Belkin F1DN102MOD-BA-4, F1DN202MOD-BA-
4, F1DN104MOD-BA-4, F1DN204MOD-BA-4,
F1DN108MOD-BA-4, F1DN208MOD-BA-4,
F1DN102MOD-HH-4, F1DN102MOD-PP-4,
F1DN102MOD-DD-4, F1DN202MOD-HH-4,
F1DN202MOD-PP-4, F1DN202MOD-DD-4,
F1DN104MOD-HH-4, F1DN104MOD-PP-4,
F1DN108MOD-PP-4, F1DN104MOD-DD-4,
F1DN204MOD-HH-4, F1DN204MOD-PP-4,
F1DN208MOD-PP-4, F1DN204MOD-DD-4,
F1DN104MOD-XX-4, F1DN204MOD-XX-4
Firmware Version 44404-E7E7 Peripheral
Sharing Devices
Security Target
Doc No: 2149-001-D102B2
Version: 1.6
8 July 2021
Belkin International, Inc.
12045 E. Waterfront Drive
Playa Vista, CA 90094 USA
Prepared by:
EWA-Canada, An Intertek Company
1223 Michael Street North, Suite 200
Ottawa, Ontario, Canada
K1J 7T2
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page i of v
CONTENTS
1 SECURITY TARGET INTRODUCTION.............................................1
1.1 DOCUMENT ORGANIZATION........................................................... 1
1.2 SECURITY TARGET REFERENCE....................................................... 2
1.3 TOE REFERENCE........................................................................... 2
1.4 TOE OVERVIEW............................................................................ 2
Security Features ...........................................................................3
TOE Environment ...........................................................................5
1.5 TOE DESCRIPTION ....................................................................... 6
Evaluated Configuration ..................................................................6
Physical Scope ...............................................................................7
Logical Scope.................................................................................9
2 CONFORMANCE CLAIMS.............................................................10
2.1 COMMON CRITERIA CONFORMANCE CLAIM .................................... 10
2.2 PROTECTION PROFILE CONFORMANCE CLAIM................................. 10
2.3 PACKAGE CLAIM......................................................................... 11
2.4 MODULE CLAIM.......................................................................... 11
2.5 CONFORMANCE RATIONALE ......................................................... 11
3 SECURITY PROBLEM DEFINITION..............................................12
3.1 THREATS .................................................................................. 12
3.2 ORGANIZATIONAL SECURITY POLICIES ......................................... 13
3.3 ASSUMPTIONS........................................................................... 13
4 SECURITY OBJECTIVES..............................................................14
4.1 SECURITY OBJECTIVES FOR THE TOE ............................................ 14
4.2 SECURITY OBJECTIVES FOR THE OPERATIONAL ENVIRONMENT......... 18
4.3 SECURITY OBJECTIVES RATIONALE............................................... 19
5 EXTENDED COMPONENTS DEFINITION......................................24
5.1 CLASS FDP: USER DATA PROTECTION ........................................... 24
FDP_APC_EXT Active PSD Connections............................................24
FDP_CDS_EXT Connected Displays Supported..................................25
FDP_FIL_EXT Device Filtering ........................................................26
FDP_IPC_EXT Internal Protocol Conversion......................................27
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page ii of v
FDP_PDC_EXT Peripheral Device Connection....................................27
FDP_RDR_EXT Re-Enumeration Device Rejection .............................29
FDP_RIP_EXT Residual Information Protection .................................30
FDP_SPR_EXT Sub-Protocol Rules ..................................................31
FDP_SWI_EXT PSD Switching ........................................................31
FDP_UDF_EXT Unidirectional Data Flow.........................................33
5.2 CLASS FPT: PROTECTION OF THE TSF ........................................... 33
FPT_FLS_EXT Failure with Preservation of Secure State ....................33
FPT_NTA_EXT No Access to TOE.....................................................34
FPT_TST_EXT TSF Testing .............................................................35
5.3 CLASS FTA: TOE ACCESS ............................................................ 35
FTA_CIN_EXT Continuous Indications .............................................35
6 SECURITY FUNCTIONAL REQUIREMENTS...................................37
6.1 CONVENTIONS AND APPLICABILITY .............................................. 37
Conventions ................................................................................37
Section Applicability......................................................................37
6.2 SECURITY FUNCTIONAL REQUIREMENTS FOR ALL DEVICES .............. 38
User Data Protection (FDP)............................................................40
Protection of the TSF (FPT)............................................................43
TOE Access (FTA).........................................................................44
6.3 ADDITIONAL SECURITY REQUIREMENTS FOR F1DN102MOD-BA-4,
F1DN104MOD-BA-4, F1DN108MOD-BA-4, F1DN102MOD-HH-4, F1DN104MOD-
HH-4 44
User Data Protection (FDP)............................................................46
6.4 ADDITIONAL SECURITY REQUIREMENTS FOR F1DN202MOD-BA-4,
F1DN204MOD-BA-4, F1DN208MOD-BA-4, F1DN202MOD-HH-4, F1DN204MOD-
HH-4 47
User Data Protection (FDP)............................................................48
6.5 ADDITIONAL SECURITY REQUIREMENTS FOR F1DN102MOD-PP-4,
F1DN104MOD-PP-4, F1DN108MOD-PP-4................................................... 49
User Data Protection (FDP)............................................................50
6.6 ADDITIONAL SECURITY REQUIREMENTS FOR F1DN102MOD-DD-4,
F1DN104MOD-DD-4 .............................................................................. 52
User Data Protection (FDP)............................................................53
6.7 ADDITIONAL SECURITY REQUIREMENTS FOR F1DN202MOD-PP-4,
F1DN204MOD-PP-4, F1DN208MOD-PP-4................................................... 53
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page iii of v
User Data Protection (FDP)............................................................55
6.8 ADDITIONAL SECURITY REQUIREMENTS FOR F1DN202MOD-DD-4,
F1DN204MOD-DD-4 .............................................................................. 56
User Data Protection (FDP)............................................................57
6.9 ADDITIONAL SECURITY REQUIREMENTS FOR F1DN104MOD-XX-4...... 57
User Data Protection (FDP)............................................................59
6.10 ADDITIONAL SECURITY REQUIREMENTS FOR F1DN204MOD-XX-4...... 61
User Data Protection (FDP) ..........................................................63
7 SECURITY ASSURANCE REQUIREMENTS ....................................66
8 SECURITY REQUIREMENTS RATIONALE.....................................67
8.1 SECURITY FUNCTIONAL REQUIREMENTS RATIONALE ....................... 67
8.2 DEPENDENCY RATIONALE............................................................ 67
8.3 SECURITY ASSURANCE REQUIREMENTS RATIONALE ........................ 68
9 TOE SUMMARY SPECIFICATION.................................................69
9.1 USER DATA PROTECTION ............................................................ 69
System Controller ........................................................................69
Keyboard and Mouse Functionality..................................................70
Video Switching Functionality.........................................................72
9.2 PROTECTION OF THE TSF ............................................................ 76
No Access to TOE .........................................................................76
Anti-tampering Functionality..........................................................77
TSF Testing .................................................................................77
9.3 TOE ACCESS.............................................................................. 77
Continuous Indications..................................................................77
Wired Remote Control...................................................................78
10 TERMINOLOGY AND ACRONYMS ................................................79
10.1 TERMINOLOGY........................................................................... 79
10.2 ACRONYMS................................................................................ 79
11 REFERENCES..............................................................................81
ANNEX A – LETTER OF VOLATILITY .................................................... A-1
ANNEX B – SFR DEVICE MATRIX......................................................... B-1
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page iv of v
LIST OF TABLES
Table 1 – Non-TOE Hardware and Software................................................. 5
Table 2 – TOE Peripheral Sharing Devices and Features ................................ 7
Table 3 – Remote Control Devices ............................................................. 8
Table 4 – Modular Secure KVM Series Models and Cables .............................. 8
Table 5 – Logical Scope of the TOE .......................................................... 10
Table 6 – Applicable Technical Decisions ................................................... 11
Table 7 – Threats.................................................................................. 12
Table 8 – Assumptions........................................................................... 13
Table 9 – Security Objectives for the TOE ................................................. 18
Table 10 – Security Objectives for the Operational Environment ................... 19
Table 11 – Security Objectives Rationale .................................................. 23
Table 12 – Functional Families of Extended Components ............................. 24
Table 13 – Devices and Applicable Sections............................................... 38
Table 14 – Summary of Security Functional Requirements........................... 40
Table 15 – Summary of Additional Security Functional Requirements for
F1DN102MOD-BA-4, F1DN104MOD-BA-4, F1DN108MOD-BA-4,
F1DN102MOD-HH-4 and F1DN104MOD-HH-4 ....................................... 45
Table 16 – Summary of Additional Security Functional Requirements for
F1DN202MOD-BA-4, F1DN204MOD-BA-4, F1DN208MOD-BA-4 and
F1DN204MOD-HH-4 ......................................................................... 48
Table 17 – Summary of Additional Security Functional Requirements for
F1DN102MOD-PP-4, F1DN104MOD-PP-4 and F1DN108MOD-PP-4............. 50
Table 18 – Summary of Additional Security Functional Requirements for
F1DN102MOD-DD-4 and F1DN104MOD-DD-4 ....................................... 52
Table 19 – Summary of Additional Security Functional Requirements for
F1DN202MOD-PP-4, F1DN204MOD-PP-4 and F1DN208MOD-PP-4............. 54
Table 20 – Summary of Additional Security Functional Requirements for
F1DN202MOD-DD-4 and F1DN204MOD-DD-4 ....................................... 56
Table 21 – Summary of Additional Security Functional Requirements for
F1DN104MOD-XX-4.......................................................................... 59
Table 22 – Summary of Additional Security Functional Requirements for
F1DN204MOD-XX-4.......................................................................... 63
Table 23 – Security Assurance Requirements............................................. 66
Table 24 – Functional Requirement Dependencies ...................................... 68
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page v of v
Table 25 – Terminology ......................................................................... 79
Table 26 – Acronyms............................................................................. 80
Table 27 – References ........................................................................... 81
Table 28 – Security Functional Requirements and Devices .......................... B-2
LIST OF FIGURES
Figure 1 – Simplified Switching Diagram..................................................... 5
Figure 2 – KVM Switch Evaluated Configuration ........................................... 6
Figure 3 – Display EDID Read Function..................................................... 72
Figure 4 – Display EDID Write Function .................................................... 73
Figure 5 – Display Normal Mode .............................................................. 74
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 1 of 81
1 SECURITY TARGET INTRODUCTION
This Security Target (ST) defines the scope of the evaluation in terms of the
assumptions made, the intended environment for the Target of Evaluation
(TOE), the Information Technology (IT) security functional and assurance
requirements to be met, and the level of confidence (evaluation assurance level)
to which it is asserted that the TOE satisfies its IT security requirements. This
document forms the baseline for the Common Criteria (CC) evaluation.
1.1 DOCUMENT ORGANIZATION
Section 1, ST Introduction, provides the Security Target reference, the Target
of Evaluation reference, the TOE overview and the TOE description.
Section 2, Conformance Claims, describes how the ST conforms to the
Common Criteria, Protection Profile (PP) and PP Modules.
Section 3, Security Problem Definition, describes the expected environment
in which the TOE is to be used. This section defines the set of threats that are
relevant to the secure operation of the TOE, organizational security policies with
which the TOE must comply, and secure usage assumptions applicable to this
analysis.
Section 4, Security Objectives, defines the set of security objectives to be
satisfied by the TOE and by the TOE operating environment in response to the
problem defined by the security problem definition.
Section 5, Extended Components Definition, defines the extended
components which are then detailed in Section 6.
Section 6, Security Functional Requirements, specifies the security
functional requirements that must be satisfied by the TOE and the IT
environment.
Section 7, Security Assurance Requirements, specifies the security
assurance requirements that must be satisfied by the TOE and the IT
environment.
Section 8, Security Requirements Rationale, provides a rationale for the
selection of functional and assurance requirements.
Section 9, TOE Summary Specification, describes the security functions that
are included in the TOE to enable it to meet the IT security functional
requirements.
Section 10, Terminology and Acronyms, defines the acronyms and
terminology used in this ST.
Section 11, References, provides a list of documents referenced in this ST.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 2 of 81
1.2 SECURITY TARGET REFERENCE
ST Title: Belkin F1DN102MOD-BA-4, F1DN202MOD- BA-4,
F1DN104MOD-BA-4, F1DN204MOD- BA-4,
F1DN108MOD- BA-4, F1DN208MOD- BA-4,
F1DN102MOD-HH-4, F1DN102MOD-PP-4,
F1DN102MOD-DD-4, F1DN202MOD-HH-4,
F1DN202MOD-PP-4, F1DN202MOD-DD-4,
F1DN104MOD-HH-4, F1DN104MOD-PP-4,
F1DN108MOD-PP-4, F1DN104MOD-DD-4,
F1DN204MOD-HH-4, F1DN204MOD-PP-4,
F1DN208MOD-PP-4, F1DN204MOD-DD-4,
F1DN104MOD-XX-4, F1DN204MOD-XX-4 Firmware
Version 44404-E7E7 Peripheral Sharing Devices
Security Target
ST Version: 1.6
ST Date: 8 July 2021
1.3 TOE REFERENCE
TOE Identification: Belkin F1DN102MOD-BA-4, F1DN202MOD-BA-4,
F1DN104MOD-BA-4, F1DN204MOD-BA-4,
F1DN108MOD-BA-4, F1DN208MOD-BA-4,
F1DN102MOD-HH-4, F1DN102MOD-PP-4,
F1DN102MOD-DD-4, F1DN202MOD-HH-4,
F1DN202MOD-PP-4, F1DN202MOD-DD-4,
F1DN104MOD-HH-4, F1DN104MOD-PP-4,
F1DN108MOD-PP-4, F1DN104MOD-DD-4,
F1DN204MOD-HH-4, F1DN204MOD-PP-4,
F1DN208MOD-PP-4, F1DN204MOD-DD-4,
F1DN104MOD-XX-4, F1DN204MOD-XX-4 Firmware
Version 44404-E7E7 Peripheral Sharing Devices
TOE Developer: Belkin International, Inc.
TOE Type: Peripheral Sharing Device (Other Devices and Systems)
1.4 TOE OVERVIEW
The Belkin Secure Peripheral Sharing Devices are part of the Modular Secure
KVM Series product line. These KVMs are modular KVM switches that support
keyboard, mouse and video switching only. The units natively support High-
Definition Multimedia Interface (HDMI) for switching, but also support
DisplayPort, Digital Visual Interface -D (DVI-D), Video Graphics Array (VGA) and
Universal Serial Bus Type C (USB-Type C) with DisplayPort as an alternate
function video protocols through the use of proprietary cables. For devices that
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 3 of 81
support DisplayPort, DVI-D, VGA and USB-Type C, the cables convert the source
protocol to HDMI. The cables are considered to be part of the TOE.
A breakdown of the models, base model and cables may be found in Table 4,
below.
Security Features
The Belkin Secure Keyboard, Video, Mouse (KVM) Switches allow users to share
keyboard, video, and mouse peripherals between a number of connected
computers. Security features ensure isolation between computers and
peripherals to prevent data leakage between connected systems.
The following security features are provided by the Belkin Peripheral Sharing
Devices (PSDs):
• Video Security
• Computer video input interfaces are isolated through the use of
separate electronic components, power and ground domains
• The display is isolated by dedicated, read-only, Extended Display
Identification Data (EDID) emulation for each computer
• Access to the monitor’s EDID is blocked
• Access to the Monitor Control Command Set (MCCS commands) is
blocked
• Both DisplayPort and High-Definition Multimedia Interface (HDMI)
video is supported
• Various video input protocols are supported:
 HDMI is supported on the F1DN102MOD-BA-4,
F1DN104MOD-BA-4, F1DN202MOD-BA-4, F1DN204MOD-BA-
4, F1DN108MOD-BA-4, F1DN208MOD-BA-4, F1DN102MOD-
HH-4, F1DN202MOD-HH-4, F1DN104MOD-HH-4,
F1DN204MOD-HH-4, F1DN104MOD-XX-4 and F1DN204MOD-
XX-4 models
 DisplayPort is supported on the F1DN102MOD-PP-4,
F1DN202MOD-PP-4, F1DN104MOD-PP-4, F1DN108MOD-PP-
4, F1DN204MOD-PP-4, F1DN208MOD-PP-4, F1DN104MOD-
XX-4 and F1DN204MOD-XX-4 models
 DVI-D is supported on the F1DN102MOD-DD-4,
F1DN202MOD-DD-4, F1DN104MOD-DD-4, F1DN204MOD-
DD-4 and F1DN204MOD-XX-4 models
 VGA is supported on the F1DN104MOD-XX-4 model
 USB Type C with DisplayPort as an alternate function is
supported on the F1DN104MOD-XX-4 and F1DN204MOD-XX-
4 models
• Various video peripheral types are supported:
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 4 of 81
 DisplayPort peripherals are supported on the F1DN202MOD-
PP-4, F1DN104MOD-PP-4, F1DN108MOD-PP-4,
F1DN204MOD-PP-4, F1DN208MOD-PP-4, F1DN104MOD-XX-4
and F1DN204MOD-XX-4 models
 HDMI peripherals are supported on the F1DN102MOD-BA-4,
F1DN202MOD-BA-4, F1DN104MOD-BA-4, F1DN204MOD-BA-
4, F1DN108MOD-BA-4, F1DN208MOD-BA-4, F1DN102MOD-
HH-4, F1DN202MOD-HH-4, F1DN104MOD-HH-4,
F1DN204MOD-HH-4, F1DN104MOD-XX-4 and F1DN204MOD-
XX-4 models
 DVI-D peripherals are supported on the F1DN102MOD-DD-4,
F1DN202MOD-DD-4, and F1DN104MOD-DD-4 models
• Keyboard and Mouse Security
• The keyboard and mouse are isolated by dedicated, USB device
emulation for each computer
• One-way, peripheral-to-computer data flow is enforced through
unidirectional optical data diodes
• Communication from computer-to-keyboard/mouse is blocked
• Non HID (Human Interface Device) data transactions are blocked
• Hardware Anti-Tampering
• Special holographic tampering evident labels on the product’s
enclosure provide a clear visual indication if the product has been
opened or compromised
Belkin secure peripheral sharing devices use multiple isolated microcontrollers
(one microcontroller per connected computer) to emulate connected peripherals
in order to prevent display signaling, keyboard signaling, and power signaling
attacks.
Figure 1 is a simplified block diagram showing the TOE keyboard and mouse
data path for two ports. A Host Emulator (HE) communicates with the user
keyboard via the USB protocol. The Host Emulator converts user key strokes
into unidirectional serial data. That unidirectional serial data is passed through
the switch that is used to select between Computer A and Computer B. Isolated
Device Emulators (DE) are connected to the data switch on one side and to the
respective computers on the other side. Each key stroke is converted by the
selected DE into a bi-directional stream to communicate with the computer.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 5 of 81
Figure 1 – Simplified Switching Diagram
The TOE is a combined software and hardware TOE. A mapping showing the
applicable Security Functional Requirements (SFRs) for each device is included
in Annex B.
TOE Environment
The following components are required for operation of the TOE in the evaluated
configuration.
Component Description
Connected Computers 2-8 General purpose computers
Mouse General purpose USB mouse
User display Standard computer display (HDMI 2.0, DVI-D, or
DisplayPort 1.1, 1.2 or 1.3)
Belkin KVM Cables USB Type-A to USB Type-B (mouse)
Video cable (DisplayPort, DVI-D, VGA, USB-C and HDMI)
Table 1 – Non-TOE Hardware and Software
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 6 of 81
1.5 TOE DESCRIPTION
Evaluated Configuration
Figure 2 – KVM Switch Evaluated Configuration
Figure 2 shows a basic evaluated configuration. The TOE is connected to two or
four computers. The base units support HDMI switching. The devices support
HDMI, DisplayPort, USB-C or VGA video input. The video format is converted
using proprietary cables purchased with the base unit. One or two displays are
supported, and may be DisplayPort, HDMI or DVI-D. The TOE devices are used
with the Belkin 2-4-8 Port Secure USB Keyboard w/Lighting remote control.
Belkin Peripheral Sharing Devices with Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 7 of 81
Physical Scope
The TOE consists of the devices shown in Table 2 and Table 3.
Family
Family
Description
Part
Number
Model
Tamper
Evident
labels
Video in
Video
out
Number
of
supported
displays
KM
Modular
Secure
KVM
Series
KVMs
Secure KVM devices CGA18717 F1DN102MOD-BA-4 Yes Note 1 Note 1 1 Yes
CGA18715 F1DN104MOD-BA-4 Yes Note 1 Note 1 1 Yes
CGA18718 F1DN202MOD-BA-4 Yes Note 1 Note 1 2 Yes
CGA18247 F1DN204MOD-BA-4 Yes Note 1 Note 1 2 Yes
CGA22661 F1DN108MOD-BA-4 Yes Note 1 Note 1 1 Yes
CGA22662 F1DN208MOD-BA-4 Yes Note 1 Note 1 2 Yes
CGA19157 F1DN102MOD-HH-4 Yes HDMI HDMI 1 Yes
CGA19159 F1DN102MOD-PP-4 Yes DisplayPort DisplayPort 1 Yes
CGA19161 F1DN102MOD-DD-4 Yes DVI-D DVI-D 1 Yes
CGA19162 F1DN202MOD-HH-4 Yes HDMI HDMI 2 Yes
CGA19164 F1DN202MOD-PP-4 Yes DisplayPort DisplayPort 2 Yes
CGA19167 F1DN202MOD-DD-4 Yes DVI-D DVI-D 2 Yes
CGA19169 F1DN104MOD-HH-4 Yes HDMI HDMI 1 Yes
CGA19170 F1DN104MOD-PP-4 Yes DisplayPort DisplayPort 1 Yes
CGA22318 F1DN108MOD-PP-4 Yes DisplayPort DisplayPort 1 Yes
CGA19173 F1DN104MOD-DD-4 Yes DVI-D DVI-D 1 Yes
CGA19174 F1DN204MOD-HH-4 Yes HDMI HDMI 2 Yes
CGA19177 F1DN204MOD-PP-4 Yes DisplayPort DisplayPort 2 Yes
CGA22319 F1DN208MOD-PP-4 Yes DisplayPort DisplayPort 2 Yes
CGA19179 F1DN204MOD-DD-4 Yes DVI-D DVI-D 2 Yes
CGA19186 F1DN104MOD-XX-4 Yes VGA, USB-C, DisplayPort, HDMI HDMI 1 Yes
CGA19187 F1DN204MOD-XX-4 Yes DVI-D, USB-C, DisplayPort, HDMI HDMI 1 Yes
Table 2 – TOE Peripheral Sharing Devices and Features
Note 1: This is a Modular Secure KVM Series base model. Video in and video out support depends upon the cables selected for use with the device.
Internal switching is performed using HDMI.
Belkin Peripheral Sharing Devices with Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 8 of 81
Description Part Number Model
Belkin 2-4-8 Port Secure USB Keyboard W/Lighting CGA201664 F1DN008KBD
Table 3 – Remote Control Devices
Table 4 shows the Modular Secure KVM Series models included in the evaluation. The HDMI (HH), DisplayPort (PP) and DVI-D (DD) models are made up of
the Base Unit (BA) and the cables required to support the video protocol.
Part Number Model Base Unit Host Cable Console Cable
CGA19157 F1DN102MOD-HH-4 F1DN102MOD-BA-4 F1DN1MOD-HC-H06 F1DN1MOD-CC-H06
CGA19159 F1DN102MOD-PP-4 F1DN102MOD-BA-4 F1DN1MOD-HC-P06 F1DN1MOD-CC-P06
CGA19161 F1DN102MOD-DD-4 F1DN102MOD-BA-4 F1DN1MOD-HC-D06 F1DN1MOD-CC-D06
CGA19162 F1DN202MOD-HH-4 F1DN202MOD-BA-4 F1DN2MOD-HC-H06 F1DN2MOD-CC-H06
CGA19164 F1DN202MOD-PP-4 F1DN202MOD-BA-4 F1DN2MOD-HC-P06 F1DN2MOD-CC-P06
CGA19167 F1DN202MOD-DD-4 F1DN202MOD-BA-4 F1DN2MOD-HC-D06 F1DN2MOD-CC-D06
CGA19169 F1DN104MOD-HH-4 F1DN104MOD-BA-4 F1DN1MOD-HC-H06 F1DN1MOD-CC-H06
CGA19170 F1DN104MOD-PP-4 F1DN104MOD-BA-4 F1DN1MOD-HC-P06 F1DN1MOD-CC-P06
CGA22318 F1DN108MOD-PP-4 F1DN108MOD-BA-4 F1DN1MOD-HC-P06 F1DN1MOD-CC-P06
CGA19173 F1DN104MOD-DD-4 F1DN104MOD-BA-4 F1DN1MOD-HC-D06 F1DN1MOD-CC-D06
CGA19174 F1DN204MOD-HH-4 F1DN204MOD-BA-4 F1DN2MOD-HC-H06 F1DN2MOD-CC-H06
CGA19177 F1DN204MOD-PP-4 F1DN204MOD-BA-4 F1DN2MOD-HC-P06 F1DN2MOD-CC-P06
CGA22319 F1DN208MOD-PP-4 F1DN208MOD-BA-4 F1DN2MOD-HC-P06 F1DN2MOD-CC-P06
CGA19179 F1DN204MOD-DD-4 F1DN204MOD-BA-4 F1DN2MOD-HC-D06 F1DN2MOD-CC-D06
CGA19186 F1DN104MOD-XX-4 F1DN104MOD-BA-4
F1DN1MOD-HC-V06
F1DN1MOD-HC-U03
F1DN1MOD-HC-H06
F1DN1MOD-HC-P06
F1DN1MOD-CC-H06
CGA19187 F1DN204MOD-XX-4 F1DN204MOD-BA-4
F1DN2MOD-HC-V06
F1DN2MOD-HC-U03
F1DN2MOD-HC-H06
F1DN2MOD-HC-P06
F1DN2MOD-CC-H06
Table 4 – Modular Secure KVM Series Models and Cables
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 9 of 81
1.5.2.1 TOE Delivery
The TOE, together with its corresponding cables are delivered to the customer
via trusted carrier, such as Fed-Ex, that provide a tracking service for all
shipments.
1.5.2.2 TOE Guidance
The TOE includes the following guidance documentation:
• Quick Installation Guide 2/4/8 Port Single/Dual-Head Modular Secure KVM
Switches, 8820-02949 Rev.B00
o https://www.belkin.com/support/assets/belkin/qig/Quick%20Install
ation%20Guide%202_4_8%20Port%20Single_Dual-
Head%20Modular%20Secure%20KVM%20Switches%2C%208820-
02949%20Rev.B00.pdf
• Belkin Regulatory Information, 8820-02969 Rev. A00
o https://www.belkin.com/support/assets/belkin/others/Belkin%20Re
gulatory%20Information%2C%208820-02969%20Rev.%20A00.pdf
Guidance may be downloaded from the Belkin website (www.belkin.com) in .pdf
format from the indicated locations.
The following guidance is available upon request by emailing
support@highseclabs.com:
• Belkin F1DN102MOD-BA-4, F1DN202MOD-BA-4, F1DN104MOD-BA-4,
F1DN204MOD-BA-4, F1DN108MOD-BA-4, F1DN208MOD-BA-4,
F1DN102MOD-HH-4, F1DN102MOD-PP-4, F1DN102MOD-DD-4,
F1DN202MOD-HH-4, F1DN202MOD-PP-4, F1DN202MOD-DD-4,
F1DN104MOD-HH-4, F1DN104MOD-PP-4, F1DN108MOD-PP-4,
F1DN104MOD-DD-4, F1DN204MOD-HH-4, F1DN204MOD-PP-4,
F1DN208MOD-PP-4, F1DN204MOD-DD-4, F1DN104MOD-XX-4,
F1DN204MOD-XX-4 Firmware Version 44404-E7E7 Peripheral Sharing
Devices Common Criteria Guidance Supplement, Version 1.2
Logical Scope
The logical boundary of the TOE includes all interfaces and functions within the
physical boundary. The logical boundary of the TOE may be broken down by the
security function classes described in Section 6. Table 5 summarizes the logical
scope of the TOE.
Functional Classes Description
User Data Protection The TOE provides secure switching capabilities for
keyboard, video and mouse. The TOE ensures that only
authorized peripheral devices may be used.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 10 of 81
Functional Classes Description
Protection of the TSF1
The TOE ensures a secure state in the case of failure,
provides only restricted access, and performs self-testing.
The TOE provides passive detection of physical attack.
TOE Access The TOE provides a continuous indication of which
computer is currently selected.
Table 5 – Logical Scope of the TOE
2 CONFORMANCE CLAIMS
2.1 COMMON CRITERIA CONFORMANCE CLAIM
This Security Target claims to be conformant to Version 3.1 of Common Criteria
for Information Technology Security Evaluation according to:
• Common Criteria for Information Technology Security Evaluation, Part 1:
Introduction and General Model; CCMB-2017-04-001, Version 3.1,
Revision 5, April 2017
• Common Criteria for Information Technology Security Evaluation, Part 2:
Security Functional Components; CCMB-2017-04-002, Version 3.1,
Revision 5, April 2017
• Common Criteria for Information Technology Security Evaluation, Part 3:
Security Assurance Components CCMB-2017-04-003, Version 3.1,
Revision 5, April 2017
As follows:
• CC Part 2 extended
• CC Part 3 conformant
The Common Methodology for Information Technology Security Evaluation,
Version 3.1, Revision 5, April 2017 has been taken into account.
2.2 PROTECTION PROFILE CONFORMANCE
CLAIM
This ST claims exact conformance with the National Information Assurance
Partnership (NIAP) PP‐Configuration for Peripheral Sharing Device,
Keyboard/Mouse Devices, and Video/Display Devices [CFG_PSD‐KM‐VI_V1.0],
which references the Protection Profile for Peripheral Sharing Device Version 4.0
[PP_PSD_V4.0], and the modules listed in Section 2.4. The Technical Decisions
1
TOE Security Functionality
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 11 of 81
in Table 6 apply to the PP and the modules and have been accounted for in the
ST and in the evaluation.
Technical Decision PP or Module
TD0506 [MOD_VI_V1.0]
TD0507 [MOD_KM_V1.0]
TD0514 [MOD_VI_V1.0]
TD0518 [PP_PSD_V4.0]
TD0539 [MOD_VI_V1.0]
TD0583 [PP_PSD_V4.0]
TD0584 [MOD_VI_V1.0]
TD0586 [MOD_VI_V1.0]
TD0593 [MOD_KM_V1.0], [MOD_VI_V1.0]
Table 6 – Applicable Technical Decisions
2.3 PACKAGE CLAIM
This Security Target does not claim conformance with any package.
2.4 MODULE CLAIM
The following PP‐Modules are specified in a PP‐Configuration with this PP:
• PP‐Module for Keyboard/Mouse Devices, Version 1.0
• PP‐Module for Video/Display Devices, Version 1.0
2.5 CONFORMANCE RATIONALE
The TOE modular Keyboard, Video, Mouse (KVM) switches are inherently
consistent with the Compliant Targets of Evaluation described in the
[PP_PSD_V4.0] and in the PP modules listed in Section 2.4, and with the PP‐
Configuration for Peripheral Sharing Device, Keyboard/Mouse Devices, and
Video/Display Devices [CFG_PSD‐KM‐VI_V1.0].
The security problem definition, statement of security objectives and statement
of security requirements in this ST conform exactly to the security problem
definition, statement of security objectives and statement of security
requirements contained in [PP_PSD_V4.0] and the modules listed in Section 2.4.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 12 of 81
3 SECURITY PROBLEM DEFINITION
3.1 THREATS
Table 7 lists the threats described in Section 3.1 of the [PP_PSD_V4.0].
Mitigation to the threats is through the objectives identified in Section 4.1,
Security Objectives for the TOE.
Threat Description
T.DATA_LEAK A connection via the PSD between one or more
computers may allow unauthorized data flow through
the PSD or its connected peripherals.
T.SIGNAL_LEAK A connection via the PSD between one or more
computers may allow unauthorized data flow through
bit‐by‐bit signaling.
T.RESIDUAL_LEAK A PSD may leak (partial, residual, or echo) user data
between the intended connected computer and another
unintended connected computer.
T.UNINTENDED_USE A PSD may connect the user to a computer other than
the one to which the user intended to connect.
T.UNAUTHORIZED_DEVICES The use of an unauthorized peripheral device with a
specific PSD peripheral port may allow unauthorized
data flows between connected devices or enable an
attack on the PSD or its connected computers.
T.LOGICAL_TAMPER An attached device (computer or peripheral) with
malware, or otherwise under the control of a
malicious user, could modify or overwrite code or
data stored in the PSD’s volatile or non‐volatile
memory to allow unauthorized information flows.
T.PHYSICAL_TAMPER A malicious user or human agent could physically
modify the PSD to allow unauthorized information
flows.
T.REPLACEMENT A malicious human agent could replace the PSD
during shipping, storage, or use with an alternate
device that does not enforce the PSD security
policies.
T.FAILED Detectable failure of a PSD may cause an
unauthorized information flow or weakening of PSD
security functions.
Table 7 – Threats
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 13 of 81
3.2 ORGANIZATIONAL SECURITY POLICIES
There are no Organizational Security Policies applicable to this TOE.
3.3 ASSUMPTIONS
The assumptions required to ensure the security of the TOE are listed in Table 8.
Assumptions Description
A.NO_TEMPEST Computers and peripheral devices connected to the
PSD are not TEMPEST approved.
The TSF may or may not isolate the ground of the
keyboard and mouse computer interfaces (the USB
ground). The Operational Environment is assumed not
to support TEMPEST red‐black ground isolation.
A.PHYSICAL The environment provides physical security
commensurate with the value of the TOE and the data
it processes and contains.
A.NO_WIRELESS_DEVICES The environment includes no wireless peripheral
devices.
A.TRUSTED_ADMIN PSD Administrators and users are trusted to follow and
apply all guidance in a trusted manner.
A.TRUSTED_CONFIG Personnel configuring the PSD and its operational
environment follow the applicable security
configuration guidance.
A.USER_ALLOWED_ACCESS All PSD users are allowed to interact with all
connected computers. It is not the role of the PSD to
prevent or otherwise control user access to connected
computers. Computers or their connected network
shall have the required means to authenticate the user
and to control access to their various resources.
A.NO_SPECIAL_ANALOG
_CAPABILITIES
The computers connected to the TOE are not equipped
with special analog data collection cards or peripherals
such as analog to digital interface, high performance
audio interface, digital signal processing function, or
analog video capture function.
Table 8 – Assumptions
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 14 of 81
4 SECURITY OBJECTIVES
The purpose of the security objectives is to address the security concerns and to
show which security concerns are addressed by the TOE, and which are
addressed by the environment. Threats may be addressed by the TOE or the
security environment or both. Therefore, the CC identifies two categories of
security objectives:
• Security objectives for the TOE
• Security objectives for the environment
4.1 SECURITY OBJECTIVES FOR THE TOE
This section identifies and describes the security objectives that are to be
addressed by the TOE, and traces each Security Functional Requirement (SFR)
back to a security objective of the TOE.
Security Objective Description
O.COMPUTER
_INTERFACE
_ISOLATION
The PSD shall prevent unauthorized data flow to ensure that
the PSD and its connected peripheral devices cannot be
exploited in an attempt to leak data. The TOE‐Computer
interface shall be isolated from all other PSD‐Computer
interfaces while TOE is powered.
Addressed by:
MOD_VI FDP_APC_EXT.1/VI, FDP_PDC_EXT.1
MOD_KM FDP_APC_EXT.1/KM, FDP_FIL_EXT.1/KM,
FDP_PDC_EXT.1, FDP_RDR_EXT.1,
FDP_SWI_EXT.3
O.COMPUTER
_INTERFACE
_ISOLATION
_TOE_UNPOWERED
The PSD shall not allow data to transit a PSD‐Computer
interface while the PSD is unpowered.
Addressed by:
MOD_VI FDP_APC_EXT.1/VI, FDP_PDC_EXT.1
MOD_KM FDP_APC_EXT.1/KM, FDP_FIL_EXT.1/KM,
FDP_PDC_EXT.1, FDP_RDR_EXT.1,
FDP_SWI_EXT.3
O.USER_DATA
_ISOLATION
The PSD shall route user data, such as keyboard entries, only
to the computer selected by the user. The PSD shall provide
isolation between the data flowing from the peripheral device
to the selected computer and any non‐selected computer.
Addressed by:
MOD_VI FDP_APC_EXT.1/VI, FDP_PDC_EXT.1
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 15 of 81
Security Objective Description
MOD_KM FDP_APC_EXT.1/KM, FDP_FIL_EXT.1/KM,
FDP_PDC_EXT.1, FDP_RDR_EXT.1,
FDP_SWI_EXT.3
O.NO_USER
_DATA_RETENTION
The PSD shall not retain user data in non‐volatile memory
after power up or, if supported, factory reset.
Addressed by:
PP_PSD FDP_RIP_EXT.1
MOD_KM FDP_RIP.1/KM
O.NO_OTHER
_EXTERNAL
_INTERFACES
The PSD shall not have any external interfaces other than
those implemented by the TSF.
Addressed by:
PP_PSD FDP_PDC_EXT.1
O.LEAK
_PREVENTION
_SWITCHING
The PSD shall ensure that there are no switching mechanisms
that allow signal data leakage between connected computers.
Addressed by:
PP_PSD FDP_SWI_EXT.1, FDP_SWI_EXT.2
O.AUTHORIZED
_USAGE
The TOE shall explicitly prohibit or ignore unauthorized
switching mechanisms, either because it supports only one
connected computer or because it allows only authorized
mechanisms to switch between connected computers.
Authorized switching mechanisms shall require express user
action restricted to console buttons, console switches, console
touch screen, wired remote control, and peripheral devices
using a guard. Unauthorized switching mechanisms include
keyboard shortcuts, also known as “hotkeys,” automatic port
scanning, control through a connected computer, and control
through keyboard shortcuts. Where applicable, the results of
the switching activity shall be indicated by the TSF so that it
is clear to the user that the switching mechanism was
engaged as intended.
A conformant TOE may also provide a management function
to configure some aspects of the TSF. If the TOE provides this
functionality, it shall ensure that whatever management
functions it provides can only be performed by authorized
administrators and that an audit trail of management
activities is generated.
Addressed by:
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 16 of 81
Security Objective Description
PP_PSD FDP_SWI_EXT.1, FDP_SWI_EXT.2,
FTA_CIN_EXT.1
MOD_VI FDP_CDS_EXT.1(1), FDP_CDS_EXT.1(2),
FTA_CIN_EXT.1
MOD_KM FDP_FIL_EXT.1/KM
O.PERIPHERAL
_PORTS_ISOLATION
The PSD shall ensure that data does not flow between
peripheral devices connected to different PSD interfaces.
Addressed by:
MOD_VI FDP_APC_EXT.1/VI, FDP_PDC_EXT.1
MOD_KM FDP_APC_EXT.1/KM, FDP_FIL_EXT.1/KM,
FDP_PDC_EXT.1, FDP_RDR_EXT.1,
FDP_SWI_EXT.3
O.REJECT
_UNAUTHORIZED
_PERIPHERAL
The PSD shall reject unauthorized peripheral device types and
protocols.
Addressed by:
PP_PSD FDP_PDC_EXT.1
MOD_VI FDP_PDC_EXT.2/VI, FDP_PDC_EXT.3/VI,
FDP_IPC_EXT.1, FDP_SPR_EXT.1/DP,
SPR_EXT.1/DVI-D, FDP_SPR_EXT.1/HDMI,
FDP_SPR_EXT.1/USB, FDP_SPR_EXT.1/VGA
MOD_KM FDP_APC_EXT.1/KM, FDP_FIL_EXT.1/KM,
FDP_PDC_EXT.1, FDP_RDR_EXT.1,
FDP_SWI_EXT.3, FDP_PDC_EXT.2/KM,
FDP_PDC_EXT.3/KM
O.REJECT
_UNAUTHORIZED
_ENDPOINTS
The PSD shall reject unauthorized peripheral devices
connected via a Universal Serial Bus (USB) hub.
Addressed by:
PP_PSD FDP_PDC_EXT.1
MOD_KM FDP_APC_EXT.1/KM, FDP_FIL_EXT.1/KM,
FDP_PDC_EXT.1, FDP_RDR_EXT.1,
FDP_SWI_EXT.3
O.NO_TOE_ACCESS The PSD firmware, software, and memory shall not be
accessible via its external ports.
Addressed by:
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 17 of 81
Security Objective Description
PP_PSD FPT_NTA_EXT.1
O.TAMPER
_EVIDENT
_LABEL
The PSD shall be identifiable as authentic by the user and the
user must be made aware of any procedures or other such
information to accomplish authentication. This feature must
be available upon receipt of the PSD and continue to be
available during the PSD deployment. The PSD shall be
labeled with at least one visible unique identifying tamper‐
evident marking that can be used to authenticate the device.
The PSD manufacturer must maintain a complete list of
manufactured PSD articles and their respective identification
markings’ unique identifiers.
Addressed by:
PP_PSD FPT_PHP.1
O.ANTI_TAMPERING The PSD shall be physically enclosed so that any attempts to
open or otherwise access the internals or modify the
connections of the PSD would be evident, and optionally
thwarted through disablement of the TOE. Note: This applies
to a wired remote control as well as the main chassis of the
PSD.
Addressed by:
PP_PSD FPT_PHP.1
O.SELF_TEST The PSD shall perform self‐tests following power up or
powered reset.
Addressed by:
PP_PSD FPT_TST.1
O.SELF_TEST
_FAIL_TOE
_DISABLE
The PSD shall enter a secure state upon detection of a critical
failure.
Addressed by:
PP_PSD FPT_FLS_EXT.1, FPT_TST_EXT.1
O.SELF_TEST
_FAIL_INDICATION
The PSD shall provide clear and visible user indications in the
case of a self‐test failure.
Addressed by:
PP_PSD FPT_TST_EXT.1
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 18 of 81
Security Objective Description
O.PROTECTED
_EDID
The TOE shall read the connected display Extended Display
Identification Data (EDID) once during the TOE power up or
reboot sequence and prevent any EDID channel write
transactions that connected computers initiate.
Addressed by:
MOD_VI FDP_PDC_EXT.2/VI, FDP_SPR_EXT.1/DP,
FDP_SPR_EXT.1/DVI-D, FDP_SPR_EXT.1/HDMI,
FDP_SPR_EXT.1/USB, FDP_SPR_EXT.1/VGA
O.UNIDIRECTIONAL
_VIDEO
The TOE shall enforce unidirectional video data flow from the
connected computer video interface to the display interface
only.
Addressed by:
MOD_VI FDP_UDF_EXT.1/VI
O.EMULATED_INPUT The TOE shall emulate the keyboard and/or mouse functions
from the TOE to the connected computer.
Addressed by:
MOD_KM FDP_PDC_EXT.2/KM, FDP_PDC_EXT.3/KM
O.UNIDIRECTIONAL
_INPUT
The TOE shall enforce unidirectional keyboard and/or mouse
device’s data flow from the peripheral device to only the
selected computer.
Addressed by:
MOD_KM FDP_UDF_EXT.1/KM
Table 9 – Security Objectives for the TOE
4.2 SECURITY OBJECTIVES FOR THE
OPERATIONAL ENVIRONMENT
This section identifies and describes the security objectives that are to be
addressed by the IT environment or by non-technical or procedural means.
Security Objective Description
OE.NO_TEMPEST The operational environment will not use TEMPEST
approved equipment.
OE.PHYSICAL The operational environment will provide physical
security, commensurate with the value of the PSD
and the data that transits it.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 19 of 81
OE.NO_WIRELESS_DEVICES The operational environment will not include
wireless keyboards, mice, audio, user
authentication, or video devices.
OE.TRUSTED_ADMIN The operational environment will ensure that trusted
PSD Administrators and users are appropriately
trained.
OE.TRUSTED_CONFIG The operational environment will ensure that
administrators configuring the PSD and its
operational environment follow the applicable
security configuration guidance.
OE.NO_SPECIAL_ANALOG
_CAPABILITIES
The operational environment will not have special
analog data collection cards or peripherals such as
analog to digital interface, high performance audio
interface, or a component with digital signal
processing or analog video capture functions.
Table 10 – Security Objectives for the Operational Environment
4.3 SECURITY OBJECTIVES RATIONALE
The security objectives rationale describes how the assumptions and threats
map to the security objectives.
Threat or
Assumption
Security
Objective(s)
Rationale
T.DATA_LEAK O.COMPUTER
_INTERFACE
_ISOLATION
Isolation of computer interfaces
prevents data from leaking between
them without authorization.
O.COMPUTER
_INTERFACE
_ISOLATION
_TOE_UNPOWERED
Maintaining interface isolation while
the TOE is in an unpowered state
ensures that data cannot leak
between computer interfaces.
O.USER_DATA
_ISOLATION
The TOE’s routing of data only to the
selected computer ensures that it will
not leak to any others.
O.NO_OTHER
_EXTERNAL
_INTERFACES
The absence of additional external
interfaces ensures that there is no
unexpected method by which data
can be leaked.
O.UNIDIRECTIONAL
_INPUT
The TOE’s enforcement of
unidirectional input for
keyboard/mouse data prevents
leakage of computer data through a
connected peripheral interface.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 20 of 81
Threat or
Assumption
Security
Objective(s)
Rationale
O.PERIPHERAL_PORTS
_ISOLATION
Isolation of peripheral ports prevents
data from leaking between them
without authorization.
O.PROTECTED_EDID The TOE’s protection of the EDID
interface prevents its use as a vector
for unauthorized data leakage via this
channel.
O.UNIDIRECTIONAL
_VIDEO
The TOE’s enforcement of
unidirectional output for video data
protects against data leakage via
connected computers by ensuring
that no video data can be input to a
connected computer through this
interface.
T.SIGNAL_LEAK O.COMPUTER
_INTERFACE
_ISOLATION
Isolation of computer interfaces
prevents data leakage through bit‐
wise signaling because there is no
mechanism by which the signal data
can be communicated.
O.NO_OTHER
_EXTERNAL
_INTERFACES
The absence of additional external
interfaces ensures that there is no
unexpected method by which data
can be leaked through bitwise
signaling.
O.LEAK_PREVENTION
_SWITCHING
The TOE’s use of switching methods
that are not susceptible to signal
leakage helps mitigate the signal leak
threat.
O.UNIDIRECTIONAL
_INPUT
The TOE’s enforcement of
unidirectional input for
keyboard/mouse data prevents
leakage of computer data through bit‐
by‐bit signaling to a connected
peripheral interface.
O.PROTECTED_EDID The TOE’s protection of the EDID
interface prevents its use as a vector
for bit‐by‐bit signal leakage via this
channel.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 21 of 81
Threat or
Assumption
Security
Objective(s)
Rationale
O.UNIDIRECTIONAL
_VIDEO
The TOE’s enforcement of
unidirectional output for video data
protects against signaling leakage via
connected computers by ensuring
that no video data can be input to a
connected computer through this
interface.
T.RESIDUAL
_LEAK
O.NO_USER_DATA
_RETENTION
The TOE’s lack of data retention
ensures that a residual data leak is
not possible.
O.PROTECTED_EDID The TOE’s protection of the EDID
interface prevents the leakage of
residual data by ensuring that no
such data can be written to EDID
memory.
T.UNINTENDED
_USE
O.AUTHORIZED
_USAGE
The TOE’s support for only switching
mechanisms that require explicit user
action
to engage ensures that a user has
sufficient information to avoid
interacting with an unintended
computer.
T.UNAUTHORIZED
_DEVICES
O.REJECT
_UNAUTHORIZED
_ENDPOINTS
The TOE’s ability to reject
unauthorized endpoints mitigates the
threat of unauthorized devices being
used to communicate with connected
computers.
O.REJECT
_UNAUTHORIZED
_PERIPHERAL
The TOE’s ability to reject
unauthorized peripherals mitigates
the threat of unauthorized devices
being used to communicate with
connected computers.
O.EMULATED_INPUT The TOE’s emulation of
keyboard/mouse data input ensures
that a connected computer will only
receive this specific type of data
through a connected peripheral.
O.UNIDIRECTIONAL
_VIDEO
The TOE’s limitation of supported
video protocol interfaces prevents the
connection of unauthorized devices.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 22 of 81
Threat or
Assumption
Security
Objective(s)
Rationale
T.LOGICAL
_TAMPER
O.NO_TOE_ACCESS The TOE’s prevention of logical
access to its firmware, software, and
memory mitigates the threat of
logical tampering.
O.EMULATED_INPUT The TOE’s emulation of
keyboard/mouse data input prevents
logical tampering of the TSF ensuring
that only known inputs to it are
supported.
T.PHYSICAL
_TAMPER
O.ANTI_TAMPERING The TOE mitigates the threat of
physical tampering through use of an
enclosure that provides tamper
detection functionality.
O.TAMPER_EVIDENT
_LABEL
The TOE mitigates the threat of
physical tampering through use of
tamper evident labels that reveal
physical tampering attempts.
T.REPLACEMENT O.TAMPER_EVIDENT
_LABEL
The TOE’s use of a tamper evident
label that provides authenticity of the
device mitigates the threat that it is
substituted for a replacement device
during the acquisition process.
T.FAILED O.SELF_TEST The TOE mitigates the threat of
failures leading to compromise of
security functions through self‐tests
of its own functionality.
O.SELF_TEST_FAIL
_TOE_DISABLE
The TOE mitigates the threat of
failures leading to compromise of
security functions by disabling all
data flows in the event a failure is
detected.
O.SELF_TEST_FAIL
_INDICATION
The TOE mitigates the threat of
failures leading to compromise of
security functions by providing users
with a clear indication when it is in a
failure state and should not be
trusted.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 23 of 81
Threat or
Assumption
Security
Objective(s)
Rationale
A.NO_TEMPEST OE.NO_TEMPEST If the TOE’s operational environment
does not include TEMPEST approved
equipment, then the assumption is
satisfied.
A.NO_PHYSICAL OE.PHYSICAL If the TOE’s operational environment
provides physical security, then the
assumption is satisfied.
A.NO_WIRELESS
_DEVICES
OE.NO_WIRELESS
_DEVICES
If the TOE’s operational environment
does not include wireless peripherals,
then the assumption is satisfied.
A.TRUSTED_ADMIN OE.TRUSTED
_ADMIN
If the TOE’s operational environment
ensures that only trusted
administrators will manage the TSF,
then the assumption is satisfied.
A.TRUSTED
_CONFIG
OE.TRUSTED
_CONFIG
If TOE administrators follow the
provided security configuration
guidance, then the assumption is
satisfied.
A.USER_ALLOWED
_ACCESS
OE.PHYSICAL If the TOE’s operational environment
provides physical access to connected
computers, then the assumption is
satisfied.
A.NO_SPECIAL
_ANALOG
_CAPABILITIES
OE.NO_SPECIAL
_ANALOG
_CAPABILITIES
If administrators in the TOE’s
operational environment take care to
ensure that computers with special
analog data collection interfaces are
not connected to the TOE, then the
assumption that such components
are not present is satisfied.
Table 11 – Security Objectives Rationale
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 24 of 81
5 EXTENDED COMPONENTS DEFINITION
The extended components definition is presented in Appendix C of the Protection
Profile for Peripheral Sharing Device [PP_PSD_V4.0] and in the modules for
keyboard/mouse devices [MOD_KM_V1.0], and display devices [MOD_VI_1.0].
It is repeated here to ensure the completeness of this ST.
The families to which these components belong are identified in the following
table:
Functional Class Functional Families
User Data Protection (FDP) FDP_APC_EXT Active PSD Connections
FDP_CDS_EXT Connected Displays Supported
FDP_FIL_EXT Device Filtering
FDP_IPC_EXT Internal Protocol Conversion
FDP_PDC_EXT Peripheral Device Connection
FDP_RDR_EXT Re-Enumeration Device Rejection
FDP_RIP_EXT Residual Information Protection
FDP_SPR_EXT Sub-Protocol Rules
FDP_SWI_EXT PSD Switching
FDP_UDF_EXT Unidirectional Data Flow
Protection of the TSF (FPT) FPT_FLS_EXT Failure with Preservation of Secure State
FPT_NTA_EXT No Access to TOE
FPT_TST_EXT TSF Testing
TOE Access (FTA) FTA_CIN_EXT Continuous Indications
Table 12 – Functional Families of Extended Components
5.1 CLASS FDP: USER DATA PROTECTION
FDP_APC_EXT Active PSD Connections
Family Behavior
Components in this family define the requirements for when an external
interface to the TOE is authorized to transmit data related to peripheral sharing.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 25 of 81
Component Leveling
FDP_APC_EXT.1 Active PSD Connections, restricts the flow of data through the
TSF.
Management: FDP_APC_EXT.1
No specific management functions are identified.
Audit: FDP_APC_EXT.1
There are no auditable events foreseen.
FDP_APC_EXT.1 Active PSD Connections
Hierarchical to: No other components.
Dependencies: No dependencies
FDP_APS_EXT.1.1 The TSF shall route user data only to or from the interfaces selected
by the user.
FDP_APS_EXT.1.2 The TSF shall ensure that no data flows between connected
computers whether the TOE is powered on or powered off.
FDP_APS_EXT.1.3 The TSF shall ensure that no data transits the TOE when the TOE is
powered off.
FDP_APS_EXT.1.4 The TSF shall ensure that no data transits the TOE when the TOE is
in a failure state.
FDP_CDS_EXT Connected Displays Supported
Family Behavior
Components in this family define requirements for the number of display
interfaces contained within the TOE.
Component Leveling
FDP_CDS_EXT.1, Connected Displays Supported, requires the TSF to define
whether it supports one connected display at a time or multiple connected
displays simultaneously.
FDP_APC_EXT Active PSD
Connections
1
FDP_CDS_EXT Connected
Displays Supported
1
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 26 of 81
Management: FDP_CDS_EXT.1
There are no specific management functions identified.
Audit: FDP_CDS_EXT.1
There are no auditable events foreseen.
FDP_CDS_EXT.1 Connected Displays Supported
Hierarchical to: No other components
Dependencies: No other components
FDP_CDS_EXT.1.1 The TSF shall support [selection: one connected display, multiple
connected displays] at a time.
FDP_FIL_EXT Device Filtering
Family Behavior
Components in this family define the requirements for device filtering.
Component Leveling
FDP_FIL_EXT.1 Device Filtering, requires the TSF to specify the method of
device filtering used for peripheral interfaces and defines requirements for
handling whitelists and blacklists.
Management: FDP_FIL_EXT.1
The following actions could be considered for the management functions in FMT:
• Ability to configure whitelist/blacklist members
Audit: FDP_FIL_EXT.1
The following actions should be auditable if FAU_GEN.1 Audit Data Generation is
included in the PP/ST:
• Configuration of whitelist/blacklist members
FDP_FIL_EXT.1 Device Filtering
Hierarchical to: No other components
Dependencies: FDP_PDC_EXT.1 Peripheral Device Connection
FDP_FIL_EXT.1.1 The TSF shall have [selection: configurable, fixed] device filtering for
[assignment: list of supported peripheral interface types] interfaces.
FDP_FIL_EXT.1.2 The TSF shall consider all [assignment: blacklist name] blacklisted
devices as unauthorized devices for [assignment: list of supported
peripheral interface types] interfaces in peripheral device
connections.
FDP_FIL_EXT Device
Filtering
1
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 27 of 81
FDP_FIL_EXT.1.3 The TSF shall consider all [assignment: whitelist name] whitelisted
devices as authorized devices for peripheral device connections only
if they are not on the [assignment: blacklist name] blacklist or
otherwise unauthorized.
FDP_IPC_EXT Internal Protocol Conversion
Family Behavior
Components in this family define requirements for the TOE’s ability to convert
one protocol into another for internal processing.
Component Leveling
FDP_IPC_EXT.1, Internal Protocol Conversion, requires the TSF to specify an
input protocol that the TOE receives, the protocol that the TSF converts it to,
and whether the data is output from the TOE as the original protocol or as the
converted one.
Management: FDP_IPC_EXT.1
There are no specific management functions identified.
Audit: FDP_IPC_EXT.1
There are no auditable events foreseen.
FDP_IPC_EXT.1 Internal Protocol Conversion
Hierarchical to: No other components
Dependencies: FDP_PDC_EXT.2 Authorized Connection Protocols
FDP_IPC_EXT.1.1 The TSF shall convert the [assignment: original protocol] protocol at
the [assignment: TOE external interface(s)] into the [assignment:
converted protocol] protocol within the TOE.
FDP_IPC_EXT.1.2 The TSF shall output the [assignment: converted protocol] protocol
from inside the TOE to [assignment: TOE external interface(s)] as
[selection: [assignment: original protocol] protocol], [assignment:
converted protocol] protocol].
FDP_PDC_EXT Peripheral Device Connection
Family Behavior
Components in this family define the requirements for peripheral device
connections.
This family is defined in the PSD PP. The PP‐Modules [MOD_KM_V1.0],
[MOD_VI_V1.0] augment the extended family by adding two additional
components, FDP_PDC_EXT.2 and FDP_PDC_EXT.3. The new components and
FDP_IPC_EXT Internal
Protocol Conversion
1
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 28 of 81
their impact on the extended family’s component leveling are shown below;
reference the PSD PP for all other definitions for this family.
Component Leveling
FDP_PDC_EXT.1 Peripheral Device Connection, requires the TSF to limit external
connections to only authorized devices.
FDP_PDC_EXT.2 Authorized Devices, defines the types of physical devices that
the TSF will permit to connect to it.
FDP_PDC_EXT.3, Authorized Connection Protocols, defines the protocols that the
TSF will authorize over its physical/logical interfaces, as well as any rules that
are applicable to these interfaces.
Management: FDP_PDC_EXT.1, FDP_PDC_EXT.2, FDP_PDC_EXT.3
No specific management functions are identified.
Audit: FDP_PDC_EXT.1
The following actions should be auditable if FAU_GEN.1 Audit Data Generation is
included in the PP/ST:
• Acceptance or rejection of a peripheral
Audit: FDP_PDC_EXT.2, FDP_PDC_EXT.3
There are no specific auditable events foreseen.
FDP_PDC_EXT.1 Peripheral Device Connection
Hierarchical to: No other components.
Dependencies: No dependencies
FDP_PDC_EXT.1.1 The TSF shall reject connections with unauthorized devices upon
TOE power up and upon connection of a peripheral device to a
powered‐on TOE.
FDP_PDC_EXT.1.2 The TSF shall reject connections with devices presenting
unauthorized interface protocols upon TOE power up and upon
connection of a peripheral device to a powered‐on TOE.
FDP_PDC_EXT Peripheral
Device
1
2
3
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 29 of 81
FDP_PDC_EXT.1.3 The TOE shall have no external interfaces other than those claimed
by the TSF.
FDP_PDC_EXT.1.4 The TOE shall not have wireless interfaces.
FDP_PDC_EXT.1.5 The TOE shall provide a visual or auditory indication to the User
when a peripheral is rejected.
FDP_PDC_EXT.2 Authorized Devices
Hierarchical to: No other components.
Dependencies: FDP_PDC_EXT.1 Peripheral Device Connection
FDP_PDC_EXT.2.1 The TSF shall allow connections with authorized devices as defined
in [assignment: devices specified in the PP or PP‐Module in which
this SFR is defined] and [assignment: devices specified in another
PP or PP‐Module that shares a PP Configuration with the PP or PP‐
Module in which this SFR is defined] upon TOE power up and upon
connection of a peripheral device to a powered‐on TOE.
FDP_PDC_EXT.2.2 The TSF shall allow connections with authorized devices presenting
authorized interface protocols as defined in [assignment: devices
specified in the PP or PP Module in which this SFR is defined] and
[assignment: devices specified in another PP or PP‐Module that
shares a PP‐Configuration with the PP or PP‐Module in which this SFR
is defined] upon TOE power up and upon connection of a peripheral
device to a powered‐on TOE.
FDP_PDC_EXT.3 Authorized Connection Protocols
Hierarchical to: No other components.
Dependencies: FDP_PDC_EXT.1 Peripheral Device Connection
FDP_PDC_EXT.3.1 The TSF shall have interfaces for the [assignment: list of supported
protocols associated with physical and/or logical TSF interfaces]
protocols.
FDP_PDC_EXT.3.2 The TSF shall apply the following rules to the supported protocols:
[assignment: rules defining the handling for communications over
this protocol (e.g. any processing that must be done by the TSF
prior to transmitting it through the TOE, circumstances or frequency
with which the protocol is invoked)].
FDP_RDR_EXT Re-Enumeration Device
Rejection
Family Behavior
Components in this family define requirements to reject device spoofing
attempts through reenumeration.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 30 of 81
Component Leveling
FDP_RDR_EXT.1 Re‐Enumeration Device Rejection, requires the TSF to reject re‐
enumeration as an unauthorized device.
Management: FDP_RDR_EXT.1
No specific management functions are identified.
Audit: FDP_RDR_EXT.1
There are no specific auditable events foreseen.
FDP_RDR_EXT.1 Re-Enumeration Device Rejection
Hierarchical to: No other components.
Dependencies: FDP_PDC_EXT.1 Peripheral Device Connection
FDP_RDR_EXT.1.1 The TSF shall reject any device that attempts to enumerate again as
a different unauthorized device.
FDP_RIP_EXT Residual Information Protection
Family Behavior
Components in this family define the requirements for how the TSF prevents
data disclosure from its memory.
Component Leveling
FDP_RIP_EXT.1 Residual Information Protection, requires the TSF to prevent the
writing of user data to non‐volatile memory.
Management: FDP_RIP_EXT.1
The following actions could be considered for the management functions in FMT:
• Ability to trigger the TSF’s purge function
Audit: FDP_RIP_EXT.1
There are no auditable events foreseen.
FDP_RDR_EXT Re-
Enumeration Device
Rejection
1
FDP_RIP_EXT Residual
Information Protection
1
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 31 of 81
FDP_RIP_EXT.1 Residual Information Protection
Hierarchical to: No other components.
Dependencies: No dependencies
FDP_RIP_EXT.1.1 The TSF shall ensure that no user data is written to TOE non‐volatile
memory or storage.
FDP_SPR_EXT Sub-Protocol Rules
Family Behavior
Components in this family define the sub‐protocols that the TSF allows or blocks
depending on the protocols it supports.
Component Leveling
FDP_SPR_EXT.1 Sub‐Protocol Rules, requires the TSF to specify the allowed and
blocked sub‐protocols based on the protocol it supports.
Management: FDP_SPR_EXT.1
No specific management functions are identified.
Audit: FDP_SPR_EXT.1
There are no auditable events foreseen.
FDP_SPR_EXT.1 Sub-Protocol Rules
Hierarchical to: No other components.
Dependencies: FDP_PDC_EXT.3 Authorized Connection Protocols
FDP_SPR_EXT.1.1 The TSF shall apply the following rules for the [assignment:
supported protocol] protocol:
• block the following video/display sub‐protocols:
o [assignment: list of blocked sub‐protocols]
• allow the following video/display sub‐protocols:
o [assignment: list of allowed sub‐protocols].
FDP_SWI_EXT PSD Switching
Family Behavior
Components in this family define the requirements for how the TSF protects
against inadvertent data switching.
FDP_SPR_EXT Sub-
Protocol Rules
1
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 32 of 81
Component Leveling
FDP_SWI_EXT.1 PSD Switching, requires action on the part of a user in order for
the TSF’s switching mechanisms to be activated.
FDP_SWI_EXT.2 PSD Switching Methods, places restrictions on how the TSF’s
switching mechanisms can be controlled.
FDP_SWI_EXT.3 Tied Switching, requires the TSF to ensure that multiple
connected peripherals are always switched to the same connected computer.
Management: FDP_SWI_EXT.1, FDP_SWI_EXT.2, FDP_SWI_EXT.3
No specific management functions are identified.
Audit: FDP_SWI_EXT.1, FDP_SWI_EXT.2, FDP_SWI_EXT.3
There are no auditable events foreseen.
FDP_SWI_EXT.1 PSD Switching
Hierarchical to: No other components.
Dependencies: No dependencies
FDP_SWI_EXT.1.1 The TSF shall ensure that [selection: the TOE supports only one
connected computer, switching can be initiated only through express
user action].
FDP_SWI_EXT.2 PSD Switching Methods
Hierarchical to: No other components.
Dependencies: FDP_SWI_EXT.1 PSD Switching
FDP_SWI_EXT.2.1 The TSF shall ensure that no switching can be initiated through
automatic port scanning, control through a connected computer, or
control through keyboard shortcuts.
FDP_APS_EXT.2.2 The TSF shall ensure that switching can be initiated only through
express user action using [selection: console buttons, console
switches, console touch screen, wired remote control, peripheral
devices using a guard].
FDP_SWI_EXT PSD
Switching
1
2
3
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 33 of 81
FDP_SWI_EXT.3 Tied Switching
Hierarchical to: No other components.
Dependencies: FDP_SWI_EXT.1 PSD Switching
FDP_SWI_EXT.3.1 The TSF shall ensure that [assignment: two or more tied peripheral
devices] are always switched together to the same connected
computer.
FDP_UDF_EXT Unidirectional Data Flow
Family Behavior
Components in this family define unidirectional transmission of user data.
Component Leveling
FDP_UDF_EXT.1 Unidirectional Data Flow, requires the TSF to provide
unidirectional (one‐way) communications between a given pair of interface
types.
Management: FDP_UDF_EXT.1
No specific management functions are identified.
Audit: FDP_UDF_EXT.1
There are no auditable events foreseen.
FDP_UDF_EXT.1 Unidirectional Data Flow
Hierarchical to: No other components.
Dependencies: FDP_APC_EXT.1 Active PSD Connections
FDP_UDF_EXT.1.1 The TSF shall ensure [assignment: type of data] data transits the
TOE unidirectionally from the [assignment: origin point of data]
interface to the [assignment: destination point of data] interface.
5.2 CLASS FPT: PROTECTION OF THE TSF
FPT_FLS_EXT Failure with Preservation of
Secure State
Family Behavior
Components in this family define the secure failure requirements for the TSF.
FDP_UDF_EXT
Unidirectional Data Flow
1
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 34 of 81
Component Leveling
FPT_FLS_EXT.1 Failure with Preservation of Secure State, requires the TSF to go
into a secure state upon the detection of selected failures.
Management: FPT_FLS_EXT.1
No specific management functions are identified.
Audit: FPT_FLS_EXT.1
There are no auditable events foreseen.
FPT_FLS_EXT.1 Failure with Preservation of Secure State
Hierarchical to: No other components.
Dependencies: FPT_TST.1 TSF Testing
FPT_PHP.3 Resistance to Physical Attack
FPT_FLS_EXT.1.1 The TSF shall preserve a secure state when the following types of
failures occur: failure of the power‐on self‐test and [selection: failure
of the anti‐tamper function, no other failures].
FPT_NTA_EXT No Access to TOE
Family Behavior
Components in this family define what TSF information may be externally
accessible.
Component Leveling
FPT_NTA_EXT.1 No Access to TOE, requires the TSF to block access to non‐
authorized TSF data via external ports.
Management: FPT_NTA_EXT.1
No specific management functions are identified.
Audit: FPT_NTA_EXT.1
There are no auditable events foreseen.
FDP_FLS_EXT Failure with
Preservation of Secure
State
1
FPT_NTA_EXT No Access to
TOE
1
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 35 of 81
FPT_NTA_EXT.1 No Access to TOE
Hierarchical to: No other components.
Dependencies: No dependencies
FPT_NTA_EXT.1.1 TOE firmware, software, and memory shall not be accessible via the
TOE’s external ports, with the following exceptions: [selection: the
EDID memory of Video TOEs may be accessible from connected
computers; the configuration data, settings, and logging data that
may be accessible by authorized administrators; no other
exceptions].
FPT_TST_EXT TSF Testing
Family Behavior
Components in this family define how the TSF responds to a self‐test failure.
Component Leveling
FPT_TST_EXT.1 TSF Testing, requires the TSF to shutdown normal functions and
provide a visual or auditory indication that a self‐test has failed.
Management: FPT_TST_EXT.1
No specific management functions are identified.
Audit: FPT_TST_EXT.1
The following actions should be auditable if FAU_GEN.1 Audit Data Generation is
included in the PP/ST:
• Indication that the TSF self‐test was completed
• Failure of self‐test
FPT_TST_EXT.1 TSF Testing
Hierarchical to: No other components.
Dependencies: FPT_TST.1 TSF Testing
FPT_TST_EXT.1.1 The TSF shall respond to a self‐test failure by providing users with a
[selection: visual, auditory] indication of failure and by shutdown of
normal TSF functions.
5.3 CLASS FTA: TOE ACCESS
FTA_CIN_EXT Continuous Indications
Family Behavior
Components in this family define how the TSF displays its switching status.
FPT_TST_EXT TSF Testing 1
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 36 of 81
Component Leveling
FTA_CIN_EXT.1 Continuous Indications, requires the TSF to display a visual
indication of what computers are selected.
Management: FTA_CIN_EXT.1
No specific management functions are identified.
Audit: FTA_CIN_EXT.1
There are no auditable events foreseen.
FTA_CIN_EXT.1 Continuous Indications
Hierarchical to: No other components.
Dependencies: FDP_APC_EXT.1 Active PSD Connections
FTA_CIN_EXT.1.1 The TSF shall display a visible indication of the selected computers
at all times when the TOE is powered.
FTA_CIN_EXT.1.2 The TSF shall implement the visible indication using the following
mechanism: easily visible graphical and/or textual markings
of each source video on the display, [selection: a button, a
panel with lights, a screen with dimming function, a screen with no
dimming function, [assignment: description of visible indication]].
FTA_CIN_EXT.1.3 The TSF shall ensure that while the TOE is powered the current
switching status is reflected by [selection: the indicator, multiple
indicators which never display conflicting information].
FTA_CIN_EXT Continuous
Indications
1
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 37 of 81
6 SECURITY FUNCTIONAL
REQUIREMENTS
Section 6 provides security functional and assurance requirements that must be
satisfied by a compliant TOE.
6.1 CONVENTIONS AND APPLICABILITY
Conventions
The CC permits four types of operations to be performed on functional
requirements: selection, assignment, refinement, and iteration. These
operations are shown using the same conventions as those in the PSD PP. This is
defined in the PP as:
• Assignment: Indicated by surrounding brackets and italics, e.g., [assigned
item].
• Selection: Indicated by surrounding brackets and italics, e.g., [selected
item].
• Refinement: Refined components are identified by using bold for
additional information, or strikeout for deleted text.
• Iteration: Iteration operations for iterations within the Protection Profile
and associated modules are identified with a slash (‘/’) and an identifier
(e.g. “/KM”).
• Where an SFR does not apply equally to all devices, an additional tag has
been added to indicate the products to which the SFR applies. This tag
provides the applicable model names in brackets (e.g. FDP_CDS_EXT.1
(1) Connected Displays Supported (F1DN102MOD-BA-4, F1DN104MOD-
BA-4, F1DN108MOD-BA-4, F1DN208MOD-BA-4, F1DN102MOD-HH-4,
F1DN102MOD-PP-4, F1DN102MOD-DD-4, F1DN104MOD-HH-4,
F1DN104MOD-PP-4, F1DN108MOD-PP-4, F1DN104MOD-DD-4,
F1DN104MOD-XX-4)). Additionally, a number is appended to the SFR
identifier where multiple iterations of the SFR are required.
Extended Security Functional Requirement (SFRs) are identified by the inclusion
of “EXT” in the Security Functional Requirement SFR name.
Section Applicability
Table 13 shows the TOE models and the Section 6 Subsections that include the
SFRs claimed for that device.
TOE Model Sections Describing Security Functionality
F1DN102MOD-BA-4 Section 6.2 and Section 6.3
F1DN104MOD-BA-4 Section 6.2 and Section 6.3
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 38 of 81
TOE Model Sections Describing Security Functionality
F1DN202MOD-BA-4 Section 6.2 and Section 6.4
F1DN204MOD-BA-4 Section 6.2 and Section 6.4
F1DN108MOD-BA-4 Section 6.2 and Section 6.3
F1DN208MOD-BA-4 Section 6.2 and Section 6.4
F1DN102MOD-HH-4 Section 6.2 and Section 6.3
F1DN102MOD-PP-4 Section 6.2 and Section 6.5
F1DN102MOD-DD-4 Section 6.2 and Section 6.6
F1DN202MOD-HH-4 Section 6.2 and Section 6.4
F1DN202MOD-PP-4 Section 6.2 and Section 6.7
F1DN202MOD-DD-4 Section 6.2 and Section 6.8
F1DN104MOD-HH-4 Section 6.2 and Section 6.3
F1DN104MOD-PP-4 Section 6.2 and Section 6.5
F1DN108MOD-PP-4 Section 6.2 and Section 6.5
F1DN104MOD-DD-4 Section 6.2 and Section 6.6
F1DN204MOD-HH-4 Section 6.2 and Section 6.4
F1DN204MOD-PP-4 Section 6.2 and Section 6.7
F1DN208MOD-PP-4 Section 6.2 and Section 6.7
F1DN204MOD-DD-4 Section 6.2 and Section 6.8
F1DN104MOD-XX-4 Section 6.2 and Section 6.9
F1DN204MOD-XX-4 Section 6.2 and Section 6.10
Table 13 – Devices and Applicable Sections
6.2 SECURITY FUNCTIONAL REQUIREMENTS
FOR ALL DEVICES
Section 6.2 details the security functional requirements that apply to all TOE
devices.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 39 of 81
Class Identifier Name Source
User Data
Protection
(FDP)
FDP_APC_EXT.1/KM Active PSD Connections [MOD_KM_V1.0]
FDP_APC_EXT.1/VI Active PSD Connections [MOD_VI_V1.0]
FDP_FIL_EXT.1/KM Device Filtering
(Keyboard/Mouse)
[MOD_KM_V1.0]
FDP_PDC_EXT.1 Peripheral Device
Connection
[PP_PSD_V4.0]
[MOD_VI_V1.0]2
[MOD_KM_V1.0]3
FDP_PDC_EXT.2/KM Authorized Devices
(Keyboard/Mouse)
[MOD_KM_V1.0]
FDP_PDC_EXT.2/VI Authorized Devices
(Video Output)
[MOD_VI_V1.0]
FDP_PDC_EXT.3/KM Authorized Connection
Protocols
(Keyboard/Mouse)
[MOD_KM_V1.0]
FDP_RDR_EXT.1 Re-Enumeration Device
Rejection
[MOD_KM_V1.0]
FDP_RIP_EXT.1 Residual Information
Protection
[PP_PSD_V4.0]
FDP_RIP.1/KM Residual Information
Protection (Keyboard
Data)
[MOD_KM_V1.0]
FDP_SWI_EXT.1 PSD Switching [PP_PSD_V4.0]
FDP_SWI_EXT.2 PSD Switching Methods [PP_PSD_V4.0]
[MOD_KM_V1.0]
FDP_SWI_EXT.3 Tied Switching [MOD_KM_V1.0]
FDP_UDF_EXT.1/KM Unidirectional Data
Flow (Keyboard/Mouse)
[MOD_KM_V1.0]
2
There is no modification to this SFR in the [MOD_VI_V1.0]. However, there are
additions to the Peripheral Device Connections associated with this SFR and additional
evaluation activities.
3
There is no modification to this SFR in the [MOD_KM_V1.0]. However, there are
additions to the Peripheral Device Connections associated with this SFR and additional
evaluation activities.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 40 of 81
Class Identifier Name Source
FDP_UDF_EXT.1/VI Unidirectional Data
Flow (Video Output)
[MOD_VI_V1.0]
Protection of
the TSF (FPT)
FPT_FLS_EXT.1 Failure with
Preservation of Secure
State
[PP_PSD_V4.0]
FPT_NTA_EXT.1 No Access to TOE [PP_PSD_V4.0]
FPT_PHP.1 Passive Detection of
Physical Attack
[PP_PSD_V4.0]
FPT_TST.1 TSF testing [PP_PSD_V4.0]
FPT_TST_EXT.1 TSF Testing [PP_PSD_V4.0]
TOE Access
(FTA)
FTA_CIN_EXT.1 Continuous Indications [PP_PSD_V4.0]
[MOD_VI_V1.0]4
Table 14 – Summary of Security Functional Requirements
User Data Protection (FDP)
6.2.1.1 FDP_APC_EXT.1/KM Active PSD Connections
FDP_APC_EXT.1.1/KM The TSF shall route user data only to or from the interfaces
selected by the user.
FDP_APC_EXT.1.2/KM The TSF shall ensure that no data or electrical signals flow
between connected computers whether the TOE is powered on
or powered off.
FDP_APC_EXT.1.3/KM The TSF shall ensure that no data transits the TOE when the
TOE is powered off.
FDP_APC_EXT.1.4/KM The TSF shall ensure that no data transits the TOE when the
TOE is in a failure state.
6.2.1.2 FDP_APC_EXT.1/VI Active PSD Connections
FDP_APC_EXT.1.1/VI The TSF shall route user data only to or from the interfaces
selected by the user.
FDP_APC_EXT.1.2/VI The TSF shall ensure that no data or electrical signals flow
between connected computers whether the TOE is powered on
or powered off.
4
The refinement from [MOD_VI_V1.0] has been included in FTA_CIN_EXT.1.2.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 41 of 81
FDP_APC_EXT.1.3/VI The TSF shall ensure that no data transits the TOE when the
TOE is powered off.
FDP_APC_EXT.1.4/VI The TSF shall ensure that no data transits the TOE when the
TOE is in a failure state.
6.2.1.3 FDP_FIL_EXT.1/KM Device Filtering (Keyboard/Mouse)
FDP_FIL_EXT.1.1/KM The TSF shall have [fixed] device filtering for [keyboard,
mouse] interfaces.
FDP_FIL_EXT.1.2/KM The TSF shall consider all [PSD KM] blacklisted devices as
unauthorized devices for [keyboard, mouse] interfaces in
peripheral device connections.
FDP_FIL_EXT.1.3/KM The TSF shall consider all [PSD KM] whitelisted devices as
authorized devices for [keyboard, mouse] interfaces in
peripheral device connections only if they are not on the [PSD
KM] blacklist or otherwise unauthorized.
6.2.1.4 FDP_PDC_EXT.1 Peripheral Device Connection
FDP_PDC_EXT.1.1 The TSF shall reject connections with unauthorized devices upon
TOE power up and upon connection of a peripheral device to a
powered‐on TOE.
FDP_ PDC_EXT.1.2 The TSF shall reject connections with devices presenting
unauthorized interface protocols upon TOE power up and upon
connection of a peripheral device to a powered‐on TOE.
FDP_ PDC_EXT.1.3 The TOE shall have no external interfaces other than those claimed
by the TSF.
FDP_ PDC_EXT.1.4 The TOE shall not have wireless interfaces.
FDP_ PDC_EXT.1.5 The TOE shall provide a visual or auditory indication to the User
when a peripheral is rejected.
6.2.1.5 FDP_PDC_EXT.2/KM Authorized Devices
(Keyboard/Mouse)
FDP_PDC_EXT.2.1/KM The TSF shall allow connections with authorized devices and
functions as defined in [Appendix E] and [
• authorized devices as defined in the PP‐Module for
Video/Display Devices
] upon TOE power up and upon connection of a peripheral
device to a powered-on TOE.
FDP_ PDC_EXT.2.2/KM The TSF shall allow connections with authorized devices
presenting authorized interface protocols as defined in
[Appendix E] and [
• authorized devices presenting authorized interface
protocols as defined in the PP‐Module for
Video/Display Devices
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 42 of 81
] upon TOE power up and upon connection of a peripheral
device to a powered-on TOE.
6.2.1.6 FDP_PDC_EXT.2/VI Peripheral Device Connection
(Video Output)
FDP_PDC_EXT.2.1/VI The TSF shall allow connections with authorized devices as
defined in [Appendix E] and [
• authorized devices and functions as defined in the
PP‐Module for Keyboard/Mouse Devices,
] upon TOE power up and upon connection of a peripheral
device to a powered-on TOE.
FDP_ PDC_EXT.2.2/VI The TSF shall allow connections with authorized devices
presenting authorized interface protocols as defined in
[Appendix E] and [
• authorized devices presenting authorized interface
protocols as defined in the PP‐Module for
Keyboard/Mouse Devices,
] upon TOE power up and upon connection of a peripheral
device to a powered-on TOE.
6.2.1.7 FDP_PDC_EXT.3/KM Authorized Connection Protocols
(Keyboard/Mouse)
FDP_PDC_EXT.3.1/KM The TSF shall have interfaces for the [USB (keyboard), USB
(mouse)] protocols.
FDP_PDC_EXT.3.2/KM The TSF shall apply the following rules to the supported
protocols: [the TSF shall emulate any keyboard or mouse
device functions from the TOE to the connected computer].
6.2.1.8 FDP_RDR_EXT.1 Re-Enumeration Device Rejection
FDP_RDR_EXT.1.1 The TSF shall reject any device that attempts to enumerate again as
a different unauthorized device.
6.2.1.9 FDP_RIP_EXT.1 Residual Information Protection
FDP_RIP_EXT.1.1 The TSF shall ensure that no user data is written to TOE non‐volatile
memory or storage.
6.2.1.10 FDP_RIP.1/KM Residual Information Protection
(Keyboard Data)
FDP_RIP.1.1/KM The TSF shall ensure that any keyboard data in volatile
memory is purged upon switching computers.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 43 of 81
6.2.1.11 FDP_SWI_EXT.1 PSD Switching
FDP_SWI_EXT.1.1 The TSF shall ensure that [switching can be initiated only through
express user action].
6.2.1.12 FDP_SWI_EXT.2 PSD Switching Methods
FDP_SWI_EXT.2.1 The TSF shall ensure that no switching can be initiated through
automatic port scanning, control through a connected computer, or
control through keyboard shortcuts.
FDP_SWI_EXT.2.2 The TSF shall ensure that switching can be initiated only through
express user action using [console buttons, wired remote control,
peripheral devices using a guard].
6.2.1.13 FDP_SWI_EXT.3 Tied Switching
FDP_SWI_EXT.3.1 The TSF shall ensure that [connected keyboard and mouse
peripheral devices] are always switched together to the same
connected computer.
6.2.1.14 FDP_UDF_EXT.1/KM Unidirectional Data Flow
(Keyboard/Mouse)
FDP_UDF_EXT.1.1/KM The TSF shall ensure [keyboard, mouse] data transits the
TOE unidirectionally from the [TOE [keyboard, mouse]]
peripheral interface(s) to the [TOE [keyboard, mouse]]
interface.
6.2.1.15 FDP_UDF_EXT.1/VI Unidirectional Data Flow (Video
Output)
FDP_UDF_EXT.1.1/VI The TSF shall ensure [video] data transits the TOE
unidirectionally from the [TOE computer video] interface to the
[TOE peripheral device display] interface.
Protection of the TSF (FPT)
6.2.2.1 FPT_FLS_EXT.1 Failure with Preservation of Secure
State
FPT_FLS_EXT.1.1 The TSF shall preserve a secure state when the following types of
failures occur: failure of the power‐on self‐test and [no other
failures].
6.2.2.2 FPT_NTA_EXT.1 No Access to TOE
FPT_NTA_EXT.1.1 TOE firmware, software, and memory shall not be accessible via the
TOE’s external ports, with the following exceptions: [the Extended
Display Identification Data (EDID) memory of Video TOEs may
be accessible from connected computers; the configuration data,
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 44 of 81
settings, and logging data that may be accessible by authorized
administrators].
6.2.2.3 FPT_PHP.1 Passive Detection of Physical Attack
FPT_PHP.1.1 The TSF shall provide unambiguous detection of physical tampering
that might compromise the TSF.
FPT_PHP.1.2 The TSF shall provide the capability to determine whether physical
tampering with the TSF's devices or TSF's elements has occurred.
6.2.2.4 FPT_TST.1 TSF Testing
FPT_TST.1.1 The TSF shall run a suite of self-tests [during initial start-up and at
the conditions [no other conditions]] to demonstrate the correct
operation of [user control functions and [no other functions]].
FPT_TST.1.2 The TSF shall provide authorized users with the capability to verify the
integrity of [TSF data].
FPT_TST.1.3 The TSF shall provide authorized users with the capability to verify the
integrity of [TSF].
6.2.2.5 FPT_TST_EXT.1 TSF Testing
FPT_TST_EXT.1.1 The TSF shall respond to a self‐test failure by providing users with a
[visual, auditory] indication of failure and by shutdown of normal
TSF functions.
TOE Access (FTA)
6.2.3.1 FTA_CIN_EXT.1 Continuous Indications
FTA_CIN_EXT.1.1 The TSF shall display a visible indication of the selected computers
at all times when the TOE is powered.
FTA_CIN_EXT.1.2 The TSF shall implement the visible indication using the following
mechanism: easily visible graphical and/or textual markings
of each source video on the display, [[illuminated buttons]].
FTA_CIN_EXT.1.3 The TSF shall ensure that while the TOE is powered the current
switching status is reflected by [multiple indicators which never
display conflicting information].
6.3 ADDITIONAL SECURITY REQUIREMENTS
FOR F1DN102MOD-BA-4, F1DN104MOD-BA-
4, F1DN108MOD-BA-4, F1DN102MOD-HH-4,
F1DN104MOD-HH-4
Section 6.3 details the security functional requirements that are satisfied by the
F1DN102MOD-BA-4, F1DN104MOD-BA-4, F1DN108MOD-BA-4, F1DN102MOD-
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 45 of 81
HH-4 and F1DN104MOD-HH-4 TOE devices. These devices support a single
connected display and the HDMI video protocol.
Class Identifier Name Source
User Data
Protection
(FDP)
FDP_CDS_EXT.1(1) Connected Displays
Supported
(F1DN102MOD-BA-4,
F1DN104MOD-BA-4,
F1DN108MOD-BA-4,
F1DN208MOD-BA-4,
F1DN102MOD-HH-4,
F1DN102MOD-PP-4,
F1DN102MOD-DD-4,
F1DN104MOD-HH-4,
F1DN104MOD-PP-4,
F1DN108MOD-PP-4,
F1DN104MOD-DD-4,
F1DN104MOD-XX-4)
[MOD_VI_V1.0]
FDP_PDC_EXT.3/VI(1) Authorized Connection
Protocols (Video
Output)
(F1DN102MOD-BA-4,
F1DN202MOD-BA-4,
F1DN104MOD-BA-4,
F1DN204MOD-BA-4,
F1DN108MOD-BA-4,
F1DN208MOD-BA-4,
F1DN102MOD-HH-4,
F1DN202MOD-HH-4,
F1DN104MOD-HH-4,
F1DN204MOD-HH-4)
[MOD_VI_V1.0]
FDP_SPR_EXT.1/HDMI Sub-Protocol Rules
(HDMI Protocol)
(F1DN102MOD-BA-4,
F1DN104MOD-BA-4,
F1DN202MOD-BA-4,
F1DN204MOD-BA-4,
F1DN108MOD-BA-4,
F1DN208MOD-BA-4,
F1DN102MOD-HH-4,
F1DN202MOD-HH-4,
F1DN104MOD-HH-4,
F1DN204MOD-HH-4,
F1DN104MOD-XX-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
Table 15 – Summary of Additional Security Functional Requirements for F1DN102MOD-
BA-4, F1DN104MOD-BA-4, F1DN108MOD-BA-4, F1DN102MOD-HH-4 and F1DN104MOD-
HH-4
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 46 of 81
User Data Protection (FDP)
6.3.1.1 FDP_CDS_EXT.1(1) Connected Displays Supported
(F1DN102MOD-BA-4, F1DN104MOD-BA-4, F1DN108MOD-
BA-4, F1DN208MOD-BA-4, F1DN102MOD-HH-4,
F1DN102MOD-PP-4, F1DN102MOD-DD-4, F1DN104MOD-
HH-4, F1DN104MOD-PP-4, F1DN108MOD-PP-4,
F1DN104MOD-DD-4, F1DN104MOD-XX-4)
FDP_CDS_EXT.1.1(1) The TSF shall support [one connected display] at a time.
6.3.1.2 FDP_PDC_EXT.3/VI(1) Authorized Connection
Protocols (Video Output) (F1DN102MOD-BA-4,
F1DN202MOD-BA-4, F1DN104MOD-BA-4, F1DN204MOD-
BA-4, F1DN108MOD-BA-4, F1DN208MOD-BA-4,
F1DN102MOD-HH-4, F1DN202MOD-HH-4, F1DN104MOD-
HH-4, F1DN204MOD-HH-4)
FDP_PDC_EXT.3.1/VI(1) The TSF shall have interfaces for the [HDMI] protocols.
FDP_PDC_EXT.3.2/VI(1) The TSF shall apply the following rules to the supported
protocols: [the TSF shall read the connected display EDID
information once during power‐on or reboot].
6.3.1.3 FDP_SPR_EXT.1/HDMI Sub-Protocol Rules (HDMI
Protocol) (F1DN102MOD-BA-4, F1DN104MOD-BA-4,
F1DN202MOD-BA-4, F1DN204MOD-BA-4, F1DN108MOD-
BA-4, F1DN208MOD-BA-4, F1DN102MOD-HH-4,
F1DN202MOD-HH-4, F1DN104MOD-HH-4, F1DN204MOD-
HH-4, F1DN104MOD-XX-4, F1DN204MOD-XX-4)
FDP_SPR_EXT.1.1/HDMI The TSF shall apply the following rules for the [HDMI]
protocol:
• block the following video/display sub‐protocols:
o [ARC
o CEC,
o EDID from computer to display,
o HDCP,
o HEAC,
o HEC,
o MCCS]
• allow the following video/display sub‐protocols:
o [EDID from display to computer,
o HPD from display to computer].
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 47 of 81
6.4 ADDITIONAL SECURITY REQUIREMENTS
FOR F1DN202MOD-BA-4, F1DN204MOD-BA-
4, F1DN208MOD-BA-4, F1DN202MOD-HH-4,
F1DN204MOD-HH-4
Section 6.4 details the security functional requirements that are satisfied by the
F1DN202MOD-BA-4, F1DN204MOD-BA-4, F1DN208MOD-BA-4, F1DN202MOD-
HH-4 and F1DN204MOD-HH-4 TOE devices. These devices support multiple
connected displays and the HDMI video protocol.
Class Identifier Name Source
User Data
Protection
(FDP)
FDP_CDS_EXT.1(2) Connected Displays
Supported
(F1DN202MOD-BA-4,
F1DN204MOD-BA-4,
F1DN208MOD-BA-4,
F1DN202MOD-HH-4,
F1DN202MOD-PP-4,
F1DN202MOD-DD-4,
F1DN204MOD-HH-4,
F1DN204MOD-PP-4,
F1DN208MOD-PP-4,
F1DN204MOD-DD-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
FDP_PDC_EXT.3/VI(1) Authorized Connection
Protocols (Video
Output)
(F1DN102MOD-BA-4,
F1DN202MOD-BA-4,
F1DN104MOD-BA-4,
F1DN204MOD-BA-4,
F1DN108MOD-BA-4,
F1DN208MOD-BA-4,
F1DN102MOD-HH-4,
F1DN202MOD-HH-4,
F1DN104MOD-HH-4,
F1DN204MOD-HH-4)
[MOD_VI_V1.0]
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 48 of 81
Class Identifier Name Source
FDP_SPR_EXT.1/HDMI Sub-Protocol Rules
(HDMI Protocol)
(F1DN102MOD-BA-4,
F1DN104MOD-BA-4,
F1DN202MOD-BA-4,
F1DN204MOD-BA-4,
F1DN108MOD-BA-4,
F1DN208MOD-BA-4,
F1DN102MOD-HH-4,
F1DN202MOD-HH-4,
F1DN104MOD-HH-4,
F1DN204MOD-HH-4,
F1DN104MOD-XX-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
Table 16 – Summary of Additional Security Functional Requirements for F1DN202MOD-
BA-4, F1DN204MOD-BA-4, F1DN208MOD-BA-4 and F1DN204MOD-HH-4
User Data Protection (FDP)
6.4.1.1 FDP_CDS_EXT.1(2) Connected Displays Supported
(F1DN202MOD-BA-4, F1DN204MOD-BA-4, F1DN208MOD-
BA-4, F1DN202MOD-HH-4, F1DN202MOD-PP-4,
F1DN202MOD-DD-4, F1DN204MOD-HH-4, F1DN204MOD-
PP-4, F1DN208MOD-PP-4, F1DN204MOD-DD-4,
F1DN204MOD-XX-4)
FDP_CDS_EXT.1.1(2) The TSF shall support [multiple connected displays] at a time.
6.4.1.2 FDP_PDC_EXT.3/VI(1) Authorized Connection
Protocols (Video Output) (F1DN102MOD-BA-4,
F1DN202MOD-BA-4, F1DN104MOD-BA-4, F1DN204MOD-
BA-4, F1DN108MOD-BA-4, F1DN208MOD-BA-4,
F1DN102MOD-HH-4, F1DN202MOD-HH-4, F1DN104MOD-
HH-4, F1DN204MOD-HH-4)
FDP_PDC_EXT.3.1/VI(1) The TSF shall have interfaces for the [HDMI] protocols.
FDP_PDC_EXT.3.2/VI(1) The TSF shall apply the following rules to the supported
protocols: [the TSF shall read the connected display EDID
information once during power‐on or reboot].
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 49 of 81
6.4.1.3 FDP_SPR_EXT.1/HDMI Sub-Protocol Rules (HDMI
Protocol) (F1DN102MOD-BA-4, F1DN104MOD-BA-4,
F1DN202MOD-BA-4, F1DN204MOD-BA-4, F1DN108MOD-
BA-4, F1DN208MOD-BA-4, F1DN102MOD-HH-4,
F1DN202MOD-HH-4, F1DN104MOD-HH-4, F1DN204MOD-
HH-4, F1DN104MOD-XX-4, F1DN204MOD-XX-4)
FDP_SPR_EXT.1.1/HDMI The TSF shall apply the following rules for the [HDMI]
protocol:
• block the following video/display sub‐protocols:
o [ARC
o CEC,
o EDID from computer to display,
o HDCP,
o HEAC,
o HEC,
o MCCS]
• allow the following video/display sub‐protocols:
o [EDID from display to computer,
o HPD from display to computer].
6.5 ADDITIONAL SECURITY REQUIREMENTS
FOR F1DN102MOD-PP-4, F1DN104MOD-PP-
4, F1DN108MOD-PP-4
Section 6.5 details the security functional requirements that are satisfied by the
F1DN102MOD-PP-4, F1DN104MOD-PP-4 and F1DN108MOD-PP-4 TOE devices.
These devices support a single connected display and the DisplayPort video
protocol.
Class Identifier Name Source
User Data
Protection
(FDP)
FDP_CDS_EXT.1(1) Connected Displays
Supported
(F1DN102MOD-BA-4,
F1DN104MOD-BA-4,
F1DN108MOD-BA-4,
F1DN208MOD-BA-4,
F1DN102MOD-HH-4,
F1DN102MOD-PP-4,
F1DN102MOD-DD-4,
F1DN104MOD-HH-4,
F1DN104MOD-PP-4,
F1DN108MOD-PP-4,
F1DN104MOD-DD-4,
F1DN104MOD-XX-4)
[MOD_VI_V1.0]
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 50 of 81
Class Identifier Name Source
FDP_IPC_EXT.1(1) Internal Protocol
Conversion
(F1DN102MOD-PP-4,
F1DN202MOD-PP-4,
F1DN104MOD-PP-4,
F1DN108MOD-PP-4,
F1DN204MOD-PP-4,
F1DN208MOD-PP-4)
[MOD_VI_V1.0]
FDP_PDC_EXT.3/VI(2) Authorized Connection
Protocols (Video
Output)
(F1DN102MOD-PP-4,
F1DN104MOD-PP-4,
F1DN108MOD-PP-4,
F1DN202MOD-PP-4,
F1DN204MOD-PP-4,
F1DN208MOD-PP-4)
[MOD_VI_V1.0]
FDP_SPR_EXT.1/DP Sub-Protocol Rules
(DisplayPort Protocol)
(F1DN102MOD-PP-4,
F1DN202MOD-PP-4,
F1DN104MOD-PP-4,
F1DN108MOD-PP-4,
F1DN204MOD-PP-4,
F1DN208MOD-PP-4,
F1DN104MOD-XX-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
Table 17 – Summary of Additional Security Functional Requirements for F1DN102MOD-
PP-4, F1DN104MOD-PP-4 and F1DN108MOD-PP-4
User Data Protection (FDP)
6.5.1.1 FDP_CDS_EXT.1(1) Connected Displays Supported
(F1DN102MOD-BA-4, F1DN104MOD-BA-4, F1DN108MOD-
BA-4, F1DN208MOD-BA-4, F1DN102MOD-HH-4,
F1DN102MOD-PP-4, F1DN102MOD-DD-4, F1DN104MOD-
HH-4, F1DN104MOD-PP-4, F1DN108MOD-PP-4,
F1DN104MOD-DD-4, F1DN104MOD-XX-4)
FDP_CDS_EXT.1.1(1) The TSF shall support [one connected display] at a time.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 51 of 81
6.5.1.2 FDP_IPC_EXT.1(1) Internal Protocol Conversion
(F1DN102MOD-PP-4, F1DN202MOD-PP-4, F1DN104MOD-
PP-4, F1DN108MOD-PP-4, F1DN204MOD-PP-4,
F1DN208MOD-PP-4)
FDP_IPC_EXT.1.1(1) The TSF shall convert the [DisplayPort] protocol at the
[DisplayPort computer video interface] into the [HDMI] protocol
within the TOE.
FDP_IPC_EXT.1.2(1) The TSF shall output the [HDMI] protocol from inside the TOE to
[peripheral display interface(s)] as [[DisplayPort] protocol,
[HDMI] protocol].
6.5.1.3 FDP_PDC_EXT.3/VI(2) Authorized Connection
Protocols (Video Output) (F1DN102MOD-PP-4,
F1DN104MOD-PP-4, F1DN108MOD-PP-4, F1DN202MOD-
PP-4, F1DN204MOD-PP-4, F1DN208MOD-PP-4)
FDP_PDC_EXT.3.1/VI(2) The TSF shall have interfaces for the [DisplayPort]
protocols.
FDP_PDC_EXT.3.2/VI(2) The TSF shall apply the following rules to the supported
protocols: [the TSF shall read the connected display EDID
information once during power‐on or reboot].
6.5.1.4 FDP_SPR_EXT.1/DP Sub-Protocol Rules (DisplayPort
Protocol) (F1DN102MOD-PP-4, F1DN202MOD-PP-4,
F1DN104MOD-PP-4, F1DN108MOD-PP-4, F1DN204MOD-
PP-4, F1DN208MOD-PP-4, F1DN104MOD-XX-4,
F1DN204MOD-XX-4)
FDP_SPR_EXT.1.1/DP The TSF shall apply the following rules for the [DisplayPort]
protocol:
• block the following video/display sub‐protocols:
o [CEC,
o EDID from computer to display,
o HDCP,
o MCCS]
• allow the following video/display sub‐protocols:
o [EDID from display to computer,
o HPD from display to computer,
o Link Training].
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 52 of 81
6.6 ADDITIONAL SECURITY REQUIREMENTS
FOR F1DN102MOD-DD-4, F1DN104MOD-DD-
4
Section 6.6 details the security functional requirements that are satisfied by the
F1DN102MOD-DD-4 and F1DN104MOD-DD-4 TOE devices. These devices
support a single connected display and the DVI-D video protocol.
Class Identifier Name Source
User Data
Protection
(FDP)
FDP_CDS_EXT.1(1) Connected Displays
Supported
(F1DN102MOD-BA-4,
F1DN104MOD-BA-4,
F1DN108MOD-BA-4,
F1DN208MOD-BA-4,
F1DN102MOD-HH-4,
F1DN102MOD-PP-4,
F1DN102MOD-DD-4,
F1DN104MOD-HH-4,
F1DN104MOD-PP-4,
F1DN108MOD-PP-4,
F1DN104MOD-DD-4,
F1DN104MOD-XX-4)
[MOD_VI_V1.0]
FDP_PDC_EXT.3/VI(3) Authorized Connection
Protocols (Video
Output)
(F1DN102MOD-DD-4,
F1DN104MOD-DD-4,
F1DN202MOD-DD-4,
F1DN204MOD-DD-4)
[MOD_VI_V1.0]
FDP_SPR_EXT.1/DVI-D Sub-Protocol Rules
(DVI-D Protocol)
(F1DN102MOD-DD-4,
F1DN202MOD-DD-4,
F1DN104MOD-DD-4,
F1DN204MOD-DD-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
Table 18 – Summary of Additional Security Functional Requirements for F1DN102MOD-
DD-4 and F1DN104MOD-DD-4
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 53 of 81
User Data Protection (FDP)
6.6.1.1 FDP_CDS_EXT.1(1) Connected Displays Supported
(F1DN102MOD-BA-4, F1DN104MOD-BA-4, F1DN108MOD-
BA-4, F1DN208MOD-BA-4, F1DN102MOD-HH-4,
F1DN102MOD-PP-4, F1DN102MOD-DD-4, F1DN104MOD-
HH-4, F1DN104MOD-PP-4, F1DN108MOD-PP-4,
F1DN104MOD-DD-4, F1DN104MOD-XX-4)
FDP_CDS_EXT.1.1(1) The TSF shall support [one connected display] at a time.
6.6.1.2 FDP_PDC_EXT.3/VI(3) Authorized Connection
Protocols (Video Output) (F1DN102MOD-DD-4,
F1DN104MOD-DD-4, F1DN202MOD-DD-4, F1DN204MOD-
DD-4)
FDP_PDC_EXT.3.1/VI(3) The TSF shall have interfaces for the [DVI-D] protocols.
FDP_PDC_EXT.3.2/VI(3) The TSF shall apply the following rules to the supported
protocols: [the TSF shall read the connected display EDID
information once during power‐on or reboot].
6.6.1.3 FDP_SPR_EXT.1/DVI-D Sub-Protocol Rules (DVI-D
Protocol) (F1DN102MOD-DD-4, F1DN202MOD-DD-4,
F1DN104MOD-DD-4, F1DN204MOD-DD-4, F1DN204MOD-
XX-4)
FDP_SPR_EXT.1.1/DVI-D The TSF shall apply the following rules for the [DVI-D]
protocol:
• block the following video/display sub‐protocols:
o [ARC,
o CEC,
o EDID from computer to display,
o HDCP,
o HEAC,
o HEC,
o MCCS]
• allow the following video/display sub‐protocols:
o [EDID from display to computer,
o HPD from display to computer].
6.7 ADDITIONAL SECURITY REQUIREMENTS
FOR F1DN202MOD-PP-4, F1DN204MOD-PP-
4, F1DN208MOD-PP-4
Section 6.7 details the security functional requirements that are satisfied by the
F1DN202MOD-PP-4, F1DN204MOD-PP-4 and F1DN208MOD-PP-4 TOE devices.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 54 of 81
These devices support multiple connected displays and the DisplayPort video
protocol.
Class Identifier Name Source
User Data
Protection
(FDP)
FDP_CDS_EXT.1(2) Connected Displays
Supported
(F1DN202MOD-BA-4,
F1DN204MOD-BA-4,
F1DN208MOD-BA-4,
F1DN202MOD-HH-4,
F1DN202MOD-PP-4,
F1DN202MOD-DD-4,
F1DN204MOD-HH-4,
F1DN204MOD-PP-4,
F1DN208MOD-PP-4,
F1DN204MOD-DD-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
FDP_IPC_EXT.1(1) Internal Protocol
Conversion
(F1DN102MOD-PP-4,
F1DN202MOD-PP-4,
F1DN104MOD-PP-4,
F1DN108MOD-PP-4,
F1DN204MOD-PP-4,
F1DN208MOD-PP-4)
[MOD_VI_V1.0]
FDP_PDC_EXT.3/VI(2) Authorized Connection
Protocols (Video
Output)
(F1DN102MOD-PP-4,
F1DN104MOD-PP-4,
F1DN108MOD-PP-4,
F1DN202MOD-PP-4,
F1DN204MOD-PP-4,
F1DN208MOD-PP-4)
[MOD_VI_V1.0]
FDP_SPR_EXT.1/DP Sub-Protocol Rules
(DisplayPort Protocol)
(F1DN102MOD-PP-4,
F1DN202MOD-PP-4,
F1DN104MOD-PP-4,
F1DN108MOD-PP-4,
F1DN204MOD-PP-4,
F1DN208MOD-PP-4,
F1DN104MOD-XX-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
Table 19 – Summary of Additional Security Functional Requirements for F1DN202MOD-
PP-4, F1DN204MOD-PP-4 and F1DN208MOD-PP-4
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 55 of 81
User Data Protection (FDP)
6.7.1.1 FDP_CDS_EXT.1(2) Connected Displays Supported
(F1DN202MOD-BA-4, F1DN204MOD-BA-4, F1DN208MOD-
BA-4, F1DN202MOD-HH-4, F1DN202MOD-PP-4,
F1DN202MOD-DD-4, F1DN204MOD-HH-4, F1DN204MOD-
PP-4, F1DN208MOD-PP-4, F1DN204MOD-DD-4,
F1DN204MOD-XX-4)
FDP_CDS_EXT.1.1(2) The TSF shall support [multiple connected displays] at a time.
6.7.1.2 FDP_IPC_EXT.1(1) Internal Protocol Conversion
(F1DN102MOD-PP-4, F1DN202MOD-PP-4, F1DN104MOD-
PP-4, F1DN108MOD-PP-4, F1DN204MOD-PP-4,
F1DN208MOD-PP-4)
FDP_IPC_EXT.1.1(1) The TSF shall convert the [DisplayPort] protocol at the
[DisplayPort computer video interface] into the [HDMI] protocol
within the TOE.
FDP_IPC_EXT.1.2(1) The TSF shall output the [HDMI] protocol from inside the TOE to
[peripheral display interface(s)] as [[DisplayPort] protocol,
[HDMI] protocol].
6.7.1.3 FDP_PDC_EXT.3/VI(2) Authorized Connection
Protocols (Video Output) (F1DN102MOD-PP-4,
F1DN104MOD-PP-4, F1DN108MOD-PP-4, F1DN202MOD-
PP-4, F1DN204MOD-PP-4, F1DN208MOD-PP-4)
FDP_PDC_EXT.3.1/VI(2) The TSF shall have interfaces for the [DisplayPort] protocols.
FDP_PDC_EXT.3.2/VI(2) The TSF shall apply the following rules to the supported
protocols: [the TSF shall read the connected display EDID
information once during power‐on or reboot].
6.7.1.4 FDP_SPR_EXT.1/DP Sub-Protocol Rules (DisplayPort
Protocol) (F1DN102MOD-PP-4, F1DN202MOD-PP-4,
F1DN104MOD-PP-4, F1DN108MOD-PP-4, F1DN204MOD-
PP-4, F1DN208MOD-PP-4, F1DN104MOD-XX-4,
F1DN204MOD-XX-4)
FDP_SPR_EXT.1.1/DP The TSF shall apply the following rules for the [DisplayPort]
protocol:
• block the following video/display sub‐protocols:
o [CEC,
o EDID from computer to display,
o HDCP,
o MCCS]
• allow the following video/display sub‐protocols:
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 56 of 81
o [EDID from display to computer,
o HPD from display to computer,
o Link Training].
6.8 ADDITIONAL SECURITY REQUIREMENTS
FOR F1DN202MOD-DD-4, F1DN204MOD-DD-
4
Section 6.8 details the security functional requirements that are satisfied by the
F1DN202MOD-DD-4 and F1DN204MOD-DD-4 TOE devices. These devices
support multiple connected displays and the DVI-D video protocol.
Class Identifier Name Source
User Data
Protection
(FDP)
FDP_CDS_EXT.1(2) Connected Displays
Supported
(F1DN202MOD-BA-4,
F1DN204MOD-BA-4,
F1DN208MOD-BA-4,
F1DN202MOD-HH-4,
F1DN202MOD-PP-4,
F1DN202MOD-DD-4,
F1DN204MOD-HH-4,
F1DN204MOD-PP-4,
F1DN208MOD-PP-4,
F1DN204MOD-DD-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
FDP_PDC_EXT.3/VI(3) Authorized Connection
Protocols (Video
Output)
(F1DN102MOD-DD-4,
F1DN104MOD-DD-4,
F1DN202MOD-DD-4,
F1DN204MOD-DD-4)
[MOD_VI_V1.0]
FDP_SPR_EXT.1/DVI-
D
Sub-Protocol Rules
(DVI-D Protocol)
(F1DN102MOD-DD-4,
F1DN202MOD-DD-4,
F1DN104MOD-DD-4,
F1DN204MOD-DD-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
Table 20 – Summary of Additional Security Functional Requirements for F1DN202MOD-
DD-4 and F1DN204MOD-DD-4
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 57 of 81
User Data Protection (FDP)
6.8.1.1 FDP_CDS_EXT.1(2) Connected Displays Supported
(F1DN202MOD-BA-4, F1DN204MOD-BA-4, F1DN208MOD-
BA-4, F1DN202MOD-HH-4, F1DN202MOD-PP-4,
F1DN202MOD-DD-4, F1DN204MOD-HH-4, F1DN204MOD-
PP-4, F1DN208MOD-PP-4, F1DN204MOD-DD-4,
F1DN204MOD-XX-4)
FDP_CDS_EXT.1.1(2) The TSF shall support [multiple connected displays] at a time.
6.8.1.2 FDP_PDC_EXT.3/VI(3) Authorized Connection
Protocols (Video Output) (F1DN102MOD-DD-4,
F1DN104MOD-DD-4, F1DN202MOD-DD-4, F1DN204MOD-
DD-4)
FDP_PDC_EXT.3.1/VI(3) The TSF shall have interfaces for the [DVI-D] protocols.
FDP_PDC_EXT.3.2/VI(3) The TSF shall apply the following rules to the supported
protocols: [the TSF shall read the connected display EDID
information once during power‐on or reboot].
6.8.1.3 FDP_SPR_EXT.1/DVI-D Sub-Protocol Rules (DVI-D
Protocol) (F1DN102MOD-DD-4, F1DN202MOD-DD-4,
F1DN104MOD-DD-4, F1DN204MOD-DD-4, F1DN204MOD-
XX-4)
FDP_SPR_EXT.1.1/DVI-D The TSF shall apply the following rules for the [DVI-D]
protocol:
• block the following video/display sub‐protocols:
o [ARC,
o CEC,
o EDID from computer to display,
o HDCP,
o HEAC,
o HEC,
o MCCS]
• allow the following video/display sub‐protocols:
o [EDID from display to computer,
o HPD from display to computer].
6.9 ADDITIONAL SECURITY REQUIREMENTS
FOR F1DN104MOD-XX-4
Section 6.9 details the security functional requirements that are satisfied by the
F1DN104MOD-XX-4 TOE device. These devices support a single connected
display and the VGA, HDMI, DisplayPort and USB Type C with DisplayPort as an
alternate function video protocols.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 58 of 81
Class Identifier Name Source
User Data
Protection
(FDP)
FDP_CDS_EXT.1(1) Connected Displays
Supported
(F1DN102MOD-BA-4,
F1DN104MOD-BA-4,
F1DN108MOD-BA-4,
F1DN208MOD-BA-4,
F1DN102MOD-HH-4,
F1DN102MOD-PP-4,
F1DN102MOD-DD-4,
F1DN104MOD-HH-4,
F1DN104MOD-PP-4,
F1DN108MOD-PP-4,
F1DN104MOD-DD-4,
F1DN104MOD-XX-4)
[MOD_VI_V1.0]
FDP_IPC_EXT.1(2) Internal Protocol
Conversion
(F1DN104MOD-XX-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
FDP_PDC_EXT.3/VI(4) Authorized Connection
Protocols (Video
Output)
(F1DN104MOD-XX-4)
[MOD_VI_V1.0]
FDP_SPR_EXT.1/DP Sub-Protocol Rules
(DisplayPort Protocol)
(F1DN102MOD-PP-4,
F1DN202MOD-PP-4,
F1DN104MOD-PP-4,
F1DN108MOD-PP-4,
F1DN204MOD-PP-4,
F1DN208MOD-PP-4,
F1DN104MOD-XX-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 59 of 81
Class Identifier Name Source
FDP_SPR_EXT.1/HDMI Sub-Protocol Rules
(HDMI Protocol)
(F1DN102MOD-BA-4,
F1DN104MOD-BA-4,
F1DN202MOD-BA-4,
F1DN204MOD-BA-4,
F1DN108MOD-BA-4,
F1DN208MOD-BA-4,
F1DN102MOD-HH-4,
F1DN202MOD-HH-4,
F1DN104MOD-HH-4,
F1DN204MOD-HH-4,
F1DN104MOD-XX-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
FDP_SPR_EXT.1/USB Sub-Protocol Rules
(USB-C Protocol)
(F1DN104MOD-XX-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
FDP_SPR_EXT.1/VGA Sub-Protocol Rules
(VGA Protocol)
(F1DN104MOD-XX-4)
[MOD_VI_V1.0]
Table 21 – Summary of Additional Security Functional Requirements for F1DN104MOD-
XX-4
User Data Protection (FDP)
6.9.1.1 FDP_CDS_EXT.1(1) Connected Displays Supported
(F1DN102MOD-BA-4, F1DN104MOD-BA-4, F1DN108MOD-
BA-4, F1DN208MOD-BA-4, F1DN102MOD-HH-4,
F1DN102MOD-PP-4, F1DN102MOD-DD-4, F1DN104MOD-
HH-4, F1DN104MOD-PP-4, F1DN108MOD-PP-4,
F1DN104MOD-DD-4, F1DN104MOD-XX-4)
FDP_CDS_EXT.1.1(1) The TSF shall support [one connected display] at a time.
6.9.1.2 FDP_IPC_EXT.1(2) Internal Protocol Conversion
(F1DN104MOD-XX-4, F1DN204MOD-XX-4)
FDP_IPC_EXT.1.1(2) The TSF shall convert the [DisplayPort] protocol at the
[DisplayPort computer video interface] into the [HDMI] protocol
within the TOE.
FDP_IPC_EXT.1.2(2) The TSF shall output the [HDMI] protocol from inside the TOE to
[peripheral display interface(s)] as [ [HDMI] protocol].
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 60 of 81
6.9.1.3 FDP_PDC_EXT.3/VI(4) Authorized Connection
Protocols (Video Output) (F1DN104MOD-XX-4)
FDP_PDC_EXT.3.1/VI(4) The TSF shall have interfaces for the [VGA, HDMI,
DisplayPort, USB Type-C with DisplayPort as alternate
function ] protocols.
FDP_PDC_EXT.3.2/VI(4) The TSF shall apply the following rules to the supported
protocols: [the TSF shall read the connected display EDID
information once during power‐on or reboot].
6.9.1.4 FDP_SPR_EXT.1/DP Sub-Protocol Rules (DisplayPort
Protocol) (F1DN102MOD-PP-4, F1DN202MOD-PP-4,
F1DN104MOD-PP-4, F1DN108MOD-PP-4, F1DN204MOD-
PP-4, F1DN208MOD-PP-4, F1DN104MOD-XX-4,
F1DN204MOD-XX-4)
FDP_SPR_EXT.1.1/DP The TSF shall apply the following rules for the [DisplayPort]
protocol:
• block the following video/display sub‐protocols:
o [CEC,
o EDID from computer to display,
o HDCP,
o MCCS]
• allow the following video/display sub‐protocols:
o [EDID from display to computer,
o HPD from display to computer,
o Link Training].
6.9.1.5 FDP_SPR_EXT.1/HDMI Sub-Protocol Rules (HDMI
Protocol) (F1DN102MOD-BA-4, F1DN104MOD-BA-4,
F1DN202MOD-BA-4, F1DN204MOD-BA-4, F1DN108MOD-
BA-4, F1DN208MOD-BA-4, F1DN102MOD-HH-4,
F1DN202MOD-HH-4, F1DN104MOD-HH-4, F1DN204MOD-
HH-4, F1DN104MOD-XX-4, F1DN204MOD-XX-4)
FDP_SPR_EXT.1.1/HDMI The TSF shall apply the following rules for the [HDMI]
protocol:
• block the following video/display sub‐protocols:
o [ARC
o CEC,
o EDID from computer to display,
o HDCP,
o HEAC,
o HEC,
o MCCS]
• allow the following video/display sub‐protocols:
o [EDID from display to computer,
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 61 of 81
o HPD from display to computer].
6.9.1.6 FDP_SPR_EXT.1/USB Sub-Protocol Rules (USB-C
Protocol) (F1DN104MOD-XX-4, F1DN204MOD-XX-4)
FDP_SPR_EXT.1.1/USB-C The TSF shall apply the following rules for the [USB Type‐C
with DisplayPort as alternate function] protocol:
• block the following video/display sub‐protocols:
o [CEC,
o EDID from computer to display,
o HDCP,
o MCCS]
• allow the following video/display sub‐protocols:
o [EDID from display to computer,
o HPD from display to computer,
o Link Training].
6.9.1.7 FDP_SPR_EXT.1/VGA Sub-Protocol Rules (VGA Protocol)
(F1DN104MOD-XX-4)
FDP_SPR_EXT.1.1/VGA The TSF shall apply the following rules for the [VGA] protocol:
• block the following video/display sub‐protocols:
o [EDID from computer to display,
o MCCS]
• allow the following video/display sub‐protocols:
o [EDID from display to computer].
6.10 ADDITIONAL SECURITY REQUIREMENTS
FOR F1DN204MOD-XX-4
Section 6.10 details the security functional requirements that are satisfied by
the F1DN204MOD-XX-4 TOE device. These devices support multiple connected
displays and the DVI-D, HDMI, DisplayPort and USB Type C with DisplayPort as
an alternate function video protocols.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 62 of 81
Class Identifier Name Source
User Data
Protection
(FDP)
FDP_CDS_EXT.1(2) Connected Displays
Supported
(F1DN202MOD-BA-4,
F1DN204MOD-BA-4,
F1DN208MOD-BA-4,
F1DN202MOD-HH-4,
F1DN202MOD-PP-4,
F1DN202MOD-DD-4,
F1DN204MOD-HH-4,
F1DN204MOD-PP-4,
F1DN208MOD-PP-4,
F1DN204MOD-DD-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
FDP_IPC_EXT.1(2) Internal Protocol
Conversion
(F1DN104MOD-XX-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
FDP_PDC_EXT.3/VI(5) Authorized Connection
Protocols (Video
Output)
(F1DN204MOD-XX-4)
[MOD_VI_V1.0]
FDP_SPR_EXT.1/DP Sub-Protocol Rules
(DisplayPort Protocol)
(F1DN102MOD-PP-4,
F1DN202MOD-PP-4,
F1DN104MOD-PP-4,
F1DN108MOD-PP-4,
F1DN204MOD-PP-4,
F1DN208MOD-PP-4,
F1DN104MOD-XX-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
FDP_SPR_EXT.1/HDMI Sub-Protocol Rules
(HDMI Protocol)
(F1DN102MOD-BA-4,
F1DN104MOD-BA-4,
F1DN202MOD-BA-4,
F1DN204MOD-BA-4,
F1DN108MOD-BA-4,
F1DN208MOD-BA-4,
F1DN102MOD-HH-4,
F1DN202MOD-HH-4,
F1DN104MOD-HH-4,
F1DN204MOD-HH-4,
F1DN104MOD-XX-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 63 of 81
Class Identifier Name Source
FDP_SPR_EXT.1/USB Sub-Protocol Rules
(USB-C Protocol)
(F1DN104MOD-XX-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
FDP_SPR_EXT.1/DVI-
D
Sub-Protocol Rules
(DVI-D Protocol)
(F1DN102MOD-DD-4,
F1DN202MOD-DD-4,
F1DN104MOD-DD-4,
F1DN204MOD-DD-4,
F1DN204MOD-XX-4)
[MOD_VI_V1.0]
Table 22 – Summary of Additional Security Functional Requirements for F1DN204MOD-
XX-4
User Data Protection (FDP)
6.10.1.1 FDP_CDS_EXT.1(2) Connected Displays Supported
(F1DN202MOD-BA-4, F1DN204MOD-BA-4, F1DN208MOD-
BA-4, F1DN202MOD-HH-4, F1DN202MOD-PP-4,
F1DN202MOD-DD-4, F1DN204MOD-HH-4, F1DN204MOD-
PP-4, F1DN208MOD-PP-4, F1DN204MOD-DD-4,
F1DN204MOD-XX-4)
FDP_CDS_EXT.1.1(2) The TSF shall support [multiple connected displays] at a time.
6.10.1.2 FDP_IPC_EXT.1(2) Internal Protocol Conversion
(F1DN104MOD-XX-4, F1DN204MOD-XX-4)
FDP_IPC_EXT.1.1(2) The TSF shall convert the [DisplayPort] protocol at the
[DisplayPort computer video interface] into the [HDMI] protocol
within the TOE.
FDP_IPC_EXT.1.2(2) The TSF shall output the [HDMI] protocol from inside the TOE to
[peripheral display interface(s)] as [ [HDMI] protocol].
6.10.1.3 FDP_PDC_EXT.3/VI(5) Authorized Connection
Protocols (Video Output) (F1DN204MOD-XX-4)
FDP_PDC_EXT.3.1/VI(5) The TSF shall have interfaces for the [DVI-D, HDMI,
DisplayPort, USB Type-C with DisplayPort as alternate
function ] protocols.
FDP_PDC_EXT.3.2/VI(5) The TSF shall apply the following rules to the supported
protocols: [the TSF shall read the connected display EDID
information once during power‐on or reboot].
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 64 of 81
6.10.1.4 FDP_SPR_EXT.1/DP Sub-Protocol Rules (DisplayPort
Protocol) (F1DN102MOD-PP-4, F1DN202MOD-PP-4,
F1DN104MOD-PP-4, F1DN108MOD-PP-4, F1DN204MOD-
PP-4, F1DN208MOD-PP-4, F1DN104MOD-XX-4,
F1DN204MOD-XX-4)
FDP_SPR_EXT.1.1/DP The TSF shall apply the following rules for the [DisplayPort]
protocol:
• block the following video/display sub‐protocols:
o [CEC,
o EDID from computer to display,
o HDCP,
o MCCS]
• allow the following video/display sub‐protocols:
o [EDID from display to computer,
o HPD from display to computer,
o Link Training].
6.10.1.5 FDP_SPR_EXT.1/HDMI Sub-Protocol Rules (HDMI
Protocol) (F1DN102MOD-BA-4, F1DN104MOD-BA-4,
F1DN202MOD-BA-4, F1DN204MOD-BA-4, F1DN108MOD-
BA-4, F1DN208MOD-BA-4, F1DN102MOD-HH-4,
F1DN202MOD-HH-4, F1DN104MOD-HH-4, F1DN204MOD-
HH-4, F1DN104MOD-XX-4, F1DN204MOD-XX-4)
FDP_SPR_EXT.1.1/HDMI The TSF shall apply the following rules for the [HDMI]
protocol:
• block the following video/display sub‐protocols:
o [ARC
o CEC,
o EDID from computer to display,
o HDCP,
o HEAC,
o HEC,
o MCCS]
• allow the following video/display sub‐protocols:
o [EDID from display to computer,
o HPD from display to computer].
6.10.1.6 FDP_SPR_EXT.1/USB Sub-Protocol Rules (USB-C
Protocol) (F1DN104MOD-XX-4, F1DN204MOD-XX-4)
FDP_SPR_EXT.1.1/USB-C The TSF shall apply the following rules for the [USB Type‐C
with DisplayPort as alternate function] protocol:
• block the following video/display sub‐protocols:
o [CEC,
o EDID from computer to display,
o HDCP,
o MCCS]
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 65 of 81
• allow the following video/display sub‐protocols:
o [EDID from display to computer,
o HPD from display to computer,
o Link Training].
6.10.1.7 FDP_SPR_EXT.1/DVI-D Sub-Protocol Rules (DVI-D
Protocol) (F1DN102MOD-DD-4, F1DN202MOD-DD-4,
F1DN104MOD-DD-4, F1DN204MOD-DD-4, F1DN204MOD-
XX-4)
FDP_SPR_EXT.1.1/DVI-D The TSF shall apply the following rules for the [DVI-D]
protocol:
• block the following video/display sub‐protocols:
o [ARC,
o CEC,
o EDID from computer to display,
o HDCP,
o HEAC,
o HEC,
o MCCS]
• allow the following video/display sub‐protocols:
o [EDID from display to computer,
o HPD from display to computer].
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 66 of 81
7 SECURITY ASSURANCE REQUIREMENTS
The assurance requirements are summarized in Table 23.
Assurance Class
Assurance Components
Identifier Name
Development (ADV) ADV_FSP.1 Basic Functional Specification
Guidance Documents
(AGD)
AGD_OPE.1 Operational user guidance
AGD_PRE.1 Preparative procedures
Life-Cycle Support
(ALC)
ALC_CMC.1 Labeling of the TOE
ALC_CMS.1 TOE CM5
Coverage
Security Target
Evaluation (ASE)
ASE_CCL.1 Conformance claims
ASE_ECD.1 Extended Components Definition
ASE_INT.1 ST Introduction
ASE_OBJ.2 Security Objectives
ASE_REQ.2 Derived Security Requirements
ASE_SPD.1 Security Problem Definition
ASE_TSS.1 TOE Summary Specification
Tests (ATE)
ATE_IND.1
Independent Testing -
Conformance
Vulnerability
Assessment (AVA)
AVA_VAN.1 Vulnerability Survey
Table 23 – Security Assurance Requirements
5
Configuration Management
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 67 of 81
8 SECURITY REQUIREMENTS RATIONALE
8.1 SECURITY FUNCTIONAL REQUIREMENTS
RATIONALE
Table 9 provides a mapping between the SFRs and Security Objectives.
8.2 DEPENDENCY RATIONALE
Table 24 identifies the Security Functional Requirements and their associated
dependencies. It also indicates whether the ST explicitly addresses each
dependency.
SFR Dependencies Rationale Statement
FDP_APC_EXT.1/KM None N/A
FDP_APC_EXT.1/VI None N/A
FDP_CDS_EXT.1(1) None N/A
FDP_CDS_EXT.1(2) None N/A
FDP_FIL_EXT.1/KM FDP_PDC_EXT.1 Included
FDP_IPC_EXT.1(1) FDP_PDC_EXT.2 Included
FDP_IPC_EXT.1(2) FDP_PDC_EXT.2 Included
FDP_PDC_EXT.1 None N/A
FDP_PDC_EXT.2/KM FDP_PDC_EXT.1 Included
FDP_PDC_EXT.2/VI FDP_PDC_EXT.2 Included
FDP_PDC_EXT.3/KM FDP_PDC_EXT.1 Included
FDP_PDC_EXT.3/VI(1) FDP_PDC_EXT.2 Included
FDP_PDC_EXT.3/VI(2) FDP_PDC_EXT.2 Included
FDP_PDC_EXT.3/VI(3) FDP_PDC_EXT.2 Included
FDP_PDC_EXT.3/VI(4) FDP_PDC_EXT.2 Included
FDP_PDC_EXT.3/VI(5) FDP_PDC_EXT.2 Included
FDP_RDR_EXT.1 FDP_PDC_EXT.1 Included
FDP_RIP_EXT.1 None N/A
FDP_RIP.1/KM None N/A
FDP_SPR_EXT.1/DP FDP_PDC_EXT.3 Included
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 68 of 81
SFR Dependencies Rationale Statement
FDP_SPR_EXT.1/DVI-D FDP_PDC_EXT.3 Included
FDP_SPR_EXT.1/HDMI FDP_PDC_EXT.3 Included
FDP_SPR_EXT.1/USB-C FDP_PDC_EXT.3 Included
FDP_SPR_EXT.1/VGA FDP_PDC_EXT.3 Included
FDP_SWI_EXT.1 None N/A
FDP_SWI_EXT.2 FDP_SWI_EXT.1 Included
FDP_SWI_EXT.3 FDP_SWI_EXT.1 Included
FDP_UDF_EXT.1/KM FDP_APC_EXT.1 Included
FDP_UDF_EXT.1/VI FDP_APC_EXT.1 Included
FPT_FLS_EXT.1 FPT_TST.1
FPT_PHP.3
Included
Included only if anti‐tamper is selected in
FPT_FLS_EXT.1.1
FPT_NTA_EXT.1 None N/A
FPT_PHP.1 None N/A
FPT_TST.1 None N/A
FPT_TST_EXT.1 FPT_TST.1 Included
FTA_CIN_EXT.1 FDP_APC_EXT.1 Included
Table 24 – Functional Requirement Dependencies
8.3 SECURITY ASSURANCE REQUIREMENTS
RATIONALE
The TOE assurance requirements for this ST consist of the requirements
indicated in the [PP_PSD_V4.0].
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 69 of 81
9 TOE SUMMARY SPECIFICATION
This section provides a description of the security functions and assurance
measures of the TOE that meet the TOE security requirements.
Unless otherwise stated, the description applies to all devices.
9.1 USER DATA PROTECTION
System Controller
Each device includes a System Controller which is responsible for device
management, user interaction, system control security functions, and device
monitoring. It receives user input from the switches on the front panel or from
the wired remote control, and drives the TOE channel select lines that control
switching circuits within the TOE.
The System Controller includes a microcontroller with internal non-volatile, Read
Only Memory (ROM). The controller function manages the TOE functionality
through a pre-programmed state machine loaded on the ROM as read-only
firmware during product manufacturing.
Following boot up of the TOE, the channel select lines are set to Channel 1 by
default. The channel select lines are also used to link the System Controller
channel select commands to the Field Programmable Gate Array (FPGA) that
supports video processing.
The user determines which host computer is to be connected to the peripherals
by pressing a button on the TOE front panel, or by selecting a channel on the
remote control. The remote control for the Modular Secure KVM Series units
(see Table 2) has push buttons on the left side of the keyboard. When the
remote control device is used, both the front panel button and the remote’s
channel indicator for the selected computer are illuminated. These are always
consistent. Switching can only be initiated through express user action.
KVM devices may be switched with peripheral devices using a guard6
. This is
done by moving the mouse to the edge of the screen while pressing the left
CTRL key.
TOE Security Functional Requirements addressed: FDP_SWI_EXT.1,
FDP_SWI_EXT.2.
6
See Section 10.1 or [PP_PSD_V4.0] for the definition of a guard.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 70 of 81
9.1.1.1 Active PSD Connections
The TOE ensures that data flows only between the peripherals and the
connected computer selected by the user. No data transits the TOE when the
TOE is powered off, or when the TOE is in a failure state. A failure state occurs
when the TOE fails a self-test when powering on, or when the anti-tampering
function has been triggered.
TOE Security Functional Requirements addressed: FDP_APC_EXT.1/KM,
FDP_APC_EXT.1/VI.
9.1.1.2 Connected Computer Interfaces
The connected computers are attached to the TOE as follows:
• The TOE connects to the keyboard and mouse port using a USB A to USB
B cable. The USB A end attaches to the computer, and the USB B end
attaches to the TOE.
• The TOE is connected to the computer video port using a video cable
supporting DisplayPort, HDMI, or DVI-D, VGA or a USB-Type C Display
Port interface. For DVI-D, VGA or USB-Type C connections, the cables
convert the protocol to HDMI for switching. The cables are considered to
be part of the TOE device.
TOE Security Functional Requirements addressed: FDP_PDC_EXT.1.
9.1.1.3 Residual Information Protection
The Letter of Volatility is included as Annex A.
TOE Security Functional Requirements addressed: FDP_RIP_EXT.1.
Keyboard and Mouse Functionality
9.1.2.1 Keyboard and Mouse Enumeration
The TOE determines whether or not a peripheral device that has been plugged
into the keyboard and mouse peripheral ports is allowed to operate with the
TOE. The TOE uses optical data diodes to enforce a unidirectional data flow from
the user peripherals to the coupled hosts, and uses isolated device emulators to
prevent data leakage through the peripheral switching circuitry.
The Static Random Access Memory (SRAM) in the host and device emulator
circuitry stores USB Host stack parameters and up to the last 4 key codes. User
data may be briefly retained; however, there are no data buffers. Data is erased
during power off of the KVM, and when the user switches channels. When the
TOE switches from one computer to another, the system controller ensures that
the keyboard and mouse stacks are deleted, and that any data received from
the keyboard in the first 100 milliseconds following switching is deleted. This is
done to ensure that any data buffered in the keyboard microcontroller is not
passed to the newly selected computer.
The TOE supports USB Type A HIDs on keyboard and mouse ports. The USB
bidirectional communication protocol is converted into a unidirectional
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 71 of 81
proprietary protocol, and is then converted back into the USB bidirectional
protocol to communicate with the coupled computer hosts.
A USB keyboard is connected to the TOE keyboard host emulator through the
console keyboard port. The keyboard host emulator is a microcontroller which
enumerates the connected keyboard and verifies that it is a permitted device
type. Once the keyboard has been verified, the USB keyboard sends scan codes,
which are generated when the user types. These scan codes are converted by
the keyboard host emulator into a proprietary protocol data stream that is
combined with the data stream from the mouse host emulator.
Similarly, the USB mouse is connected to the TOE mouse host emulator through
the USB mouse port. The mouse host emulator is a microcontroller which
enumerates the connected mouse and verifies that it is a permitted device type.
Once the mouse device has been verified, it sends serial data generated by
mouse movement and button use. The mouse serial data is converted by the
mouse host emulator into a proprietary protocol data stream that is combined
with the data stream from the keyboard host emulator.
TOE Security Functional Requirements addressed: FDP_PDC_EXT.3/KM,
FDP_UDF_EXT.1/KM, FDP_RIP.1/KM.
9.1.2.2 Keyboard and Mouse Switching Functionality
The combined data stream is passed through the channel select lines to the
selected host channel. The channel select lines are driven by the System
Controller Module, and the selection is based on user input through use of the
mouse or keyboard. Once a channel is selected, the combined mouse and
keyboard data stream is passed through an optical data diode and routed to the
specific host channel device emulator. The optical data diode is an opto-coupler
designed to physically prevent reverse data flow. The keyboard and mouse can
only be switched together.
Device emulators are USB enabled microcontrollers that are programmed to
emulate a standard USB keyboard and mouse composite device. The combined
data stream is converted back to bidirectional data before reaching the selected
host computer.
Since the keyboard and mouse function are emulated by the TOE, the connected
computer is not able to send data to the keyboard that would allow it to indicate
that Caps Lock, Num Lock or Scroll Lock are set. These are indicated on the TOE
front panel.
TOE Security Functional Requirements addressed: FDP_APC_EXT.1/KM,
FDP_UDF_EXT.1/KM, FDP_SWI_EXT.3.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 72 of 81
9.1.2.3 Keyboard and Mouse Compatible Device Types
The TOE employs fixed device filtering and accepts only USB HID devices at the
keyboard and mouse peripheral ports. Only USB Type A connections are
permitted. The TOE does not support a wireless connection to a mouse,
keyboard or USB hub.
TOE Security Functional Requirements addressed: FDP_PDC_EXT.1,
FDP_PDC_EXT.2/KM, FDP_FIL_EXT.1/KM.
9.1.2.4 Re-Enumeration Device Rejection
If a connected device attempts to re-enumerate as a different USB device type,
it will be rejected by the TOE.
TOE Security Functional Requirements addressed: FDP_RDR_EXT.1.
Video Switching Functionality
Video data flow is comprised of unidirectional Extended Display Identification
Data (EDID) and video data flow paths. Figure 3 shows a data flow during the
display EDID read function.
Figure 3 – Display EDID Read Function
An EDID read event only occurs as the TOE is being powered up. The video
controller reads the EDID content from the display device to verify that it is valid
and usable. If data is not valid, TOE operation will cease and wait for the display
peripheral to be changed.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 73 of 81
Figure 3 shows a data flow during the display EDID read function.
Figure 4 – Display EDID Write Function
Figure 4 illustrates the video controller (shown in blue) as it writes the EDID
content into the first channel emulated EDID Electrically Erasable Programmable
Read-Only Memory (EEPROM) chip (shown in gray). The thick lines in this figure
indicate native video lines, and the thin lines indicate Inter-Integrated Circuit
(I2C) lines. The EDID multiplexer couples the I2C lines to the first EDID mode
switch (shown in orange). The first EDID mode switch switches the video
controller I2C lines to the first emulated EDID EEPROM chip (shown in gray).
The chip write protect switch opens to enable writing. The video controller uses
the I2C lines to write to the first emulated EDID EEPROM chip. Once the write
operation is complete and verified, the video controller switches the EDID
multiplexer to the next channel and the operation repeats until all chips are
programmed. Once the write operation is complete, the video controller switches
to normal operating mode, as shown in Figure 5 below.
In EDID write mode, the Emulated EDID EEPROM chips are switched to their
respective computers to enable reading of the EDID information. The write
protect switches are switched back to protected mode to prevent any attempt to
write to the EEPROM or to transmit MCCS commands.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 74 of 81
Figure 5 – Display Normal Mode
In normal mode, each computer interface operates independently. The power to
each emulated EDID EEPROM is received from its respective computer through
the video cable. The main video multiplexer is switched to the user selected
computer to enable the proper video display.
During TOE normal operation (Figure 5), any attempt by a connected computer
to affect the EDID channel is blocked by the architecture. Each computer is only
able to affect its own emulated EDID EEPROM.
Video input interfaces are isolated from one another. Isolation is achieved
through the use of separate power and ground planes, separate electronic
components and a separate emulated EDID chip for each channel.
The EDID function is emulated by an independent emulation EEPROM chip for
each computer channel. These chips read content from the connected display
once during TOE power up. Any subsequent change to the display peripheral will
be ignored.
The TOE will reject any display device that does not present valid EDID content.
An LED on the rear panel of the TOE will indicate a rejected display device.
The TOE supports DisplayPort versions 1.1, 1.2 and 1.3, HDMI 2.0, DVI-D, USB-
C and VGA connections:
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 75 of 81
• For DisplayPort connections, the TOE video function filters the AUX
channel by converting it to I2C EDID only. DisplayPort video is converted
into an HDMI video stream, and the I2C EDID lines connected to the
emulated EDID EEPROM functions as shown in the figures above. This
allows EDID to be passed from the display to the computer (as described
above), and allows Hot-Plug Detection (HPD) and Link Training
information to pass through the TOE. AUX channel threats are mitigated
through the conversion from DisplayPort to HDMI protocols. Traffic types
including USB, Ethernet, MCCS, and EDID write from the computer to the
display are blocked by the TOE. High-bandwidth Digital Content Protection
(HDCP) and Consumer Electronics Control (CEC) functions are not
connected.
o DisplayPort input is supported on the F1DN102MOD-PP-4,
F1DN202MOD-PP-4, F1DN104MOD-PP-4, F1DN108MOD-PP-4,
F1DN204MOD-PP-4, F1DN208MOD-PP-4, F1DN104MOD-XX-4 and
F1DN204MOD-XX-4 devices.
o DisplayPort peripherals are supported by the F1DN102MOD-PP-4,
F1DN202MOD-PP-4, F1DN104MOD-PP-4, F1DN108MOD-PP-4,
F1DN204MOD-PP-4 and F1DN208MOD-PP-4 devices.
• For DVI-D connections, EDID information is allowed to pass from the
display to the computer, as described above. HPD information is also
allowed to pass. Other protocols, including Audio Return Channel (ARC),
EDID from the computer to the display, HDMI Ethernet and Audio Return
Channel (HEAC), HDMI Ethernet Channel (HEC) and MCCS are blocked.
HDCP and Consumer Electronics Control (CEC) functions are not
connected.
o The DVI-D protocol is supported on the F1DN102MOD-DD-4,
F1DN202MOD-DD-4, F1DN104MOD-DD-4, F1DN204MOD-DD-4 and
F1DN204MOD-XX-4 devices for both input and peripheral devices.
• For HDMI connections, EDID information is allowed to pass from the
display to the computer, as described above. HPD information is also
allowed to pass. Other protocols, including Audio Return Channel (ARC),
EDID from the computer to the display, HDMI Ethernet and Audio Return
Channel (HEAC), and HDMI Ethernet Channel (HEC) are blocked. HDCP
and Consumer Electronics Control (CEC) functions are not connected.
o The HDMI protocol is supported on the F1DN102MOD-BA-4,
F1DN104MOD-BA-4, F1DN202MOD-BA-4, F1DN204MOD-BA-4,
F1DN108MOD-BA-4, F1DN208MOD-BA-4, F1DN102MOD-HH-4,
F1DN202MOD-HH-4, F1DN104MOD-HH-4, F1DN204MOD-HH-4,
F1DN104MOD-XX-4 and F1DN204MOD-XX-4 devices for both input
and peripheral devices.
• For USB-C connections, EDID information is allowed to pass from the
display to the computer, as described above. HPD information and Link
Training are also allowed to pass. Other protocols, including EDID from
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 76 of 81
the computer to the display, and MCCS are blocked. HDCP and Consumer
Electronics Control (CEC) functions are not connected.
o USB Type C with DisplayPort as an alternate function is supported
for video input on the F1DN104MOD-XX-4 and F1DN204MOD-XX-4
devices.
• For VGA connections, EDID information is allowed to pass from the display
to the computer, as described above. Other protocols, including EDID
from the computer to the display, and MCCS are blocked.
o VGA input is supported for video input on the F1DN104MOD-XX-4
device.
The TOE video function blocks MCCS write transactions through the emulated
EDID EEPROMs. The emulated EEPROMs support only EDID read transactions,
and are isolated by the write protect switch.
Following a failed self-test, or when the TOE is powered off, all video input
signals are isolated from other video inputs and from the video output interfaces
by the active video re-drivers. Emulated EDID EEPROMs may still operate since
they are powered by their respective computers; however, the video function
remains isolated.
TOE Security Functional Requirements addressed: FDP_IPC_EXT.1(1),
FDP_IPC_EXT.1(2), FDP_SPR_EXT.1/DP, FDP_SPR_EXT.1/DVI-D,
FDP_SPR_EXT.1/HDMI, FDP_SPR_EXT.1/USB-C, FDP_SPR_EXT.1/VGA.
9.1.3.1 Video Compatible Device Types
The TOE accepts any DisplayPort of HDMI display device at the video peripheral
ports. The TOE does not support a wireless connection to a video display.
The F1DN102MOD-BA-4, F1DN104MOD-BA-4, F1DN108MOD-BA-4,
F1DN208MOD-BA-4, F1DN102MOD-HH-4, F1DN102MOD-PP-4, F1DN102MOD-
DD-4, F1DN104MOD-HH-4, F1DN104MOD-PP-4, F1DN108MOD-PP-4,
F1DN104MOD-DD-4 and F1DN104MOD-XX-4 devices support a single display.
The F1DN202MOD-BA-4, F1DN204MOD-BA-4, F1DN208MOD-BA-4,
F1DN202MOD-HH-4, F1DN202MOD-PP-4, F1DN202MOD-DD-4, F1DN204MOD-
HH-4, F1DN204MOD-PP-4, F1DN208MOD-PP-4, F1DN204MOD-DD-4 and
F1DN204MOD-XX-4 devices support two displays.
TOE Security Functional Requirements addressed: FDP_PDC_EXT.1,
FDP_PDC_EXT.2/VI, FDP_PDC_EXT.3/VI, FDP_CDS_EXT.1(1),
FDP_CDS_EXT.1(2).
9.2 PROTECTION OF THE TSF
No Access to TOE
Connected computers do not have access to TOE firmware or memory, with the
exception of EDID data, which is accessible to connected computers from the
TOE.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 77 of 81
All of the TOE microcontrollers run from internal protected flash memory.
Firmware cannot be updated from an external source. Firmware cannot be read
or rewritten through the use of Joint Test Action Group (JTAG) tools. Firmware is
executed on Static Random Access Memory (SRAM) with the appropriate
protections to prevent external access and tampering of code or stacks.
TOE Security Functional Requirements addressed: FPT_NTA_EXT.1.
Anti-tampering Functionality
The TOE enclosure was designed specifically to prevent physical tampering. It
features a stainless-steel welded chassis and panels that prevent external access
through bending or brute force.
Additionally, each device is fitted with one or more holographic Tampering
Evident Labels placed at critical locations on the TOE enclosure. If the label is
removed, the word ‘VOID’ appears on both the label and the product surface.
TOE Security Functional Requirements addressed: FPT_PHP.1.
TSF Testing
The TOE performs a self-test at initial start-up. The self-test runs independently
at each microcontroller and performs the following checks:
• Verification of the front panel push-buttons
• Verification of the integrity of the microcontroller firmware
• Verification of computer port isolation. This is tested by sending test
packets to various interfaces and attempting to detect this traffic at all
other interfaces
If the self-test fails, the Light Emitting Diodes (LEDs) on the front panel blink
and the device makes a clicking sound to indicate the failure. The TOE disables
the PSD switching functionality, and remains in a disabled state until the self-
test is rerun and passes. All self-test failures are recorded in the log file,
together with the date and time.
TOE Security Functional Requirements addressed: FPT_FLS_EXT.1, FPT_TST.1,
FPT_TST_EXT.1.
9.3 TOE ACCESS
Continuous Indications
The TOE user switches between computers by pressing the corresponding front
panel button on the device. The front panel button corresponding to the selected
computer will illuminate.
On power up, all peripherals are connected to channel #1, and the
corresponding push button LED will be illuminated.
TOE Security Functional Requirements addressed: FTA_CIN_EXT.1.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 78 of 81
Wired Remote Control
The remote control device for the Modular Secure KVM Series devices is built
into a custom keyboard, and acts as a wired remote control as described in the
[PP_PSD_V4.0].
When the user selects a channel using the remote control keyboard, the selected
channel indicator on the left side of the remote control devices illuminates, and
a signal is sent from the wired remote control device to the KVM switch. The
corresponding channel on the switch also illuminates and the TOE peripheral
sharing device switches to the indicated channel.
Additionally, a holographic Tampering Evident Label is placed at a critical
location on the remote control device. If the label is removed, the word ‘VOID’
appears on both the label and the product surface.
TOE Security Functional Requirements addressed: FTA_CIN_EXT.1, FPT_PHP.1.
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 79 of 81
10TERMINOLOGY AND ACRONYMS
10.1 TERMINOLOGY
The following terminology is used in this ST:
Term Description
AUX AUX refers to the auxiliary channel, particularly as it applies to
the DisplayPort protocol.
Guard 'Guard' refers to a peripheral sharing device function that
requires multiple express user actions in order to switch
between connected computers using connected peripherals.
KM KM refers to the requirements for Keyboard/Mouse Devices.
VI VI refers to the requirements for Video/Display Devices.
Table 25 – Terminology
10.2 ACRONYMS
The following acronyms are used in this ST:
Acronym Definition
ARC Audio Return Channel
CC Common Criteria
CEC Consumer Electronics Control
CM Configuration Management
DE Device Emulator
DVI Digital Visual Interface
EDID Extended Display Identification Data
EEPROM Electrically Erasable Programmable Read-Only Memory
FPGA Field Programmable Gate Array
HDCP High-bandwidth Digital Content Protection
HDMI High-Definition Multimedia Interface
HE Host Emulator
HEAC HDMI Ethernet and Audio Return Channel
HEC HDMI Ethernet Channel
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 80 of 81
Acronym Definition
HID Human Interface Device
HPD Hot-Plug Detection
I2C Inter-Integrated Circuit
IT Information Technology
JTAG Joint Test Action Group
KVM Keyboard, Video, Mouse
LED Light Emitting Diode
MCCS Monitor Control Command Set
NIAP National Information Assurance Partnership
OTP One Time Programming
PP Protection Profile
PSD Peripheral Sharing Device
ROM Read Only Memory
SFR Security Functional Requirement
SRAM Static Random Access Memory
ST Security Target
TOE Target of Evaluation
TSF TOE Security Functionality
USB Universal Serial Bus
VGA Video Graphics Array
Table 26 – Acronyms
Belkin Peripheral Sharing Devices with
Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page 81 of 81
11REFERENCES
Identifier Title
[CC] Common Criteria for Information Technology Security
Evaluation –
• Part 1: Introduction and General Model, CCMB‐2017‐
04‐001, Version 3.1 Revision 5, April 2017
• Part 2: Security Functional Components, CCMB‐2017‐
04‐002, Version 3.1 Revision 5, April 2017
• Part 3: Security Assurance Components, CCMB‐2017‐
04‐003, Version 3.1 Revision 5, April 2017
[CEM] Common Methodology for Information Technology Security
Evaluation, Evaluation Methodology, CCMB‐2017‐04‐004,
Version 3.1 Revision 5, April 2017
[PP_PSD_V4.0] Protection Profile for Peripheral Sharing Device, Version: 4.0,
2019‐07‐19
[MOD_KM_V1.0] PP‐Module for Keyboard/Mouse Devices, Version 1.0
[MOD_VI_1.0] PP‐Module for Video/Display Devices, Version 1.0
[CFG_PSD‐KM‐
VI_V1.0]
PP‐Configuration for Peripheral Sharing Device,
Keyboard/Mouse Devices, and Video/Display Devices, 19 July
2019
Table 27 – References
Belkin Peripheral Sharing Devices with Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page A-1 of A-2
ANNEX A – LETTER OF VOLATILITY
The table below provides volatility information and memory types for the Belkin Peripheral Sharing Devices. User
data is not retained in any TOE device when the power is turned off.
Product Models Number in each
product
Function,
Manufacturer
and Part
Number
Storage
Type
Size Power Source
(if not the
TOE)
Volatility Contains User Data
F1DN102MOD-BA-4
F1DN104MOD-BA-4
F1DN108MOD-BA-4
F1DN202MOD-BA-4
F1DN204MOD-BA-4
F1DN208MOD-BA-4
F1DN102MOD-HH-4
F1DN102MOD-PP-4
F1DN102MOD-DD-4
F1DN202MOD-HH-4
F1DN202MOD-PP-4
F1DN202MOD-DD-4
F1DN104MOD-HH-4
F1DN104MOD-PP-4
F1DN108MOD-PP-4
F1DN104MOD-DD-4
1 System
Controller, Host
emulators:
ST
Microelectronics
STM32F446ZCT
Embedded
SRAM1
128KB Volatile May contain user data
Embedded
Flash2
256KB Non-Volatile No user data
Embedded
EEPROM3
4KB Non-Volatile No user data
OTP Memory 512bytes Non-Volatile Event logs are saved
1 in Single head and
2 in Dual head
models
Video Controller:
ST
Microelectronics
STM32F070C6T6
Embedded
SRAM1
16KB Volatile No user data
Embedded
Flash2
128KB Non-Volatile No user data
Embedded
EEPROM3
4KB Non-Volatile No user data
2 in 2 port, 4 in 4
port or 8 in 8 port
models
Device
emulators:
ST
Microelectronics
STM32F070C6T6
Embedded
SRAM1
6KB Connected
computer
Volatile May contain user data
Embedded
Flash2
32KB Non-Volatile No user data
Embedded
EEPROM3
4KB Non-Volatile No user data
Belkin Peripheral Sharing Devices with Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page A-2 of A-2
Product Models Number in each
product
Function,
Manufacturer
and Part
Number
Storage
Type
Size Power Source
(if not the
TOE)
Volatility Contains User Data
F1DN204MOD-HH-4
F1DN204MOD-PP-4
F1DN208MOD-PP-4
F1DN204MOD-DD-4
F1DN104MOD-XX-4
F1DN204MOD-XX-4
2 in 2 port Single
head, 4 in 4 port
Single head and 2
port Dual head, 8 in
8 port Single head
and 4 port Dual head
and 16 in 8 port Dual
head
EDID Emulator:
ST
Microelectronics
M24C02-
WMN6TP
EEPROM4
2 KB Non-Volatile No user data
Notes:
1
SRAM stores USB Host stack parameters and up to the last 4 key-codes. Data is erased during power off of the KVM, and
when the user switches channels. Device emulators receive power from the individual connected computers and therefore
devices are powered on as long as the associated computer is powered on and connected.
2
Flash storage is used to store firmware code. It contains no user data. Flash storage is permanently locked by fuses after
initial programming to prevent rewriting. It is an integral part of the ST Microcontroller together with SRAM and EEPROM.
3
EEPROM is used to store operational parameters, such as display Plug & Play. They contain no user data. These devices
receive power from the individual computers connected to the TOE, and therefore are powered on as long as the associated
computer is powered on and connected.
4
EEPROM is used to store operational parameters (display Plug & Play) and contains no user data.
Belkin Peripheral Sharing Devices with Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page B-1 of B-2
ANNEX B – SFR DEVICE MATRIX
Table 28 indicates the SFRs supported by each device.
FDP_APC_EXT.1/KM
FDP_APC_EXT.1/VI
FDP_CDS_EXT.1(1)
FDP_CDS_EXT.1(2)
FDP_FIL_EXT.1/KM
FDP_IPC_EXT.1(1)
FDP_IPC_EXT.1(2)
FDP_PDC_EXT.1
FDP_PDC_EXT.2/KM
FDP_PDC_EXT.2/VI
FDP_PDC_EXT.3/KM
FDP_PDC_EXT.3/VI
FDP_RDR_EXT.1
FDP_RIP_EXT.1
FDP_RIP.1/KM
FDP_SPR_EXT.1/DP
FDP_SPR_EXT.1/DVI-D
FDP_SPR_EXT.1/HDMI
FDP_SPR_EXT.1/USB
FDP_SPR_EXT.1/VGA
FDP_SWI_EXT.1
FDP_SWI_EXT.2
FDP_SWI_EXT.3
FDP_UDF_EXT.1/KM
FDP_UDF_EXT.1/VI
FPT_FLS_EXT.1
FPT_NTA_EXT.1
FPT_PHP.1
FPT_TST.1
FPT_TST_EXT.1
FTA_CIN_EXT.1
F1DN102MOD-BA-4 X X X X X X X X X X X X X X X X X X X X X X X X
F1DN104MOD-BA-4 X X X X X X X X X X X X X X X X X X X X X X X X
F1DN108MOD-BA-4 X X X X X X X X X X X X X X X X X X X X X X X X
F1DN202MOD-BA-4 X X X X X X X X X X X X X X X X X X X X X X X X
F1DN204MOD-BA-4 X X X X X X X X X X X X X X X X X X X X X X X X
F1DN208MOD-BA-4 X X X X X X X X X X X X X X X X X X X X X X X X
F1DN102MOD-HH-4 X X X X X X X X X X X X X X X X X X X X X X X X
F1DN102MOD-PP-4 X X X X X X X X X X X X X X X X X X X X X X X X X
F1DN102MOD-DD-4 X X X X X X X X X X X X X X X X X X X X X X X X
F1DN202MOD-HH-4 X X X X X X X X X X X X X X X X X X X X X X X X
F1DN202MOD-PP-4 X X X X X X X X X X X X X X X X X X X X X X X X X
F1DN202MOD-DD-4 X X X X X X X X X X X X X X X X X X X X X X X X
F1DN104MOD-HH-4 X X X X X X X X X X X X X X X X X X X X X X X X
Belkin Peripheral Sharing Devices with Keyboard, Video, Mouse
Security Target
Doc No: 2149-001-D102B2 Version: 1.6 Date: 8 July 2021 Page B-2 of B-2
FDP_APC_EXT.1/KM
FDP_APC_EXT.1/VI
FDP_CDS_EXT.1(1)
FDP_CDS_EXT.1(2)
FDP_FIL_EXT.1/KM
FDP_IPC_EXT.1(1)
FDP_IPC_EXT.1(2)
FDP_PDC_EXT.1
FDP_PDC_EXT.2/KM
FDP_PDC_EXT.2/VI
FDP_PDC_EXT.3/KM
FDP_PDC_EXT.3/VI
FDP_RDR_EXT.1
FDP_RIP_EXT.1
FDP_RIP.1/KM
FDP_SPR_EXT.1/DP
FDP_SPR_EXT.1/DVI-D
FDP_SPR_EXT.1/HDMI
FDP_SPR_EXT.1/USB
FDP_SPR_EXT.1/VGA
FDP_SWI_EXT.1
FDP_SWI_EXT.2
FDP_SWI_EXT.3
FDP_UDF_EXT.1/KM
FDP_UDF_EXT.1/VI
FPT_FLS_EXT.1
FPT_NTA_EXT.1
FPT_PHP.1
FPT_TST.1
FPT_TST_EXT.1
FTA_CIN_EXT.1
F1DN104MOD-PP-4 X X X X X X X X X X X X X X X X X X X X X X X X X
F1DN108MOD-PP-4 X X X X X X X X X X X X X X X X X X X X X X X X X
F1DN104MOD-DD-4 X X X X X X X X X X X X X X X X X X X X X X X X
F1DN204MOD-HH-4 X X X X X X X X X X X X X X X X X X X X X X X X
F1DN204MOD-PP-4 X X X X X X X X X X X X X X X X X X X X X X X X X
F1DN208MOD-PP-4 X X X X X X X X X X X X X X X X X X X X X X X X X
F1DN204MOD-DD-4 X X X X X X X X X X X X X X X X X X X X X X X X
F1DN104MOD-XX-4 X X X X X X X X X X X X X X X X X X X X X X X X X X X X
F1DN204MOD-XX-4 X X X X X X X X X X X X X X X X X X X X X X X X X X X X
F1DN008KBD* X X X X X
Table 28 – Security Functional Requirements and Devices
*When used with another TOE device, the Belkin 2-4-8 Port Secure KVM USB Keyboard W/Lighting, F1DN008KBD
contributes to the enforcement of the specified SFRs. This device is only used with another TOE device.