation of such an allowance Audit: FPT_FDI_EXP.1 The following actions should be auditable if FAU_GEN Security Audit Data Generation is included in the PP/ST: There are no auditable events foreseen. Rationale: Quite often, a TOE is supposed to perform specific checks and process data received on one external interface before such (processed) data are allowed to be transferred to another external interface. Examples are firewall systems but also other systems that require a specific work flow for the incoming data before it can be transferred. Direct forwarding of such data (i.e., without processing the data first) between different external interfaces is therefore a function that—if allowed at all—can only be allowed by an authorized role. It has been viewed as useful to have this functionality as a single component that allows specifying the property to disallow direct forwarding and require that only an authorized role can allow this. Since this is a function that is quite common for a number of products, it has been viewed as useful to define an extended component. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 45 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved The Common Criteria defines attribute-based control of user data flow in its FDP class. However, in this Protection Profile, the authors needed to express the control of both user data and TSF data flow using administrative control instead of attribute-based control. It was found that using FDP_IFF and FDP_IFC for this purpose resulted in SFRs that were either too implementation-specific for a Protection Profile or too unwieldy for refinement in a Security Target. Therefore, the authors decided to define an extended component to address this functionality. This extended component protects both user data and TSF data, and it could therefore be placed in either the FDP or the FPT class. Since its purpose is to protect the TOE from misuse, the authors believed that it was most appropriate to place it in the FPT class. It did not fit well in any of the existing families in either class, and this led the authors to define a new family with just one member. FPT_FDI_EXP.1 Restricted forwarding of data to external interfaces Hierarchical to: No other components Dependencies: FMT_SMF.1 Specification of Management Functions FMT_SMR.1 Security roles FPT_FDI_EXP.1.1 The TSF shall provide the capability to restrict data received on [assignment: list of external interfaces] from being forwarded without further processing by the TSF to [assignment: list of external interfaces]. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 46 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 6 Security Requirements 6.1 Security Functional Requirements The security functional requirements defined in this Security Target conform to the PP. Additional security functional requirements in this ST not defined in the PP are based on the functional requirements in Part 2 of the Common Criteria. Table 29 summarizes the security functional requirements defined by this ST. Table 29: Security Functional Requirements Class Component Defined in Security Audit FAU_GEN.1 Audit data generation PP FAU_GEN.2 User identity association PP FAU_SAR.1 Audit review This ST additionally FAU_SAR.2 Restricted audit review This ST additionally FAU_SEL.1 Selective audit This ST additionally FAU_STG.1 Protected audit trail storage This ST additionally FAU_STG.4 Prevention of audit data loss This ST additionally Cryptographic Support FCS_CKM.1(1) Cryptographic key generation This ST additionally FCS_CKM.1(2) Cryptographic key generation This ST additionally FCS_CKM.4(1) Cryptographic key destruction This ST additionally FCS_CKM.4(2) Cryptographic key destruction This ST additionally FCS_COP.1(1) Cryptographic operation This ST additionally FCS_COP.1(2) Cryptographic operation This ST additionally User Data Protection FDP_ACC.1(1)(2)(3) Subset access control PP PRT package SCN package CPY package FAX package DSR package Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 47 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Class Component Defined in FDP_ACF.1(1)(2)(3) Security attribute based access control PP PRT package SCN package CPY package FAX package DSR package FDP_ETC.1 Export of user data without security attributes This ST additionally FDP_IFC.1(1)(2)(3)(4)(5) Subset information flow control This ST additionally FDP_IFF.1(1)(2)(3)(4)(5) Simple security attributes This ST additionally FDP_RIP.1 Subset residual information protection PP Identification and Authentication FIA_AFL.1 Authentication failure handling This ST additionally FIA_ATD.1 User attribute definition PP FIA_UAU.1 Enforces authorization by requiring user authentication. PP FIA_UAU.7 Protected authentication feedback This ST additionally FIA_UID.1 User identification before any action PP FIA_USB.1 User-subject binding PP Security Management FMT_MOF.1 Management of functions in TSF This ST additionally FMT_MSA.1(1) Management of security attributes PP FMT_MSA.1(2) Management of security attributes PP FMT_MSA.3(1)(2) Static attribute initialization PP FMT_MTD.1 Management of TSF data PP FMT_SMF.1 Specification of management functions PP FMT_SMR.1 Security roles PP Protection of the TSF FPT_STM.1 Reliable time stamps PP FPT_TST.1 TSF testing PP FPT_FDI_EXP.1 Restricted forwarding of data to external interfaces PP Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 48 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Class Component Defined in TOE Access FTA_SSL.3 TSF-initiated termination PP Trusted paths/channels FTP_ITC.1 Inter-TSF trusted channel PP 6.1.1 Class FAU: Security Audit 6.1.1.1 FAU_GEN.1 Audit data generation Hierarchical to: No other components. Dependencies: FPT_STM.1 Reliable time stamps FAU_GEN.1.1 The TSF shall be able to generate an audit record of the following auditable events: a) Start-up and shutdown of the audit functions; and b) All auditable events for the not specified level of audit; and c) All Auditable Events as each is defined for its Audit Level (if one is specified) for the Relevant SFR in Table 30; [The Auditable Events specified in Table 30 below]. FAU_GEN.1.2 The TSF shall record within each audit record at least the following information: a) Date and time of the event, type of event, subject identity (if applicable), and the outcome (success or failure) of the event; and b) For each audit event type, based on the auditable event definitions of the functional components included in the PP/ST, for each Relevant SFR listed in Table 30: (1) information as defined by its Audit Level (if one is specified), and (2) all Additional Information (if any is required); [none]. Table 30: Audit data Auditable Events Relevant SFR Audit Level Additional Information Job completion FDP_ACF.1 Not specified -Type of job Both successful and unsuccessful use of the authentication mechanism FIA_UAU.1 Basic None required Use of the management functions - Log Enable/Disable - Log Data Access - Management of User Information FMT_SMF.1 Minimum None required Both successful and unsuccessful use of the identification FIA_UID.1 Basic Attempted user identity, if available Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 49 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Locking of an interactive session by the locking mechanism FTA_SSL.3 Minimum None required Execution of the TSF self tests and the results of the tests FPT_TST.1 Not specified None required Manual Image Overwrite FDP_RIP.1 Not specified None required Failure of the trusted channel functions FTP_ITC.1 Minimum None required 6.1.1.2 FAU_GEN.2 User identity association Hierarchical to: No other components. Dependencies: FAU_GEN.1 Audit data generation FIA_UID.1 Timing of identification FAU_GEN.2.1 For audit events resulting from actions of identified users, the TSF shall be able to associate each auditable event with the identity of the user that caused the event. 6.1.1.3 FAU_SAR.1 Audit review Hierarchical to: No other components. Dependencies: FAU_GEN.1 Audit data generation FAU_SAR.1.1 The TSF shall provide [U.ADMINISTRATOR] with the capability to read [all of audit information] from the audit records. FAU_SAR.1.2 The TSF shall provide the audit records in a manner suitable for the user to interpret the information. 6.1.1.4 FAU_SAR.2 Restricted audit review Hierarchical to: No other components. Dependencies: FAU_SAR.1 Audit review FAU_SAR.2.1 The TSF shall prohibit all users read access to the audit records, except those users that have been granted explicit read-access. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 50 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 6.1.1.5 FAU_SEL.1 Selective audit Hierarchical to: No other components. Dependencies: FAU_GEN.1 Audit data generation FMT_MTD.1 Management of TSF data FAU_SEL.1.1 The TSF shall be able to select the set of events to be audited from the set of all auditable events based on the following attributes: a) event type b) [none] 6.1.1.6 FAU_STG.1 Protected audit trail storage Hierarchical to: No other components. Dependencies: FAU_GEN.1 Audit data generation FAU_STG.1.1 The TSF shall protect the stored audit records in the audit trail from unauthorized deletion. FAU_STG.1.2 The TSF shall be able to prevent unauthorized modifications to the stored audit records in the audit trail. 6.1.1.7 FAU_STG.4 Prevention of audit data loss Hierarchical to: FAU_STG.3 Action in case of possible audit data loss Dependencies: FAU_STG.1 Protected audit trail storage FAU_STG.4.1 The TSF shall overwrite the oldest stored audit records and [none] if the audit trail is full. 6.1.2 Class FCS: Cryptographic support 6.1.2.1 FCS_CKM.1(1) Cryptographic key generation Hierarchical to: No other components. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 51 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Dependencies: [FCS_CKM.2 Cryptographic distribution or FCS_COP.1 Cryptographic operation] FCS_CKM.4 Cryptographic key destruction FCS_CKM.1.1(1) The TSF shall generate cryptographic keys in accordance with a specified cryptographic key generation algorithm [random key generation method] and specified cryptographic key sizes [256-bit] that meet the following: [None]. 6.1.2.2 FCS_CKM.1(2) Cryptographic key generation Hierarchical to: No other components. Dependencies: [FCS_CKM.2 Cryptographic distribution or FCS_COP.1 Cryptographic operation] FCS_CKM.4 Cryptographic key destruction FCS_CKM.1.1(2) The TSF shall generate cryptographic keys in accordance with ryptographic key generation algorithm [Diffie-Hellman algorithm] during communication and specified cryptographic key sizes [768 or 1024 or 2048] that meet the following: [None]. 6.1.2.3 FCS_CKM.4(1) Cryptographic key destruction Hierarchical to: No other components. Dependencies: [FDP_ITC.1 or FDP_ITC.2 or FCS_CKM.1Cryptographic key generation] FCS_CKM.4.1(1) The TSF shall destroy cryptographic keys in accordance with a specified cryptographic key destruction method [overwrite used cryptographic key using new generation cryptographic key, previous cryptographic keys will be overwritten with a newly generated key] that meets the following: [None]. 6.1.2.4 FCS_CKM.4(2) Cryptographic key destruction Hierarchical to: No other components. Dependencies: [FDP_ITC.1 or FDP_ITC.2 or FCS_CKM.1Cryptographic key generation] FCS_CKM.4.1(2) The TSF shall destroy cryptographic keys in accordance with a specified cryptographic key destruction method [overwrite existing Pre-shared key using new generation Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 52 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved cryptographic key, previous cryptographic keys will be overwritten with a newly generated key] that meets the following: [None]. 6.1.2.5 FCS_COP.1(1) Cryptographic operation Hierarchical to: No other components. Dependencies: [FDP_ITC.1 or FDP_ITC.2 or FCS_CKM.1Cryptographic key generation] FCS_CKM.4 Cryptographic key destruction FCS_COP.1.1(1) The TSF shall perform [cryptographic operation of data in HDD] in accordance with a specified cryptographic algorithm [AES] and cryptographic key sizes [256-bit] that meet the following: [FIPS PUB 197]. 6.1.2.6 FCS_COP.1(2) Cryptographic operation Hierarchical to: No other components. Dependencies: [FDP_ITC.1 or FDP_ITC.2 or FCS_CKM.1Cryptographic key generation] FCS_COP.1.1(2) The TSF shall perform [cryptographic operation of data listed below Table 31 outgoing to the network] in accordance with a specified cryptographic algorithm and cryptographic key sizes that meet the following: [table 31] Table 31: Cryptographic Operations Standard Algorithm Operations Key Size in Bits FIPS 46-3 Triple-DES Encryption, Decryption 168 FIPS 197 AES Encryption, Decryption 128 FIPS 180-2 SHA-1 Hashing 160 PKCS #3 Diffie-Hellman Key agreement 768 1024 2048 6.1.3 Class FDP: User data protection 6.1.3.1 FDP_ACC.1(1) Subset access control Hierarchical to: No other components. Dependencies: FDP_ACF.1 Security attribute based access control Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 53 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved FDP_ACC.1.1(1) The TSF shall enforce the Common Access Control SFP in Table 32 on the list of users as subjects, objects, and operations among subjects and objects covered by the Common Access Control SFP in Table 32. 6.1.3.2 FDP_ACC.1(2) Subset access control Hierarchical to: No other components. Dependencies: FDP_ACF.1 Security attribute based access control FDP_ACC.1.1(2) The TSF shall enforce the TOE Function Access Control SFP in Table 32 on the list of users as subjects, TOE Functions as objects, and the right to use the functions as operations among subjects and objects covered by the TOE Function Access Control SFP in Table 32. 6.1.3.3 FDP_ACC.1(3) Subset access control Hierarchical to: No other components. Dependencies: FDP_ACF.1 Security attribute based access control FDP_ACC.1.1(3) The TSF shall enforce the Service (PRN, SCN, CPY, DSR FAX) Access Control SFP in Table 33 on the list of subjects, objects, and operations among subjects and objects covered by the Service (PRN, SCN, CPY, DSR FAX) Access Control SFP in Table 33. 6.1.3.4 FDP_ACF.1(1) Security attribute based access control Hierarchical to: No other components. Dependencies: FDP_ACC.1 Subset access control FMT_MSA.3 Static attribute initialization FDP_ACF.1.1(1) The TSF shall enforce the Common Access Control SFP in Table 32 to objects based on the following: the list of users as subjects and objects controlled under the Common Access Control SFP in Table 32, and for each, the indicated security attributes in Table 32 FDP_ACF.1.2(1) The TSF shall enforce the following rules to determine if an operation among controlled subjects and controlled objects is allowed: rules specified in the Common Access Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 54 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Control SFP in Table 32 governing access among controlled users as subjects and controlled objects using controlled operations on controlled objects. FDP_ACF.1.3(1) The TSF shall explicitly authorize access of subjects to objects based on the following additional rules: [none]. FDP_ACF.1.4(1) The TSF shall explicitly deny access of subjects to objects based on the following additional rules: [none]. Table 32: Common Access Control SFP Commo m Access Control SFP Object Attribute (Object) Operation(s) Subject Attribute (Subject) Access control rule Commo n Access Control D.DOC +PRT +SCN +FAXIN +FAXOU T Delete U.NORMA L User ID Denied, except for his/her own documents D.FUN C +PRT +SCN +FAXIN +FAXOU T Modify, Delete U.NORMA L User ID Denied, except for his/her own function data Table 33: Service Access Control SFP PRT Access Control D.DOC +PRT Read U.NORMA L User ID Denied, except for his/her own documents SCN Access Control D.DOC +SCN Read U.NORMA L User ID Denied, except for his/her own documents FAX Access Control D.DOC +FAXIN +FAXOU T Read U.NORMA L User ID Denied, except for his/her own documents CPY Access Control D.DOC +CPY Read Not specify any access control restriction DSR Access Control D.DOC +DSR Read U.NORMA L User ID Denied, except for his/her own documents Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 55 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Application Note : Operation(s) Attribute (Object) Description Read +PRT Refers (as a minimum) to the release of pending hardcopy output to a Hardcopy Output Handler. It may also be used to refer to previewing documents on a display device, if such a feature is present in a conforming TOE. +SCN Refers (as a minimum) to the transmission of User Document Data through an Interface to a destination of the user’s choice. It may also be used to refer to previewing documents on a display device, if such a feature is present in a conforming TOE. + CPY Refers to the release of pending hardcopy output to a Hardcopy Output Handler. It may also be used to refer to previewing documents on a display device, if such a feature is present in a conforming TOE. +FAXIN +FAXOUT Refers (as a minimum) to the release of pending hardcopy output to a Hardcopy Output Handler for receiving faxes (+FAXIN) and to the transmission of User Document Data through an Interface for sending or receiving faxes (+FAXOUT or +FAXIN). It may also be used to refer to previewing documents on a display device, if such a feature is present in a conforming TOE. +DSR Refers (as a minimum) to the transmission of User Document Data through an Interface to a destination of the user’s choice. It may also be used to refer to previewing documents on a display device, if such a feature is present in a conforming TOE. 6.1.3.5 FDP_ACF.1(2) Security attribute based access control Hierarchical to: No other components. Dependencies: FDP_ACC.1 Subset access control FMT_MSA.3 Static attribute initialization FDP_ACF.1.1(2) The TSF shall enforce the TOE Function Access Control SFP in table 34 to objects based on the following: users and [list of TOE functions and the security attribute(s) used to determine the TOE Function Access Control SFP in table 34] FDP_ACF.1.2(2) The TSF shall enforce the following rules to determine if an operation among controlled subjects and controlled objects is allowed: [the user is explicitly authorized by U.ADMINISTRATOR to use a function, a user that is authorized to use the TOE is automatically authorized to use the functions [list of functions in table 34] FDP_ACF.1.3(2) The TSF shall explicitly authorise access of subjects to objects based on the following additional rules: the user acts in the role U.ADMINISTRATOR: [none]. FDP_ACF.1.4(2) The TSF shall explicitly deny access of subjects to objects based on the [none]. Table 34: TOE Function Access Control SFP Access Object Attribute Operation(s) Subject Attribute Access control rule Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 56 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Control SFP (Object) (Subject) TOE Functio n Access Control F.PRT Permissi on Execution U.NORMA L User ID Denied, except for the U.NORMAL explicitly authorized by U.ADMINISTRAT OR to use a function F.SCN F.CPY F.FAX F.DSR 6.1.3.6 FDP_ACF.1(3) Security attribute based access control Hierarchical to: No other components. Dependencies: FDP_ACC.1 Subset access control FMT_MSA.3 Static attribute initialization FDP_ACF.1.1(3) The TSF shall enforce the Service (PRN, SCN, CPY, DSR FAX) Access Control SFP in Table 33 to objects based on the following: the list of subjects and objects controlled under the Service (PRN, SCN, CPY, DSR FAX) Access Control SFP in Table 33. FDP_ACF.1.2(3) The TSF shall enforce the following rules to determine if an operation among controlled subjects and controlled objects is allowed: rules specified in the Service (PRN, SCN, CPY, DSR FAX) Access Control SFP in Table 33 governing access among Users and controlled objects using controlled operations on controlled objects. FDP_ACF.1.3(3) The TSF shall explicitly authorise access of subjects to objects based on the following additional rules: [Accounting User Rules]. FDP_ACF.1.4(3) The TSF shall explicitly deny access of subjects to objects based on the [Accounting User Rules]. 6.1.3.7 FDP_ETC.1 Export of user data without security attributes Hierarchical to: No other components. Dependencies: [FDP_ACC.1 Subset access control, or FDP_IFC.1 Subset information flow control] FDP_ETC.1.1 The TSF shall enforce the [SCN Access Control , FAX Access Control, DSR Access Control] when exporting user data, controlled under the SFP(s), outside of the TOE. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 57 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved FDP_ETC.1.2 The TSF shall export the user data without the user data's associated security attributes. 6.1.3.8 FDP_IFC.1(1) Subset information flow control Hierarchical to: No other components. Dependencies: FDP_IFF.1 Simple security attributes FDP_IFC.1.1(1) The TSF shall enforce the [MAC filtering rule] on [list of subjects (External IT entities), list of information (packet), operations (allow, deny)]. 6.1.3.9 FDP_IFC.1(2) Subset information flow control Hierarchical to: No other components. Dependencies: FDP_IFF.1 Simple security attributes FDP_IFC.1.1(2) The TSF shall enforce the [IPv4 filtering rule] on [list of subjects (External IT entities), list of information (packet), operations (allow, deny)]. 6.1.3.10 FDP_IFC.1(3) Subset information flow control Hierarchical to: No other components. Dependencies: FDP_IFF.1 Simple security attributes FDP_IFC.1.1(3) The TSF shall enforce the [IPv6 filtering rule] on [list of subjects (External IT entities), list of information (packet), operations (allow, deny)]. 6.1.3.11 FDP_IFC.1(4) Subset information flow control Hierarchical to: No other components. Dependencies: FDP_IFF.1 Simple security attributes FDP_IFC.1.1(4) The TSF shall enforce the [FAX data control] on [list of subjects (External IT entities), list of information (fax data), operations (discard)]. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 58 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 6.1.3.12 FDP_IFC.1(5) Subset information flow control Hierarchical to: No other components. Dependencies: FDP_IFF.1 Simple security attributes FDP_IFC.1.1(5) The TSF shall enforce the [Protocol/Port information flow control] on [list of subjects (External IT entities), list of information (packet), operation (allow)]. 6.1.3.13 FDP_IFF.1(1) Simple security attributes Hierarchical to: No other components. Dependencies: FDP_IFC.1 Subset information flow control FMT_MSA.3 Static attribute initialization FDP_IFF.1.1(1) The TSF shall enforce the [MAC filtering rule] based on the following types of subject and information security attributes: [list of subjects (External IT entities), list of information (packet), security attributes of subjects (MAC Address), security attributes of information (MAC Address)]. FDP_IFF.1.2(1) The TSF shall permit an information flow between a controlled subject and controlled information via a controlled operation if the following rules hold: [ a) All packets are allowed if there is no MAC filtering rule registered by U.ADMINISTRATOR b) If U.ADMINISTRATOR registers specific MAC filtering rules, all packets via MAC address registered by U.ADMINISTRATOR are not allowed] FDP_IFF.1.3(1) The TSF shall enforce the [none]. FDP_IFF.1.4(1) The TSF shall explicitly authorize an information flow based on the following rules: [none]. FDP_IFF.1.5(1) The TSF shall explicitly deny an information flow based on the following rules: [none]. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 59 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 6.1.3.14 FDP_IFF.1(2) Simple security attributes Hierarchical to: No other components. Dependencies: FDP_IFC.1 Subset information flow control FMT_MSA.3 Static attribute initialization FDP_IFF.1.1(2) The TSF shall enforce the [IPv4 filtering rule] based on the following types of subject and information security attributes: [list of subjects (External IT entities), list of information (packet), security attributes of subjects(IPv4 Address), security attributes of information(IPv4 Address)]. FDP_IFF.1.2(2) The TSF shall permit an information flow between a controlled subject and controlled information via a controlled operation if the following rules hold: [ a) All packets are allowed if there is no IPv4 filtering rule registered by U.ADMINISTRATOR b) If U.ADMINISTRATOR registers specific IPv4 filtering rules, specific protocols and port are allowed as IP filtering rule registered by U.ADMINISTRATOR.] FDP_IFF.1.3(2) The TSF shall enforce the [none]. FDP_IFF.1.4(2) The TSF shall explicitly authorize an information flow based on the following rules: [none]. FDP_IFF.1.5(2) The TSF shall explicitly deny an information flow based on the following rules: [none]. 6.1.3.15 FDP_IFF.1(3) Simple security attributes Hierarchical to: No other components. Dependencies: FDP_IFC.1 Subset information flow control FMT_MSA.3 Static attribute initialization FDP_IFF.1.1(3) The TSF shall enforce the [IPv6 filtering rule] based on the following types of subject and information security attributes: [list of subjects (External IT entities), list of information (packet), security attributes of subjects(IPv6 Address), security attributes of information(IPv6 Address)]. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 60 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved FDP_IFF.1.2(3) The TSF shall permit an information flow between a controlled subject and controlled information via a controlled operation if the following rules hold: [ a) All packets are allowed if there is no IPv6 filtering rule registered by U.ADMINISTRATOR b) If U.ADMINISTRATOR registers specific IPv4 filtering rules, specific protocols and port are allowed as IP filtering rule registered by U.ADMINISTRATOR.] FDP_IFF.1.3(3) The TSF shall enforce the [none]. FDP_IFF.1.4(3) The TSF shall explicitly authorize an information flow based on the following rules: [none]. FDP_IFF.1.5(3) The TSF shall explicitly deny an information flow based on the following rules: [none]. 6.1.3.16 FDP_IFF.1(4) Simple security attributes Hierarchical to: No other components. Dependencies: FDP_IFC.1 Subset information flow control FMT_MSA.3 Static attribute initialization FDP_IFF.1.1(4) The TSF shall enforce the [FAX data control] based on the following types of subject and information security attributes: [list of subjects (External IT entities), list of information (fax data), security attributes of subjects (none), security attributes of information (fax image format)]. FDP_IFF.1.2(4) The TSF shall permit an information flow between a controlled subject and controlled information via a controlled operation if the following rules hold: [ a) Discard the fax data if the incoming fax data is not standardized MMR, MR, or MH of T.4 specification] FDP_IFF.1.3(3) The TSF shall enforce the [none]. FDP_IFF.1.4(3) The TSF shall explicitly authorize an information flow based on the following rules: [none]. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 61 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved FDP_IFF.1.5(3) The TSF shall explicitly deny an information flow based on the following rules: [none]. 6.1.3.17 FDP_IFF.1(4) Simple security attributes Hierarchical to: No other components. Dependencies: FDP_IFC.1 Subset information flow control FMT_MSA.3 Static attribute initialization FDP_IFF.1.1(4) The TSF shall enforce the [Protocol/Port information flow control] based on the following types of subject and information security attributes: [list of subjects (External IT entities), list of information (packet), security attributes of subjects (none), security attributes of information (Protocol type, Port number)]. FDP_IFF.1.2(4) The TSF shall permit an information flow between a controlled subject and controlled information via a controlled operation if the following rules hold: [ a) All packets are denied except for the Protocol/Port explicitly enabled by U.ADMINISTRATOR] FDP_IFF.1.3(4) The TSF shall enforce the [none]. FDP_IFF.1.4(4) The TSF shall explicitly authorize an information flow based on the following rules: [none]. FDP_IFF.1.5(4) The TSF shall explicitly deny an information flow based on the following rules: [none]. 6.1.3.18 FDP_RIP.1 Subset residual information protection Hierarchical to: No other components. Dependencies: No dependencies. FDP_RIP.1.1 The TSF shall ensure that any previous information content of a resource is made unavailable upon the [deallocation of the resource from] the following objects: D.DOC, [D.FUNC]. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 62 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 6.1.4 Class FIA: Identification and authentication 6.1.4.1 FIA_AFL.1 Authentication failure handling Hierarchical to: No other components. Dependencies: FIA_UAU.1 Timing of authentication FIA_AFL.1.1 The TSF shall detect when [3] unsuccessful authentication attempts occur related to [U.ADMINISTRATOR authentication] FIA_AFL.1.2 When the defined number of unsuccessful authentication attempts has been met the TSF shall [lockout the local and Web U.ADMINISTRATOR’s login for a period of 3 minutes]. 6.1.4.2 FIA_ATD.1 User attribute definition Hierarchical to: No other components. Dependencies: No dependencies. FIA_ATD.1.1 The TSF shall maintain the following list of security attributes belonging to individual users: [User ID, User Name, Password, Email, Fax No for Local Authentication and User ID, User Name, Password, User Permission for Standard Accounting] 6.1.4.3 FIA_UAU.1 Timing of authentication Hierarchical to: No other components Dependencies: FIA_UID.1 Timing of identification FIA_UAU.1.1 The TSF shall allow [submission of network print jobs, incoming faxes, and usage of the GUI with menus that has no relation with security] behalf of the user to be performed before the user is authenticated. FIA_UAU.1.2 The TSF shall require each user to be successfully authenticated before allowing any other TSF-mediated actions on behalf of that user. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 63 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Application Note: U.ADMINISTRATOR authentication is performed internally by the TOE. However, U.NORMAL authentication is performed internally by the TOE or externally by authentication servers (SMB, Kerberos, LDAP server) in the operational environment of the TOE. 6.1.4.4 FIA_UAU.7 Protected authentication feedback Hierarchical to: No other components. Dependencies: FIA_UAU.1 Timing of authentication FIA_UAU.7.1 The TSF shall provide only [ *, • ] to the user while the authentication is in progress. 6.1.4.5 FIA_UID.1 User identification before any action Hierarchical to: FIA_UID.1 Timing of identification Dependencies: No dependencies. FIA_UID.1.1 The TSF shall allow [Incoming faxes, and usage of the GUI with menus that has no relation with security] on behalf of the user to be performed before the user is identified. FIA_UID.1.2 The TSF shall require each user to be successfully identified before allowing any other TSF-mediated actions on behalf of that user. Application Note: U.ADMINISTRATOR identification is performed internally by the TOE. However, U.NORMAL identification is performed internally by the TOE or externally by identification servers (SMB, Kerberos, LDAP server) in the operational environment of the TOE. 6.1.4.6 FIA_USB.1 User-subject binding Hierarchical to: No other components. Dependencies: FIA_ATD.1 User attribute definition FIA_USB.1.1 The TSF shall associate the following user security attributes with subjects acting on the behalf of that user: [User ID]. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 64 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved FIA_USB.1.2 The TSF shall enforce the following rules on the initial association of user security attributes with subjects acting on the behalf of users: [U.ADMINISTRATOR associates subjects with assigned to User ID when U.USER logs in]. FIA_USB.1.3 The TSF shall enforce the following rules governing changes to the user security attributes associated with subjects acting on the behalf of users: [TSF re-associates subjects with User ID when U.ADMINISTRATOR changes User permissions or Clear]. 6.1.5 Class FMT: Security management 6.1.5.1 FMT_MOF.1 Management of security functions behavior Hierarchical to: No other components. Dependencies: FMT_SMR.1 Security roles FMT_SMF.1 Specification of Management Functions FMT_MOF.1.1 The TSF shall restrict the ability to determine the behavior of, disable, and enable the functions [list of security functions in Table 35] to [U.ADMINISTRATOR]. Table 35: Management of Security Functions Behavior Security Function Selection Operation determine the behavior of disable enable System Reboot ○ Authentication Mode ○ ○ Log Configuration ○ ○ Secure HTTP ○ ○ IP/MAC Filtering ○ ○ ○ Image Overwrite ○ ○ ○ IP SEC ○ ○ Secure Connection ○ ○ SNMPv4 ○ ○ 6.1.5.2 FMT_MSA.1(1) Management of security attributes Hierarchical to: No other components. Dependencies: [FDP_ACC.1 Subset access control, or Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 65 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved FDP_IFC.1 Subset information flow control] FMT_SMR.1 Security roles FMT_SMF.1 Specification of Management Functions FMT_MSA.1.1(1) The TSF shall enforce the Common Access control SFP in Table 32, [none] to restrict the ability to modify, delete the security attributes [list of security attributes in Table 32] to [U.ADMINISTRATOR]. FMT_MSA.1.1(2) The TSF shall enforce the Service (PRN, SCN, CPY, DSR FAX) Access Control SFP in Table 33, [none] to restrict the ability to [Read] the security attributes [list of security attributes in Table 33] to [U.ADMINISTRATOR]. FMT_MSA.1.1(3) The TSF shall enforce the TOE Function Access Control SFP, [none] to restrict the ability to [Execution] the security attributes [list of security attributes in Table 34] to [U.ADMINISTRATOR]. FMT_MSA.1.1(4) The TSF shall enforce the [MAC filtering rule, IPv4 filtering rule, IPv6 filtering rule, Protocol/Port information flow control] to restrict the ability to query, modify, delete, [add] the security attributes [list of security attributes in Table 36] to [U.ADMINISTRATOR]. Table 36: Management of Security Attributes Security Attributes Selection Operation query modify delete [add] MAC Address ○ ○ ○ ○ IPv4 or IPv6 Address ○ ○ ○ ○ Protocol (to deny) ○ ○ Port ○ ○ User Management ○ ○ ○ ○ 6.1.5.3 FMT_MSA.1(2) Management of security attributes Hierarchical to: No other components. Dependencies: [FDP_ACC.1 Subset access control, or FDP_IFC.1 Subset information flow control] FMT_SMR.1 Security roles FMT_SMF.1 Specification of Management Functions Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 66 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved FMT_MSA.1.1(b) The TSF shall enforce the TOE Function Access Control SFP, [TOE Function Access Control SFP, MAC filtering rule, IP filtering rule, Protocol/Port information flow control] to restrict the ability to query, modify, delete, [add] the security attributes [list of security attributes in Table 35] to [U.ADMINISTRATOR]. 6.1.5.4 FMT_MSA.3(1) Static attribute initialization Hierarchical to: No other components. Dependencies: FMT_MSA.1 Management of security attributes FMT_SMR.1 Security roles FMT_MSA.3.1(1) The TSF shall enforce the Common Access Control SFP in Table 17, [Service (PRN, SCN, CPY, DSR FAX) Access Control SFP in Table 33, FAX data control, Protocol/Port information flow control] to provide restrictive default values for security attributes that are used to enforce the SFP. FMT_MSA.3.2(1) The TSF shall allow the [U.ADMINISTRATOR] to specify alternative initial values to override the default values when an object or information is created. 6.1.5.5 FMT_MSA.3(2) Static attribute initialization Hierarchical to: No other components. Dependencies: FMT_MSA.1 Management of security attributes FMT_SMR.1 Security roles FMT_MSA.3.1(2) The TSF shall enforce the TOE Function Access Control Policy, [MAC filtering rule, IPv4 filtering rule, IPv6 filtering rule] to provide permissive default values for security attributes that are used to enforce the SFP. FMT_MSA.3.2(2) The TSF shall allow the [U.ADMINISTRATOR] to specify alternative initial values to override the default values when an object or information is created. 6.1.5.6 FMT_MTD.1 Management of TSF data Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 67 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Hierarchical to: No other components. Dependencies: FMT_SMR.1 Security roles FMT_SMF.1 Specification of Management Functions FMT_MTD.1.1 The TSF shall restrict the ability to query, modify, delete, [add] the [list of TSF data in Table 37] to U.ADMINISTRATOR Table 37: Management of TSF data TSF data Selection Operation the authorized identified roles query modify delete [add] Password of Secured Box ○ ○ ○ U.ADMINISTRATOR Kerberos Server Configuration ○ ○ ○ ○ SMB Server Configuration ○ ○ ○ ○ LDAP Server Configuration ○ ○ ○ ○ FTP Server Configuration ○ ○ SMTP Server Configuration ○ ○ Log in Identification ○ ○ Audit Log Data ○ ○ Network Protocol and Port Configuration (Raw TCP/IP Printing, LPR/LPD, HTTP, HTTPS, SLP, UPnP, mDNS, WINS, DDNS, TCP/IPv4, TCP/IPv6, IPP, SNMP, SMTP, SetIP, SNTP) ○ ○ Digital Certificate ○ ○ ○ ○ IPv4/6 filtering Address ○ ○ ○ ○ Mac filtering Address ○ ○ ○ ○ Image Overwrite configuration ○ ○ 6.1.5.7 FMT_SMF.1 Specification of Management Functions Hierarchical to: No other components. Dependencies: No dependencies. FMT_SMF.1.1 The TSF shall be capable of performing the following management functions: [the list of Management Functions in Table 38]. Table 38: Management Functions Management Functions Relevant SFR Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 68 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Management of Audit data (review, delete) FAU_GEN.1, FAU_SEL.1 Management of Common Access Control rules FDP_ACC.1(1), FDP_ACF.1(1) Management of TOE Function Access Control rules FDP_ACC.1(2), FDP_ACF.1(2) Management of Service Access Control rules FDP_ACC.1(3), FDP_ACF.1(3) Management of MAC filtering rules FDP_IFC.1(1), FDP_IFF.1(1) Management of IP filtering rules FDP_IFC.1(2), FDP_IFC.1(3), FDP_IFF.1(2), FDP_IFF.1(3) Management of Protocol/Port information flow control rules FDP_IFC.1(5), FDP_IFF.1(5) Management of Image overwrite function FDP_RIP.1 Management of User attributes (User ID, User Name, Password, Email, Fax No, and Group ID) FIA_ATD.1, FIA_UID.1, FIA_UAU.1 Management of security functions behavior FMT_MOF.1 Management of security attributes FMT_MSA.1 Management of TSF data FMT_MTD.1 Management of security Roles FMT_SMR.1 Management of TSF testing (initiation) FTP_TST.1 Management of TSF-initiation termination FTA_SSL.3 Management of fax forward functions FPT_FDI_EXP.1 6.1.5.8 FMT_SMR.1 Security roles Hierarchical to: No other components. Dependencies: FIA_UID.1 Timing of identification FMT_SMR.1.1 The TSF shall maintain the roles U.ADMINISTRATOR, U.NORMAL, Nobody. FMT_SMR.1.2 The TSF shall be able to associate users with roles, except for the role “Nobody” to which no user shall be associated. 6.1.6 Class FPT: Protection of the TSF 6.1.6.1 FPT_FDI_EXP.1 Restricted forwarding of data to external interfaces Hierarchical to: No other components Dependencies: FMT_SMF.1 Specification of Management Functions Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 69 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved FMT_SMR.1 Security roles FPT_FDI_EXP.1.1 The TSF shall provide the capability to restrict data received on any external Interface from being forwarded without further processing by the TSF to any Shared-medium Interface. 6.1.6.2 FPT_STM.1 Reliable time stamps Hierarchical to: No other components. Dependencies: No dependencies. FPT_STM.1.1 The TSF shall be able to provide reliable time stamps. 6.1.6.3 FPT_TST.1 TSF testing Hierarchical to: No other components. Dependencies: No dependencies. FPT_TST.1.1 The TSF shall run a suite of self tests during initial start-up to demonstrate the correct operation of [TSF executable code] FPT_TST.1.2 The TSF shall provide authorized users with the capability to verify the integrity of [TSF data stored in HDD]. FPT_TST.1.3 The TSF shall provide authorized users with the capability to verify the integrity of [TSF executable code]. 6.1.7 Class FTA: TOE access 6.1.7.1 FTA_SSL.3 TSF-initiated termination Hierarchical to: No other components. Dependencies: No dependencies. FTA_SSL.3.1 The TSF shall terminate an interactive session after a [3 minutes of U.ADMINISTRATOR and U.NORMAL inactivity]. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 70 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 6.1.8 Class FTP: Trusted path/channels 6.1.8.1 FDP_ITC.1 Inter-TSF trusted channel Hierarchical to: No other components. Dependencies: [FDP_ACC.1 Subset access control, or FDP_IFC.1 Subset information flow control] FMT_MSA.3 Static attribute initialisation FDP_ITC.1.1 The TSF shall provide a communication channel between itself and another trusted IT product that is logically distinct from other communication channels and provides assured identification of its end points and protection of the communicated data from modification or disclosure. FDP_ITC.1.2 The TSF shall permit the TSF, another trusted IT product to initiate communication via the trusted channel. FDP_ITC.1.3 The TSF shall initiate communication via the trusted channel for communication of D.DOC, D.FUNC, D.PROT, and D.CONF over any Shared-medium Interface. 6.2 Security Assurance Requirements Security assurance requirements (SAR) defined in this document consists of assurance component in Common Criteria for Information Technology Security Evaluation, Part 3. The Evaluation Assurance Levels (EALs) is EAL3 augmented by ALC_FLR.2. Following table shows the summary of assurance components. The SARs are not iterated or refined from Common Criteria for Information Technology Security Evaluation Part 3. Table 39: Security Assurance Requirements (EAL3 augmented by ALC_FLR.2) Assurance Class Assurance components ASE: Security Target evaluation ASE_CCL.1 Conformance claims ASE_ECD.1 Extended components definition ASE_INT.1 ST Introduction ASE_OBJ.2 Security objectives ASE_REQ.2 Derived security requirements ASE_SPD.1 Security problem definition ASE_TSS.1 TOE summary specification ADV: Development ADV_ARC.1 Security architecture description ADV_FSP.3 Functional specification with complete summary Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 71 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Assurance Class Assurance components ADV_TDS.2 Architectural design AGD: Guidance documents AGD_OPE.1 Operational user guidance AGD_PRE.1 Preparative procedures ALC: Life-cycle support ALC_CMC.3 Authorization controls ALC_CMS.3 Implementation representation CM coverage ALC_DEL.1 Delivery procedures ALC_DVS.1 Identification of security measures ALC_FLR.2 Flaw reporting procedures (augmentation of EAL3) ALC_LCD.1 Developer defined life-cycle model ATE: Tests ATE_COV.2 Analysis of coverage ATE_DPT.1 Testing: basic design ATE_FUN.1 Functional testing ATE_IND.2 Independent testing - sample AVA: Vulnerability Assessment AVA_VAN.2 Vulnerability analysis 6.2.1 Class ASE: Security Target evaluation 6.2.1.1 ASE_CCL.1 Conformance claims Dependencies: ASE_INT.1 ST introduction ASE_ECD.1 Extended components definition ASE_REQ.1 Stated security requirements Developer action elements: ASE_CCL.1.1D The developer shall provide a conformance claim. ASE_CCL.1.2D The developer shall provide a conformance claim rationale. Content and presentation elements: ASE_CCL.1.1C The conformance claim shall contain a CC conformance claim that identifies the version of the CC to which the ST and the TOE claim conformance. ASE_CCL.1.2C The CC conformance claim shall describe the conformance of the ST to CC Part 2 as either CC Part 2 conformant or CC Part 2 extended. ASE_CCL.1.3C The CC conformance claim shall describe the conformance of the ST to CC Part 3 as either CC Part 3 conformant or CC Part 3 extended. ASE_CCL.1.4C The CC conformance claim shall be consistent with the extended components definition. ASE_CCL.1.5C The conformance claim shall identify all PPs and security requirement packages to which the ST claims conformance. ASE_CCL.1.6C The conformance claim shall describe any conformance of the ST to a package as either package-conformant or package-augmented. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 72 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved ASE_CCL.1.7C The conformance claim rationale shall demonstrate that the TOE type is consistent with the TOE type in the PPs for which conformance is being claimed. ASE_CCL.1.8C The conformance claim rationale shall demonstrate that the statement of the security problem definition is consistent with the statement of the security problem definition in the PPs for which conformance is being claimed. ASE_CCL.1.9C The conformance claim rationale shall demonstrate that the statement of security objectives is consistent with the statement of security objectives in the PPs for which conformance is being claimed. ASE_CCL.1.10C The conformance claim rationale shall demonstrate that the statement of security requirements is consistent with the statement of security requirements in the PPs for which conformance is being claimed. Evaluator action elements: ASE_CCL.1.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. 6.2.1.2 ASE_ECD.1 Extended components definition Dependencies: No dependencies. Developer action elements: ASE_ECD.1.1D The developer shall provide a statement of security requirements. ASE_ECD.1.2D The developer shall provide an extended components definition. Content and presentation elements: ASE_ECD.1.1C The statement of security requirements shall identify all extended security requirements. ASE_ECD.1.2C The extended components definition shall define an extended component for each extended security requirement. ASE_ECD.1.3C The extended components definition shall describe how each extended component is related to the existing CC components, families, and classes. ASE_ECD.1.4C The extended components definition shall use the existing CC components, families, classes, and methodology as a model for presentation. ASE_ECD.1.5C The extended components shall consist of measurable and objective elements such that conformance or non-conformance to these elements can be demonstrated. Evaluator action elements: ASE_ECD.1.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. ASE_ECD.1.2E The evaluator shall confirm that no extended component can be clearly expressed using existing components. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 73 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 6.2.1.3 ASE_INT.1 ST introduction Dependencies: No dependencies. Developer action elements: ASE_INT.1.1D The developer shall provide an ST introduction. Content and presentation elements: ASE_INT.1.1C The ST introduction shall contain an ST reference, a TOE reference, a TOE overview, and a TOE description. ASE_INT.1.2C The ST reference shall uniquely identify the ST. ASE_INT.1.3C The TOE reference shall identify the TOE. ASE_INT.1.4C The TOE overview shall summarize the usage and major security features of the TOE. ASE_INT.1.5C The TOE overview shall identify the TOE type. ASE_INT.1.6C The TOE overview shall identify any non-TOE hardware/software/firmware required by the TOE. ASE_INT.1.7C The TOE description shall describe the physical scope of the TOE. ASE_INT.1.8C The TOE description shall describe the logical scope of the TOE. Evaluator action elements: ASE_INT.1.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. ASE_INT.1.2E The evaluator shall confirm that the TOE reference, the TOE overview, and the TOE description are consistent with each other. 6.2.1.4 ASE_OBJ.2 Security objectives Dependencies: ASE_SPD.1 Security problem definition Developer action elements: ASE_OBJ.2.1D The developer shall provide a statement of security objectives. ASE_OBJ.2.2D The developer shall provide a security objectives’ rationale. Content and presentation elements: ASE_OBJ.2.1C The statement of security objectives shall describe the security objectives for the TOE and the security objectives for the operational environment. ASE_OBJ.2.2C The security objectives rationale shall trace each security objective for the TOE back to threats countered by that security objective and OSPs enforced by that security objective. ASE_OBJ.2.3C The security objectives rationale shall trace each security objective for the operational environment back to threats countered by that security objective, OSPs enforced by that security objective, and assumptions upheld by that security objective. ASE_OBJ.2.4C The security objectives rationale shall demonstrate that the security objectives counter all threats. ASE_OBJ.2.5C The security objectives rationale shall demonstrate that the security objectives enforce all OSPs. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 74 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved ASE_OBJ.2.6C The security objectives rationale shall demonstrate that the security objectives for the operational environment uphold all assumptions. Evaluator action elements: ASE_OBJ.2.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. 6.2.1.5 ASE_REQ.2 Derived security requirements Dependencies: ASE_OBJ.2 Security objectives ASE_ECD.1 Extended components definition Developer action elements: ASE_REQ.2.1D The developer shall provide a statement of security requirements. ASE_REQ.2.2D The developer shall provide a security requirements’ rationale. Content and presentation elements: ASE_REQ.2.1C The statement of security requirements shall describe the SFRs and the SARs. ASE_REQ.2.2C All subjects, objects, operations, security attributes, external entities and other terms that are used in the SFRs and the SARs shall be defined. ASE_REQ.2.3C The statement of security requirements shall identify all operations on the security requirements. ASE_REQ.2.4C All operations shall be performed correctly. ASE_REQ.2.5C Each dependency of the security requirements shall either be satisfied, or the security requirements rationale shall justify the dependency not being satisfied. ASE_REQ.2.6C The security requirements rationale shall trace each SFR back to the security objectives for the TOE. ASE_REQ.2.7C The security requirements rationale shall demonstrate that the SFRs meet all security objectives for the TOE. ASE_REQ.2.8C The security requirements rationale shall explain why the SARs were chosen. ASE_REQ.2.9C The statement of security requirements shall be internally consistent. Evaluator action elements: ASE_REQ.2.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. 6.2.1.6 ASE_SPD.1 Security problem definition Dependencies: No dependencies. Developer action elements: ASE_SPD.1.1D The developer shall provide a security problem definition. Content and presentation elements: ASE_SPD.1.1C The security problem definition shall describe the threats. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 75 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved ASE_SPD.1.2C All threats shall be described in terms of a threat agent, an asset, and an adverse action. ASE_SPD.1.3C The security problem definition shall describe the OSPs. ASE_SPD.1.4C The security problem definition shall describe the assumptions about the operational environment of the TOE. Evaluator action elements: ASE_SPD.1.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. 6.2.1.7 ASE_TSS.1 TOE summary specification Dependencies: ASE_INT.1 ST introduction ASE_REQ.1 Stated security requirements ADV_FSP.1 Basic functional specification Developer action elements: ASE_TSS.1.1D The developer shall provide a TOE summary specification. Content and presentation elements: ASE_TSS.1.1C The TOE summary specification shall describe how the TOE meets each SFR. Evaluator action elements: ASE_TSS.1.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. ASE_TSS.1.2E The evaluator shall confirm that the TOE summary specification is consistent with the TOE overview and the TOE description. 6.2.2 Class ADV: Development 6.2.2.1 ADV_ARC.1 Security architecture description Dependencies: ADV_FSP.1 Basic functional specification ADV_TDS.1 Basic design Developer action elements: ADV_ARC.1.1D The developer shall design and implement the TOE so that the security features of the TSF cannot be bypassed. ADV_ARC.1.2D The developer shall design and implement the TSF so that it is able to protect itself from tampering by untrusted active entities. ADV_ARC.1.3D The developer shall provide a security architecture description of the TSF. Content and presentation elements: ADV_ARC.1.1C The security architecture description shall be at a level of detail commensurate with the description of the SFR-enforcing abstractions described in the TOE design document. ADV_ARC.1.2C The security architecture description shall describe the security domains maintained by the TSF consistently with the SFRs. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 76 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved ADV_ARC.1.3C The security architecture description shall describe how the TSF initialization process is secure. ADV_ARC.1.4C The security architecture description shall demonstrate that the TSF protects itself from tampering. ADV_ARC.1.5C The security architecture description shall demonstrate that the TSF prevents bypass of the SFR-enforcing functionality. Evaluator action elements: ADV_ARC.1.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. 6.2.2.2 ADV_FSP.3 Functional specification with complete summary Dependencies: ADV_TDS.1 Basic design Developer action elements: ADV_FSP.3.1D The developer shall provide a functional specification. ADV_FSP.3.2D The developer shall provide a tracing from the functional specification to the SFRs. Content and presentation elements: ADV_FSP.3.1C The functional specification shall completely represent the TSF. ADV_FSP.3.2C The functional specification shall describe the purpose and method of use for all TSFI. ADV_FSP.3.3C The functional specification shall identify and describe all parameters associated with each TSFI. ADV_FSP.3.4C For each SFR-enforcing TSFI, the functional specification shall describe the SFR-enforcing actions associated with the TSFI. ADV_FSP.3.5C For each SFR-enforcing TSFI, the functional specification shall describe direct error messages resulting from SFR-enforcing actions and exceptions associated with invocation of the TSFI. ADV_FSP.3.6C The functional specification shall summarise the SFR-supporting and SFR-non-interfering actions associated with each TSFI. ADV_FSP.3.7C The tracing shall demonstrate that the SFRs trace to TSFIs in the functional specification. Evaluator action elements: ADV_FSP.3.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. ADV_FSP.3.2E The evaluator shall determine that the functional specification is an accurate and complete instantiation of the SFRs. 6.2.2.3 ADV_TDS.2 Architectural design Dependencies: ADV_FSP.3 Functional specification with complete summary Developer action elements: ADV_TDS.2.1D The developer shall provide the design of the TOE. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 77 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved ADV_TDS.2.2D The developer shall provide a mapping from the TSFI of the functional specification to the lowest level of decomposition available in the TOE design. Content and presentation elements: ADV_TDS.2.1C The design shall describe the structure of the TOE in terms of subsystems. ADV_TDS.2.2C The design shall identify all subsystems of the TSF. ADV_TDS.2.3C The design shall describe the behaviour of each SFR non-interfering subsystem of the TSF in detail sufficient to determine that it is SFR non-interfering. ADV_TDS.2.4C The design shall describe the SFR-enforcing behaviour of the SFR- enforcing subsystems. ADV_TDS.2.5C The design shall summarise the SFR-supporting and SFR-non- interfering behavior of the SFR-enforcing subsystems. ADV_TDS.2.6C The design shall summarise the behaviour of the SFR-supporting subsystems. ADV_TDS.2.7C The design shall provide a description of the interactions among all subsystems of the TSF. ADV_TDS.2.8C The mapping shall demonstrate that all TSFIs trace to the behaviour described in the TOE design that they invoke. Evaluator action elements: ADV_TDS.2.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. ADV_TDS.2.2E The evaluator shall determine that the design is an accurate and complete instantiation of all security functional requirements. 6.2.3 Class AGD: Guidance documents 6.2.3.1 AGD_OPE.1 Operational user guidance Dependencies: ADV_FSP.1 Basic functional specification Developer action elements: AGD_OPE.1.1D The developer shall provide operational user guidance. Content and presentation elements: AGD_OPE.1.1C The operational user guidance shall describe, for each user role, the user-accessible functions and privileges that should be controlled in a secure processing environment, including appropriate warnings. AGD_OPE.1.2C The operational user guidance shall describe, for each user role, how to use the available interfaces provided by the TOE in a secure manner. AGD_OPE.1.3C The operational user guidance shall describe, for each user role, the available functions and interfaces, in particular all security parameters under the control of the user, indicating secure values as appropriate. AGD_OPE.1.4C The operational user guidance shall, for each user role, clearly present each type of security-relevant event relative to the user- Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 78 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved accessible functions that need to be performed, including changing the security characteristics of entities under the control of the TSF. AGD_OPE.1.5C The operational user guidance shall identify all possible modes of operation of the TOE (including operation following failure or operational error), their consequences and implications for maintaining secure operation. AGD_OPE.1.6C The operational user guidance shall, for each user role, describe the security measures to be followed in order to fulfill the security objectives for the operational environment as described in the ST. AGD_OPE.1.7C The operational user guidance shall be clear and reasonable. Evaluator action elements: AGD_OPE.1.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. 6.2.3.2 AGD_PRE.1 Preparative procedures Dependencies: No dependencies. Developer action elements: AGD_PRE.1.1D The developer shall provide the TOE including its preparative procedures. Content and presentation elements: AGD_PRE.1.1C The preparative procedures shall describe all the steps necessary for secure acceptance of the delivered TOE in accordance with the developer's delivery procedures. AGD_PRE.1.2C The preparative procedures shall describe all the steps necessary for secure installation of the TOE and for the secure preparation of the operational environment in accordance with the security objectives for the operational environment as described in the ST. Evaluator action elements: AGD_PRE.1.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. AGD_PRE.1.2E The evaluator shall apply the preparative procedures to confirm that the TOE can be prepared securely for operation. 6.2.4 Class ALC: Life-cycle support 6.2.4.1 ALC_CMC.3 Authorization controls Dependencies: ALC_CMS.1 TOE CM coverage ALC_DVS.1 Identification of security measures ALC_LCD.1 Developer defined life-cycle model Developer action elements: ALC_CMC.3.1D The developer shall provide the TOE and a reference for the TOE. ALC_CMC.3.2D The developer shall provide the CM documentation. ALC_CMC.3.3D The developer shall use a CM system. Content and presentation elements: Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 79 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved ALC_CMC.3.1C The TOE shall be labelled with its unique reference. ALC_CMC.3.2C The CM documentation shall describe the method used to uniquely identify the configuration items. ALC_CMC.3.3C The CM system shall uniquely identify all configuration items. ALC_CMC.3.4C The CM system shall provide measures such that only authorized changes are made to the configuration items. ALC_CMC.3.5C The CM documentation shall include a CM plan. ALC_CMC.3.6C The CM plan shall describe how the CM system is used for the development of the TOE. ALC_CMC.3.7C The evidence shall demonstrate that all configuration items are being maintained under the CM system. ALC_CMC.3.8C The evidence shall demonstrate that the CM system is being operated in accordance with the CM plan. Evaluator action elements: ALC_CMC.3.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. 6.2.4.2 ALC_CMS.3 Implementation representation CM coverage Dependencies: No dependencies. Developer action elements: ALC_CMS.3.1D The developer shall provide a configuration list for the TOE. Content and presentation elements: ALC_CMS.3.1C The configuration list shall include the following: the TOE itself; the evaluation evidence required by the SARs; the parts that comprise the TOE; and the implementation representation. ALC_CMS.3.2C The configuration list shall uniquely identify the configuration items. ALC_CMS.3.3C For each TSF relevant configuration item, the configuration list shall indicate the developer of the item. Evaluator action elements: ALC_CMS.3.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. 6.2.4.3 ALC_DEL.1 Delivery procedures Dependencies: No dependencies. Developer action elements: ALC_DEL.1.1D The developer shall document and provide procedures for delivery of the TOE or parts of it to the consumer. ALC_DEL.1.2D The developer shall use the delivery procedures. Content and presentation elements: ALC_DEL.1.1C The delivery documentation shall describe all procedures that are necessary to maintain security when distributing versions of the TOE to the consumer. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 80 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Evaluator action elements: ALC_DEL.1.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. 6.2.4.4 ALC_DVS.1 Identification of security measures Dependencies: No dependencies. Developer action elements: ALC_DVS.1.1D The developer shall produce and provide development security documentation. Content and presentation elements: ALC_DVS.1.1C The development security documentation shall describe all the physical, procedural, personnel, and other security measures that are necessary to protect the confidentiality and integrity of the TOE design and implementation in its development environment. Evaluator action elements: ALC_DVS.1.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. ALC_DVS.1.2E The evaluator shall confirm that the security measures are being applied. 6.2.4.5 ALC_FLR.2 Flaw reporting procedures Dependencies: No dependencies. Developer action elements: ALC_FLR.2.1D The developer shall document and provide flaw remediation procedures addressed to TOE developers. ALC_FLR.2.2D The developer shall establish a procedure for accepting and acting upon all reports of security flaws and requests for corrections to those flaws. ALC_FLR.2.3D The developer shall provide flaw remediation guidance addressed to TOE users. Content and presentation elements: ALC_FLR.2.1C The flaw remediation procedures documentation shall describe the procedures used to track all reported security flaws in each release of the TOE. ALC_FLR.2.2C The flaw remediation procedures shall require that a description of the nature and effect of each security flaw be provided, as well as the status of finding a correction to that flaw. ALC_FLR.2.3C The flaw remediation procedures shall require that corrective actions be identified for each of the security flaws. ALC_FLR.2.4C The flaw remediation procedures documentation shall describe the methods used to provide flaw information, corrections and guidance on corrective actions to TOE users. ALC_FLR.2.5C The flaw remediation procedures shall describe a means by which the developer receives from TOE users reports and enquiries of suspected security flaws in the TOE. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 81 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved ALC_FLR.2.6C The procedures for processing reported security flaws shall ensure that any reported flaws are remediated and the remediation procedures issued to TOE users. ALC_FLR.2.7C The procedures for processing reported security flaws shall provide safeguards that any corrections to these security flaws do not introduce any new flaws. ALC_FLR.2.8C The flaw remediation guidance shall describe a means by which TOE users report to the developer any suspected security flaws in the TOE. Evaluator action elements: ALC_FLR.2.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. 6.2.4.6 ALC_LCD.1 Developer defined life-cycle model Dependencies: No dependencies. Developer action elements: ALC_LCD.1.1D The developer shall establish a life-cycle model to be used in the development and maintenance of the TOE. ALC_LCD.1.2D The developer shall provide life-cycle definition documentation. Content and presentation elements: ALC_LCD.1.1C The life-cycle definition documentation shall describe the model used to develop and maintain the TOE. ALC_LCD.1.2C The life-cycle model shall provide for the necessary control over the development and maintenance of the TOE. Evaluator action elements: ALC_LCD.1.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. 6.2.5 Class ATE: Tests 6.2.5.1 ATE_COV.2 Analysis of coverage Dependencies: ADV_FSP.2 Security-enforcing functional specification ATE_FUN.1 Functional testing Developer action elements: ATE_COV.2.1D The developer shall provide an analysis of the test coverage. Content and presentation elements: ATE_COV.2.1C The analysis of the test coverage shall demonstrate the correspondence between the tests in the test documentation and the TSFIs in the functional specification. ATE_COV.2.2C The analysis of the test coverage shall demonstrate that all TSFIs in the functional specification have been tested. Evaluator action elements: ATE_COV.2.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 82 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 6.2.5.2 ATE_DPT.1 Testing: basic design Dependencies: ADV_ARC.1 Security architecture description ADV_TDS.2 Architectural design ATE_FUN.1 Functional testing Developer action elements: ATE_DPT.1.1D The developer shall provide the analysis of the depth of testing. Content and presentation elements: ATE_DPT.1.1C The analysis of the depth of testing shall demonstrate the correspondence between the tests in the test documentation and the TSF subsystems in the TOE design. ATE_DPT.1.2C The analysis of the depth of testing shall demonstrate that all TSF subsystems in the TOE design have been tested. Evaluator action elements: ATE_DPT.1.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. 6.2.5.3 ATE_FUN.1 Functional testing Dependencies: ATE_COV.1 Evidence of coverage Developer action elements: ATE_FUN.1.1D The developer shall test the TSF and document the results. ATE_FUN.1.2D The developer shall provide test documentation. Content and presentation elements: ATE_FUN.1.1C The test documentation shall consist of test plans, expected test results, and actual test results. ATE_FUN.1.2C The test plans shall identify the tests to be performed and describe the scenarios for performing each test. These scenarios shall include any ordering dependencies on the results of other tests. ATE_FUN.1.3C The expected test results shall show the anticipated outputs from a successful execution of the tests. ATE_FUN.1.4C The actual test results shall be consistent with the expected test results. Evaluator action elements: ATE_FUN.1.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. 6.2.5.4 ATE_IND.2 Independent testing - sample Dependencies: ADV_FSP.2 Security-enforcing functional specification AGD_OPE.1 Operational user guidance AGD_PRE.1 Preparative procedures ATE_COV.1 Evidence of coverage ATE_FUN.1 Functional testing Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 83 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Developer action elements: ATE_IND.2.1D The developer shall provide the TOE for testing. Content and presentation elements: ATE_IND.2.1C The TOE shall be suitable for testing. ATE_IND.2.2C The developer shall provide an equivalent set of resources to those that were used in the developer's functional testing of the TSF. Evaluator action elements: ATE_IND.2.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. ATE_IND.2.2E The evaluator shall execute a sample of tests in the test documentation to verify the developer test results. ATE_IND.2.3E The evaluator shall test a subset of the TSF to confirm that the TSF operates as specified. 6.2.6 Class AVA: Vulnerability assessment 6.2.6.1 AVA_VAN.2 Vulnerability analysis Dependencies: ADV_ARC.1 Security architecture description ADV_FSP.2 Security-enforcing functional specification ADV_TDS.1 Basic design AGD_OPE.1 Operational user guidance AGD_PRE.1 Preparative procedures. Developer action elements: AVA_VAN.2.1D The developer shall provide the TOE for testing. Content and presentation elements: AVA_VAN.2.1C The TOE shall be suitable for testing. Evaluator action elements: AVA_VAN.2.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. AVA_VAN.2.2E The evaluator shall perform a search of public domain sources to identify potential vulnerabilities in the TOE. AVA_VAN.2.3E The evaluator shall perform an independent vulnerability analysis of the TOE using the guidance documentation, functional specification, TOE design and security architecture description to identify potential vulnerabilities in the TOE. AVA_VAN.2.4E The evaluator shall conduct penetration testing, based on the identified potential vulnerabilities, to determine that the TOE is resistant to attacks performed by an attacker possessing Basic attack potential. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 84 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 6.3 Security Requirements Rationale This section demonstrates that the security requirements are satisfied with the security objectives for the TOE. 6.3.1 Security Functional Requirements’ Rationale The security functional requirements’ rationale shall demonstrate the following: - Each security objective is addressed based on at least one security functional requirement. - Each security functional requirement addresses at least one security objective. Table 40: Completeness of security functional requirements TOE Security Function O.DOC.NO_DIS O.DOC.NO_ALT O.FUNC.NO_ALT O.PROT.NO_ALT O.CONF.NO_DIS O.CONF.NO_ALT O.USER.AUTHORIZED O.INTERFACE.MANAGED O.SOFTWARE.VERIFIED O.AUDIT.LOGGED O.AUDIT_STORAGE.PROTECTED O.AUDIT_ACCESS.AUTHORIZED O.DATA.ENCRYPTED O.DATA.OVERWRITTEN O.FAX_DATA.FORMAT O.INFO.FLOW_CONTROLED O.TIME_STAMP_RELIABLE FAU_GEN.1  FAU_GEN.2  FAU_SAR.1  FAU_SAR.2  FAU_SEL.1  FAU_STG.1  FAU_STG.4  FCS_CKM.1(1)   FCS_CKM.1(2)       FCS_CKM.4(1)   FCS_CKM.4(2)       FCS_COP.1(1)   FCS_COP.1(2)       FDP_ACC.1(1)    FDP_ACC.1(2)  FDP_ACC.1(3)  FDP_ACF.1(1)    Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 85 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved FDP_ACF.1(2)  FDP_ACF.1(3)  FDP_ETC.1  FDP_IFC.1(1)  FDP_IFC.1(2)  FDP_IFC.1(3)  FDP_IFC.1(4)  FDP_IFC.1(5)  FDP_IFF.1(1)  FDP_IFF.1(2)  FDP_IFF.1(3)  FDP_IFF.1(4)  FDP_IFF.1(5)  FDP_RIP.1   FIA_AFL.1  FIA_ATD.1  FIA_UAU.1   FIA_UAU.7  FIA_UID.1          FIA_USB.1  FMT_MOF.1   FMT_MSA.1(1)    FMT_MSA.1(2)  FMT_MSA.1(3)  FMT_MSA.1(4)  FMT_MSA.3(1)     FMT_MSA.3(2)   FMT_MTD.1    FMT_SMF.1       FMT_SMR.1        FPT_FDI_EXP.1  FPT_STM.1   FPT_TST.1  FTA_SSL.3   FTP_ITC.1       Table 41: Security Requirements Rationale Objectives Description SFRs Purpose O.DOC.NO_DIS Protection of User Data from unauthorized disclosure or FDP_ACC.1(1) Enforces protection by establishing an access control policy. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 86 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Objectives Description SFRs Purpose O.DOC.NO_ALT O.FUNC.NO_ALT alteration FDP_ACF.1(1) Supports the access control policy by providing an access control function. FIA_UID.1 Supports access control and security roles by requiring user identification. FMT_MSA.1(1)( 2) Supports access control function by enforcing control of security attributes. FMT_MSA.3(2) Supports access control and information flow control function by enforcing control of security attribute defaults. FMT_SMF.1 Supports control of security attributes by requiring functions to control attributes. FMT_SMR.1 Supports control of security attributes by requiring security roles. O.DOC.NO_DIS Protection of User Document Data from unauthorized disclosure FCS_CKM.1(1) Supports encryption of the data to protect the data transmitted via network and saved to the HDD by generating cryptographic keys. FCS_CKM.4(1) Supports encryption of the data to protect the data transmitted via network and saved to the HDD by destructing cryptographic keys. FCS_COP.1(1) Supports encryption of the data to be stored on the HDD by performing a cryptographic operation. FDP_ETC.1 Supports access control policy by exporting the user data without the user data’s associated security attributes. FDP_RIP.1 Enforces protection by making residual data unavailable. FDP_ACC.1(3) Supports access control policy by providing access control function. FDP_ACF.1(3) Enforces protection by establishing an access control policy. O.PROT.NO_ALT O.CONF.NO_DIS O.CONF.NO_ALT Protection of TSF Data from Unauthorized disclosure or alteration FIA_UID.1 Supports access control and security roles by requiring user identification. FMT_MTD.1 Enforces protection by restricting access. FMT_SMF.1 Supports control of security attributes by requiring functions to control attributes. FMT_SMR.1 Supports control of security attributes by requiring security roles. O.USER. Authorization of Normal Users and Administrators to FDP_ACC.1(2) Enforces authorization by establishing an access control Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 87 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Objectives Description SFRs Purpose AUTHORIZED use the TOE policy. FDP_ACF.1(2) Supports the access control policy by providing an access control function. FIA_AFL.1 Supports authentication by handling authentication failure. FIA_ATD.1 Supports authorization by associating security attributes with users. FIA_UAU.1 Enforces authorization by requiring user authentication. FIA_UAU.7 Supports authorization by protecting authentication feedback. FIA_UID.1 Enforces authorization by requiring user identification. FIA_USB.1 Enforces authorization by distinguishing subject security attributes associated with user roles. FMT_MSA.1(1) Supports access control function by enforcing control of security attributes. FMT_MSA.3(2) Supports access control and information flow control function by enforcing control of security attribute defaults. FMT_SMR.1 Supports authorization by requiring security roles. FTA_SSL.3 Enforces authorization by terminating inactive sessions. O.INTERFACE. MANAGED Management of external interfaces FIA_UAU.1 Enforces management of external interfaces by requiring user authentication. FIA_UID.1 Enforces management of external interfaces by requiring user identification. FTA_SSL.3 Enforces management of external interfaces by terminating inactive sessions. FPT_FDI_EXP.1 Enforces management of external interfaces by requiring (as needed) administrator control of data transmission from external Interfaces to Shared-medium Interfaces. O.SOFTWARE. VERIFIED Verification of software integrity FPT_TST.1 Enforces verification of software by requiring self-tests. O.AUDIT.LOGGED Logging and authorized access to audit events FAU_GEN.1 Enforces audit policies by requiring logging of relevant events. FAU_GEN.2 Enforces audit policies by requiring logging of information associated with audited events. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 88 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Objectives Description SFRs Purpose FAU_SEL.1 Supports audit policies by providing the ability to select the set of events to be audited. FIA_UID.2 Supports audit policies by associating a user’s identity with events. FPT_STM.1 Supports audit policies by requiring time stamps associated with events. O.AUDIT_STORAG E.PROTECTED Protected audit trail storage and prevention of audit data loss FAU_STG.1 Enforces protection of audit trail storage by preventing unauthorized modification, access, deletion to the stored audit records in the audit trail. FAU_STG.4 Enforces prevention of audit data loss by overwriting the oldest stored audit records. O.AUDIT_ACCESS. AUTHORIZED Access control of audit records only by authorized persons FAU_SAR.1 Enforces the audit review function by providing authorized U.ADMINISTRATOR with the ability to read all of audit information from the audit records. FAU_SAR.2 Enforces restriction of the audit review function by prohibiting all users read access to the audit records, except those users that have been granted access specifically. O.DATA. ENCRYPTED Encryption of the data to be stored into the HDD FCS_CKM.1(1) Supports encryption of the data to be stored on the HDD by generating cryptographic keys. FCS_CKM.4(1) Supports encryption of the data to be stored on the HDD by destructing cryptographic keys. FCS_COP.1(1) Supports encryption of the data to be stored on the HDD by performing a cryptographic operation. O.DATA. OVERWRITTEN Image overwrite to protect the used document data in the HDD FDP_RIP.1 Enforces protection by making residual data unavailable. O.FAX_DATA.FOR MAT Block incoming fax data if received fax data does not qualify fax image standard. FDP_IFC.1(4) Enforces protection by establishing a FAX data control policy. FDP_IFF.1(4) Supports FAX data control policy by providing information flow control function. O.INFO.FLOW_CO NTROLED Control inflowing information data that are not allowed from external network. FDP_IFC.1(1) Enforces protection by establishing a MAC filtering rule policy. FDP_IFC.1(2) FDP_IFC.1(3) Enforces protection by establishing an IP filtering rule policy. FDP_IFC.1(5) Enforces protection by establishing a Protocol/Port information flow control policy. FDP_IFF.1(1) Supports the MAC filtering rule Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 89 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Objectives Description SFRs Purpose policy by providing an information flow control function. FDP_IFF.1(2) FDP_IFF.1(3) Supports the IP filtering rule policy by providing an information flow control function. FDP_IFF.1(5) Supports the Protocol/Port information flow control policy by providing an information flow control function. FMT_SMF.1 Supports control of security attributes by requiring functions to control attributes. FMT_SMR.1 Supports control of security attributes by requiring security roles. FMT_MSA.1 Supports access control function by enforcing control of security attributes. FMT_MSA.3(1) Supports the access control and information flow control function by enforcing control of security attribute defaults. FMT_MSA.3(2) Supports access control and information flow control function by enforcing control of security attribute defaults. 6.3.2 Security Assurance Requirements Rationale Security assurance requirements of this security target conform to IEEE Std 2600.1-2009 Version 1.0 (CCEVS-VR-VID10340-2009, June 12, 2009) as known as U.S. Government Protection Profile for Hardcopy Devices in Basic Robustness Environments [PP]. This Security Target has been developed for Hardcopy Devices used in restrictive commercial information processing environments that require a relatively high level of document security, operational accountability, and information assurance. The TOE environment will be exposed to only a low level of risk because it is assumed that the TOE will be located in a restricted or monitored environment that provides almost constant protection from unauthorized and unmanaged access to the TOE and its data interfaces. Agents cannot physically access any non-volatile storage without disassembling the TOE, except for removable non-volatile storage devices, where protection of User and TSF Data are provided when such devices are removed from the TOE environment. Agents have limited or no means of infiltrating the TOE with code to effect a change, and the TOE self-verifies its executable code to detect unintentional malfunctions. As such, the Evaluation Assurance Level 3 is appropriate. EAL 3 is augmented with ALC_FLR.2, Flaw reporting procedures. ALC_FLR.2 ensures that instructions and procedures for the reporting and remediation of identified security flaws are in place, and their inclusion is expected by the consumers of this TOE. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 90 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 6.4 Dependency Rationale 6.4.1 SFR Dependencies FAU_GEN.1 has a dependency relationship with FPT_STM.1. FCS_CKM.4, FCS_COP.1 has a dependency relationship with FCS_CKM.1. - Table 42: Dependencies on the TOE Security Functional Components No. Functional Component ID Dependencies Reference 1 FAU_GEN.1 FPT_STM.1 49 2 FAU_GEN.2 FAU_GEN.1 FIA_UID.1 1, 36 3 FAU_SAR.1 FAU_GEN.1 1 4 FAU_SAR.2 FAU_SAR.1 3 5 FAU_SEL.1 FAU_GEN.1 FMT_MTD.1 1, 45 6 FAU_STG.1 FAU_GEN.1 1 7 FAU_STG.4 FAU_STG.1 6 8 FCS_CKM.1(1) [FCS_CKM.2 or FCS_COP.1] FCS_CKM.4 10, 12 9 FCS_CKM.1(2) [FCS_CKM.2 or FCS_COP.1] FCS_CKM.4 11,13 10 FCS_CKM.4(1) [FDP_ITC.1, or FDP_ITC.2, or FCS_CKM.1] 8 11 FCS_CKM.4(2) [FDP_ITC.1, or FDP_ITC.2, or FCS_CKM.1] 9, 52 12 FCS_COP.1(1) [FDP_ITC.1, or FDP_ITC.2, or FCS_CKM.1] FCS_CKM.4 8, 10 13 FCS_COP.1(1) [FDP_ITC.1, or FDP_ITC.2, or FCS_CKM.1] 9, 11, 52 Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 91 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved No. Functional Component ID Dependencies Reference FCS_CKM.4 14 FDP_ACC.1(1) FDP_ACF.1 17 15 FDP_ACC.1(2) FDP_ACF.1 18 16 FDP_ACC.1(3) FDP_ACF.1 19 17 FDP_ACF.1(1) FDP_ACC.1 FMT_MSA.3 14, 43 18 FDP_ACF.1(2) FDP_ACC.1 FMT_MSA.3 15, 43 19 FDP_ACF.1(3) FDP_ACC.1 FMT_MSA.3 16, 44 20 FDP_ETC.1 [FDP_ACC.1, or FDP_IFC.1] 15 21 FDP_IFC.1(1) FDP_IFF.1 26 22 FDP_IFC.1(2) FDP_IFF.1 27 23 FDP_IFC.1(3) FDP_IFF.1 28 24 FDP_IFC.1(4) FDP_IFF.1 29 25 FDP_IFC.1(5) FDP_IFF.1 30 26 FDP_IFF.1(1) FDP_IFC.1 FMT_MSA.3 21, 44 27 FDP_IFF.1(2) FDP_IFC.1 FMT_MSA.3 22, 44 28 FDP_IFF.1(2) FDP_IFC.1 FMT_MSA.3 23, 44 29 FDP_IFF.1(4) FDP_IFC.1 FMT_MSA.3 24, 43 30 FDP_IFF.1(5) FDP_IFC.1 FMT_MSA.3 25, 43 31 FDP_RIP.1 - 32 FIA_AFL.1 FIA_UAU.1 34 33 FIA_ATD.1 - 34 FIA_UAU.1 FIA_UID.1 36 Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 92 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved No. Functional Component ID Dependencies Reference 35 FIA_UAU.7 FIA_UAU.1 34 36 FIA_UID.1 - 37 FIA_USB.1 FIA_ATD.1 33 38 FMT_MOF.1 FMT_SMR.1 FMT_SMF.1 46, 47 39 FMT_MSA.1(1) [FDP_ACC.1, or FDP_IFC.1] FMT_SMR.1 FMT_SMF.1 14, 46, 47 40 FMT_MSA.1(2) [FDP_ACC.1, or FDP_IFC.1] FMT_SMR.1 FMT_SMF.1 15, 46, 47 41 FMT_MSA.1(3) [FDP_ACC.1, or FDP_IFC.1] FMT_SMR.1 FMT_SMF.1 16, 46, 47 42 FMT_MSA.1(4) [FDP_ACC.1, or FDP_IFC.1] FMT_SMR.1 FMT_SMF.1 21,22, 23, 24, 25, 46, 47 43 FMT_MSA.3(1) FMT_MSA.1 FMT_SMR.1 39, 40, 42, 47 44 FMT_MSA.3(2) FMT_MSA.1 FMT_SMR.1 41, 42, 47 45 FMT_MTD.1 FMT_SMR.1 FMT_SMF.1 46, 47 46 FMT_SMF.1 - 47 FMT_SMR.1 FIA_UID.1 36 48 FPT_FDI_EXP.1 FMT_SMR.1 FMT_SMF.1 46, 47 49 FPT_STM.1 - 50 FPT_TST.1 - 51 FTA_SSL.3 - 52 FTP_ITC.1 - Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 93 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 6.4.2 SAR Dependencies The dependency of each assurance package (EAL3) provided by the CC is already satisfied. ALC_FLR.2 added to the assurance package (EAL3) has no dependency relationship with others, so it is satisfied. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 94 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 7 TOE Summary Specification 7.1 TOE Basic Functions The TOE provides the following basic features: ⎯ Printing—producing a hardcopy document from its electronic form ⎯ Scanning—producing an electronic document from its hardcopy form ⎯ Copying—duplicating a hardcopy document ⎯ Faxing—scanning documents in hardcopy form and transmitting them in electronic form over telephone lines and receiving documents in electronic form over telephone lines and printing them in hardcopy form ⎯ Document storage and retrieval—storing an electronic document during one document processing job for access during one or more subsequent document processing jobs, and retrieving an electronic document that was stored during a previous document processing job ⎯ Shared-medium Interfaces—transmitting or receiving User Data or TSF Data between the HCD and external devices over communications media which, in conventional practice, is or can be simultaneously accessed by multiple users 7.2 TOE Security Functions This section presents the security functions performed by the TOE to satisfy the identified SFRs in Section 6.1 • Identification & Authentication (TSF_FIA) • Network Access Control (TSF_NAC) • Security Management (TSF_FMT) • Security Audit (TSF_FAU) • Image Overwrite (TSF_IOW) • Data Encryption (TSF_NVE) • Fax Data Control (TSF_FLW) • Self Testing (TSF_STE) 7.2.1 Identification & Authentication (TSF_FIA) Relevant SFR: FIA_AFL.1, FIA_ATD.1, FIA_UAU.1, FIA_UAU.7, FIA_UID.1, FIA_USB.1, FMT_SMR.1, FTA_SSL.3, FDP_ACC.1(1)(2)(3), FDP_ACF.1(1)(2)(3), FDP_ETC.1, FMT_MSA.1(1)(2), FMT_MSA.3(1)(2) The TOE can restrict U.NORMAL from accessing the machine or application. U. ADMINISTRATOR can also give specific permission for U.NORMAL to only use certain features of the machine. U.NORMAL and U.ADMINISTRATOR should be identified and authenticated by entering as ID and Password to access the TOE’s management functions. In the authentication process, only ambiguous feedback, like a user’s password displayed as * or •, are provided to protect users from dictionary attack and leakage of user information. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 95 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved U. ADMINISTRATOR can choose the authentication method for user authentication. -Local authentication: Activate local authentication. Authentication is managed by using the user information registered in TOE. -Network authentication: Activate network authentication. Authentication is conducted to the remote authentication server such as LDAP, Kerberos, SMB. User information is not registered in TOE. -Standard Accounting: Activate Standard Accounting. authentication requests U.NORMAL to login before using all device applications. U.NORMAL cannot use any application without logging in. It also manages use of specific applications such as fax, copy, print, scan- to-email, scan to server. When the number of consecutive invalid authentication attempts has exceeded the 3 times within 3 minutes, the account will be locked for 3 minutes. If U. ADMINISTRATOR is idle for 3 minutes, the mutual session will be terminated automatically. U.NORMAL password should be at least 4-characters long. U.ADMINISTRATOR password should be at least 8-characters long and at least 1 number,1 special character, and 1 alphabetical character . The TOE supports the role management of U.USER by U. ADMINISTRATOR. -Role Management: U.ADMINISTRATOR can give permissions to U.NORMAL to only use certain features of the machine and can give different rights to different U.NORMAL by using role management. -User Account List: The TSF shall store user information on the machine’s hard drive. U.ADMINISTRATOR can use this feature to manage the users using the machine. U.ADMINISTRATOR can add up to 500 entries. U.USER is allowed to view all of U.NORMAL’s own Account information. With the User ID, TOE associates the roles of U. U.NORMAL TOE enforces the Common Access Control & TOE Function Access Control based on the user account assigned to User ID by U.ADMINISTRATOR when U.NORMAL accesses print/scan/copy/fax/document storage retrieval functions offered by the MFP. - Common Access Control U.NORMAL is able to perform operations (modify & delete) on the objects (D.DOC & D.FUN) owned by his/her own when doing print/scan/fax-in/fax-out job. However, there is no access control restriction associated with a copy job. Additionally, the image data (.jpg, .bmp, .tiff, etc.) generated at the result of the fax/scan/document storage and retrieval job could be exported to a external server (SMB Server, FTP Server, Mail Server) without security attributes associated with the user data. - Service (PRN, SCN, CPY, DSR, FAX) Access Control U.NORMAL is able to perform operations (read) on the objects (D.DOC) owned by his/her own when doing a document storage and retrieval job. Additionally, the image data (.jpg, .bmp, .tiff, etc.) generated at the result of the fax/scan/document storage and retrieval job could be exported to a external server (SMB Server, FTP Server, Mail Server) without security attributes associated with the user data. -TOE Function Access Control Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 96 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved U.NORMAL is able to access and execute the printing/scanning/copying/faxing/document storage and retrieval functions explicitly authorized by U.ADMINISTRATOR to use the function. PIN authentication is requested before accessing store print or the secure box. This authentication needs to configure the password from the print driver, and it is used for loading a stored file using the control panel. - Secure box U.NORMAL can save PC-printed, faxed, scanned, documents in the box and print the saved documents later, and if U.NORMAL wants the box to be a secured box, check the Secured Box and enter the password to be used for accessing the box. - Store print & Confidential print Confidential print is used for printing confidential documents. U.USER needs to enter a password to print it. Store print also only allows the U.USER who stored the file to access the file with the password by setting the secret property. 7.2.2 Network Access Control (TSF_NAC) Relevant SFR: FDP_IFC.1(1)(2)(3)(5), FDP_IFF.1(1)(2)(3)(5) The MFP system including the TOE has a network interface card (network card) connected to an external network. The MFP system can send/receive data and MFP configuration information and, thus, is able to configure MFP settings. There are two methods to control access to the MFP from outside of the TOE through a network; - Protocol/Port control: 1) Network protocols: Raw TCP/IP Printing, LPR/LPD, HTTP, SLP, UPnP, mDNS, WINS, SNMPv1/v2, SetIP IPv6, HTTPS, DDNS, WSD, SNMPv3 Protocol, SNTP Protocol 2) Port number: Logical channel in the range of 1 to 65535 A standard communication protocol and a port performs as a logical network channel. These services start up simultaneously as the system’s network card boots. Among these services, the service that uses upper protocol utilizes a predefined “Well-known port”. The TOE only allows access from authorized ports, connection using authorized protocol services by configuring the port number, and enabling/disabling network services accessing the MFP system. Only U.ADMINISTRATOR can configure these functions, and these configurations are altered on each reboot of network card, and thus MFP system information and electronic image data are protected from unauthorized reading and falsification. All packets are denied if there is no Protocol/Port information flow control rule allowed (enabled) by U.ADMINISTRATOR except for Raw TCP/IP Printing, LPR/LPD, HTTP, SLP, UPnP, mDNS, WINS, SNMPv1/v2, SetIP. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 97 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved - IP and Mac Filtering: U.ADMINISTRATOR can manage filtering rules for IPv4/IPv6 address and MAC address. U.ADMINISTRATOR can register specific IP/MAC filtering rules. All packets are allowed if there is no IP and MAC filtering rule registered by U.ADMINISTRATOR 1) IP filtering All packets are only allowed as IP filtering rule registered by U.ADMINISTRATOR U.ADMINISTRATOR can register priority to perform a filtering and services to accept. (Services to accept : Raw TCP/IP Printing, LPR/LPD, HTTP, IPP, SNMP / Priority : 1~9 ) 2) MAC filtering All packets via MAC addresses registered by U.ADMINISTRATOR are not allowed 7.2.3 Security Management (TSF_FMT) Relevant SFR: FMT_MOF.1, FMT_MSA.1(1)(2), FMT_MSA.3(1)(2), FMT_MTD.1, FMT_SMF.1, FMT_SMR.1 The TOE accomplishes security management for the security function, TSF data, and security attribute. Only U.ADMINISTRATOR can manage the security functions after identification and authentication. The TSF shall restrict the ability to determine the behavior of, and disable/enable the functions accessible to U.ADMINISTRATOR. Table 43 : Management of Security Functions Behavior Security Function Selection Operation determine the behavior of disable enable System Reboot ○ Authentication Mode ○ ○ Log Configuration ○ ○ Secure HTTP ○ ○ IP/MAC Filtering ○ ○ ○ Image Overwrite ○ ○ ○ Data Encryption ○ The TSF shall restrict the ability to query, modify, delete, and add the security attributes accessible to U.ADMINISTRATOR. The TSF shall restrict the ability to query, modify, delete, and add the security attributes of User Management to U.ADMINISTRATOR Table 44 : Management of Security Attributes Security Attributes Selection Operation query modify delete [add] MAC Address ○ ○ ○ ○ Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 98 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved IPv4 or IPv6 Address ○ ○ ○ ○ Protocol (to deny) ○ ○ Port ○ ○ User Management ○ ○ ○ ○ The TSF shall restrict the ability to query, modify, delete, and add the TSF data to the authorized identified roles. Table 45 : Management of TSF data TSF data Selection Operation the authorized identified roles query modify delete [add] Password of Secured Box ○ ○ ○ U.ADMINISTRATOR Kerberos Server Configuration ○ ○ ○ ○ SMB Server Configuration ○ ○ ○ ○ LDAP Server Configuration ○ ○ ○ ○ FTP Server Configuration ○ ○ SMTP Server Configuration ○ ○ Local Authentication List ○ ○ ○ ○ User Account List (Standard Accounting) ○ ○ ○ ○ Audit Log Data ○ ○ Network Protocol and Port Configuration (Raw TCP/IP Printing, LPR/LPD, HTTP, HTTPS, SLP, UPnP, mDNS, WINS, DDNS, TCP/IPv4, TCP/IPv6, IPP, SNMP, SMTP, SetIP, SNTP) ○ ○ Digital Certificate ○ ○ ○ ○ IPv4/6 filtering Address ○ ○ ○ ○ Mac filtering Address ○ ○ ○ ○ Image Overwrite configuration ○ ○ Encryption Key data ○ ○ Application Management ○ ○ ○ ○ There are two types of Users: U.NORMAL and U.ADMINISTRATOR: U.ADMINISTRATOR has been specifically granted the authority to perform security management of the TOE and U.NORMAL is authorized to perform User Document Data processing functions (Copy, Scan, Fax, Print, Document Box) of the TOE. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 99 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 7.2.4 Security Audit (TSF_FAU) Relevant SFR: FAU_GEN.1 FAU_GEN.2, FAU_SAR.1, FAU_SAR.2, FAU_SEL.1, FAU_STG.1, FAU_STG.4, FPT_STM.1 The TSF provides an internal capability to generate an audit record of the security audit event (job log, security event log, operation log) and audit data includes the following information (type of event, date and time of the event, success or failure, log out, access and delete, enabled and disabled). U.ADMINISTRATOR only has the capability to manage this function and to read all of the audit data (job log, security event log, operation log) from the audit records. The TSF can select the set of events to be audited from the set of all auditable events based on the event type. The TSF protects the stored audit records in the audit trail from unauthorized deletion. Only U.ADMINISTRATOR can delete audit log data. The TOE can store up to 7,000 for all log events. (The maximum number for each log event: job log: 5,000; security log: 1,000; operation log: 1,000) When each log events exceeds the maximum number, the TOE overwrites the oldest stored audit records. The records defined audit event is associated with identity of user who caused the event. The TOE provides time stamp of clock function which is issued the defined audit event occurred. The clock setting only can be changed by U.ADMINISTRATOR Table 46: Security Audit Event Relevant SFR Auditable Events Additional Information FDP_ACF.1(1) Job completion -Type of job FIA_UAU.2 Both successful and unsuccessful use of the authentication mechanism - FIA_UID.2 Both successful and unsuccessful use of the identification mechanism - FTA_SSL.3 Termination of an interactive session by the session termination mechanism - FMT_MTD.1 Log data access and deletion - FMT_MOF.1 Modification of the setting of the audit log generation function items - FPT_TST.1 Execution of the TSF self tests and the results of the tests - 7.2.5 Image Overwrite (TSF_IOW) Relevant SFR: FDP_RIP.1 The TOE provides Image Overwrite functions that delete the stored file from the hard disk drive. The Image Overwrite function consists of Automatic Image Overwrite and Manual Image Overwrite. The TOE implements an image overwrite security function (Automatic Image Overwrite) to overwrite temporary files created during the copying, printing, scan-to-email, or scan-to-server processes. Also, users can delete their own files stored in the TOE. The image overwrite security function can also be invoked manually only by U.ADMINISTRATOR (Manual Image Overwrite). Once invoked, the Manual Image Overwrite cancels all Print and Scan jobs, halts the printer interface (network), overwrites the contents of the reserved section 3 times on Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 100 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved the hard disk, and then the main controller reboots. If there are any problems during overwriting, the Manual Image Overwrite job automatically restarts after the problem is resolved to overwrite the remaining area. 7.2.6 Data Encryption (TSF_NVE) Relevant SFR: FCS_CKM.1(1), FCS_CKM.4(1), FCS_COP.1(1) The TOE provides an encryption function during the data storage procedure and decryption function in the process of accessing stored data from the hard disk drive. 7.2.7 Fax Data Control (TSF_FLW) Relevant SFR: FDP_IFC.1(4), FDP_IFF.1(4), FPT_FDI_EXP.1 In the TOE, the memory areas for the fax board and for the network port on the main controller board are separated. The TOE inspects whether the received fax image is standardized with MMR, MR, or MH of T.4 specifications or not before forwarding the received fax image to e-mail or SMB/FTP. When the data is considered to be safe, the memory copy continues from the fax memory area to the network memory area. The fax data in network memory is transmitted using SMTP, SMB, FTP servers through the internal network. When non-standardized format data are discovered, the TOE destroys the fax image. The information flow policy (SFP_FLW) is as follows: Direct access to a received fax image from the fax modem to the user PC through the internal network is not possible. Communication can be made only through the TOE. The fax image received from the fax line is inspected first. When the data is determined to be safe, the memory copy continues from the fax memory area to the network memory area. When a fax board is not installed, the information flow does not exist and does not need the protection. • The fax modem controller in the TOE is physically separated from the MFP controller, and fax function is logically separated from MFP functions. • The fax interface only answers to the predefined fax protocol and never answers to any other protocol. • The fax modem controller provides only a standardized fax image format of MMR, MR, or MH of T.4 specification. Therefore, the TOE does not answer to non-standardized format data. Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 101 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved Figure 4: Information Flow Summary 7.2.8 Self Testing (TSF_STE) Relevant SFR: FPT_TST.1 The TOE performs a suite of self tests during initial start-up. Self testing executes the TSF code and data integrity check to verify the correctness of TSF code and Data. The TOE executes the SHA256 hash algorithm with executable codes of TOE. It also compares the resulting hash data with saved data to verify the integrity. If the compared result is the same, integrity verification is successful. The TOE saves the TSF data to the encryption section. To verify TSF data integrity the TOE checks the sample string encryption. The TOE extracts the encryption Key data and decrypts the sample code with that Key and compare to the saved original sample string. If the sample string is same with previous the TOE defined the TSF data is not to corrupted.. When the TOE executes the self testing, the TOE generates audit log data for self testing as below. U.ADMINISTRATOR is authorized to view the audit log. Table 47 :Audit Event for TST Relevant SFR Auditable Events Additional Information FPT_TST.1 Both successful and unsuccessful use of TSF Function Verification result of the integrity of TST data and executable code -Success and failure -Date and time of the event Samsung SCX-5835NX/SCX-6555NX/SCX-6545NX/CLX-8385NX/CLX-8540NX Control Software V2.00.03.00 Security Target 102 Copyright 2010 Samsung Electronics Co., Ltd., All rights reserved 7.2.9 Secure Communication (TSF_SCO) Relevant SFR: FCS_CKM.1(2), FCS_CKM.4(2), FCS_COP.1(2), FPT_ITC.1 The TOE also provides secure communication between the TOE and the other trusted IT product by IPSEC. IPSEC provides securing Internet Protocol communications by authenticating and encrypting each IP packet of a communication session. IPSEC support ESP to provide confidentiality, origin authentication, integrity and IKE for key exchange. IPSEC supports 3DES, AES for encryption, SHA-1 for integrity and DH-Group: 1, 2, 5, 14, 15, 16, 17, 18 for key agreement. Only data by using IPSEC via network can be access the TOE.