KECS-CR-25-13
Korean National Protection Profile for
Database Encryption V3.1
Certification Report
Certification No.: KECS-PP-1350-2025
2025. 6. 27.
IT Security Certification Center
Certification Report Page 2
History of Creation and Revision
No. Date
Revised
Pages
Description
00 2025. 6. 27. -
Certification report for Korean National Protection
Profile for Database Encryption V3.1
- First documentation
Certification Report Page 3
This document is the certification report for Korean National Protection
Profile for Database Encryption V3.1 of National Security Research
Institute (NSR).
The Certification Body
IT Security Certification Center (ITSCC)
The Evaluation Facility
Korea Security Evaluation Laboratory Co., Ltd. (KSEL)
Certification Report Page 4
Table of Contents
Certification Report ....................................................................................................1
1. Executive Summary.............................................................................................5
2. Identification.........................................................................................................8
3. Security Policy .....................................................................................................9
4. Assumptions and Clarification of Scope............................................................9
5. Results of the Evaluation ....................................................................................9
5.1 Protection Profile Evaluation (APE) ........................................................10
5.2 Evaluation Result Summary ...................................................................10
6. Recommendations............................................................................................. 11
7. Acronyms and Glossary.................................................................................... 11
8. Bibliography....................................................................................................... 11
Certification Report Page 5
1. Executive Summary
This report describes the certification result drawn by the certification body on the
results of the APE evaluation of Korean National Protection Profile for Database
Encryption V3.1 (“PP” hereinafter) [1] with reference to the Common Criteria for
Information Technology Security Evaluation (“CC” hereinafter) [2]. It describes the
evaluation result and its soundness and conformity. The authors of the PP [1] are
National Security Research Institute (NSR).
The Target of Evaluation (TOE) in the PP [1] is Database Encryption designed to
prevent the unauthorized disclosure of confidential information by encrypting the
database. Also, the TOE shall provide a variety of security features: security audit, the
identification and authentication including mutual authentication between TOE
components, security management, the TOE access session management, and the
TSF protection function, etc. These TOE Security Functional Requirements (SFRs) are
outlined in the PP [1].
The evaluation of the PP [1] has been carried out by Korea Security Evaluation
Laboratory Co., Ltd. (KSEL) and completed on 10 Oct 2024. This report grounds on the
evaluation technical report (ETR) KSEL had submitted [6]. The evaluation of the PP [1]
was performed in accordance with the APE (Protection Profile Evaluation)
requirements in CC Part 3 and the Common Methodology for Information Technology
Security Evaluation (“CEM” hereinafter) [3].
The PP [1] does not claim conformance to any other Protection Profile. All Security
Assurance Requirements (SARs) in the PP [1] are based only upon assurance
component in CC Part 3, and the assurance package is EAL1 augmented by
ATE_FUN.1. Therefore, the PP [1] is CC Part 3 conformant. The Security Functional
Requirements (SFRs) are based upon both functional components in CC Part 2 and
newly defined components in the Extended component definition chapter of the PP [1].
Therefore, the PP [1] is CC Part 2 extended. The PP [1] requires strict conformance.
The operational environment of the Database Encryption is as shown in in [Figure 1],
[Figure 2], [Figure 3], and [Figure 4].
Certification Report Page 6
[Figure 1] Operational environment of Database Encryption (1)
[Figure 2] Operational environment of Database Encryption (2)
Certification Report Page 7
[Figure 3] Operational environment of Database Encryption (3)
[Figure 4] Operational environment of Database Encryption (4)
Certification Report Page 8
Certification Validity: The certificate is not an endorsement of the Protection Profile by
ITSCC or by any other organization that recognizes or gives effect to this certificate,
and no warranty of the Protection Profile by ITSCC or by any other organization
recognizes or gives effect to the certificate, is either expressed or implied.
2. Identification
[Table 1] summarizes identification information for scheme, developer, sponsor,
evaluation facility, certification body, etc.
Scheme Korea IT Security Evaluation and Certification
(Ministry of Science and ICT Guidance No. 2022-
61)
Korea IT Security Evaluation and Certification
Regulation (Ministry of Science and ICT·ITSCC,
May 17, 2021)
Name and Version of the
Certified Protection Profile
Korean National Protection Profile for Database
Encryption V3.1
Common Criteria Common Criteria for Information Technology
Security Evaluation, CC:2022 Revision 1, CCMB-
2022-11-001 ~ CCMB-2022-11-005, November
2022
Errata and Interpretation for CC:2022 (Release 1)
and CEM:2022 (Release 1), Version 1.1, CCMB-
2024-07-002, July, 2024
Common Methodology Common Methodology for Information Technology
Security Evaluation, CC:2022 Revision 1, CCMB-
2022-11-006, November 2022
Errata and Interpretation for CC:2022 (Release 1)
and CEM:2022 (Release 1), Version 1.1, CCMB-
2024-07-002, July, 2024
EAL EAL1+
(augmented by ATE_FUN.1)
Developer National Security Research Institute (NSR)
Sponsor National Security Research Institute (NSR)
Certification Report Page 9
Evaluation Facility Korea Security Evaluation Laboratory (KSEL)
Completion Date of Evaluation 10 Oct 2024
Certification No. KECS-PP-1350-2025
Certification Body IT Security Certification Center (ITSCC)
[Table 1] Identification information
3. Security Policy
The PP shall comply with the following Organizational Security Policies. Refer to the
PP chapter 3.3 for details.
- P.AUDIT
- P.SECURE_OPERATION
- P.CRYPTO_STRENGTH
4. Assumptions and Clarification of Scope
The TOE defined in the PP [1] is the Database Encryption. The TOE of the PP shall be
installed and operated with the following assumptions in consideration. Refer to the PP
chapter 3.4 for details.
- A.PHYSICAL_CONTROL
- A.TRUSTED_ADMIN
- A.SECURE_DEVELOPMENT
- A.OPERATION_SYSTEM_REINFORCEMENT
5. Results of the Evaluation
The PP [1] claims EAL1+ (ATE_FUN.1). The evaluation facility provided the evaluation
result in the ETR [6] which references a Single Evaluation Report for APE requirements
and Observation Reports. The evaluation result was based on the CC [2] and CEM [3].
As a result of the evaluation, the verdict PASS is assigned to all assurance
components of APE.
Certification Report Page 10
5.1 Protection Profile Evaluation (APE)
The PP Introduction correctly identifies the PP, and the PP reference and the TOE
overview are consistent with each other. Therefore, the verdict PASS is assigned to
APE_INT.1.
The Conformance Claim properly describes how the PP conforms to the CC and
packages. Therefore, the verdict PASS is assigned to APE_CCL.1.
The Security Problem Definition clearly defines the security problem intended to
addressed by TOE and its operational environment. Therefore, the verdict PASS is
assigned to APE_SPD.1
The Security Objectives for the operational environment from the PP is clearly defined.
Therefore, the verdict PASS is assigned to APE_OBJ.1.
The Extended Components Definition has been clearly and unambiguously defined,
and it is necessary. Therefore, the verdict PASS is assigned to APE_ECD.1.
The Security Requirements is defined clearly and unambiguously, and it is internally
consistent. Therefore, the verdict PASS is assigned to APE_REQ.1.
Thus, the PP is sound and internally consistent, and suitable to be used as the basis
for writing a direct rationale ST or another direct rationale PP.
The verdict PASS is assigned to the assurance class APE.
5.2 Evaluation Result Summary
Assurance
Class
Assurance
Component
Evaluator
Action
Elements
Verdict
Evaluator
Action
Elements
Assurance
Component
Assurance
Class
APE APE_INT.1 APE_INT.1.1E PASS PASS PASS
APE_CCL.1 APE_CCL.1.1E PASS PASS
APE_SPD.1 APE_SPD.1.1E PASS PASS
APE_OBJ.1 APE_OBJ.1.1E PASS PASS
APE_ECD.1 APE_ECD.1.1E PASS PASS
APE_ECD.1.2E PASS
APE_REQ.1 APE_REQ.1.1E PASS PASS
[Table 2] Evaluation Result Summary
Certification Report Page 11
6. Recommendations
The PP [1] defines the minimum security requirements for Database Encryption, and
requires an ST or another PP claiming this PP [1] to fulfill the CC requirements for strict
conformance. If the TOE defined in the ST which claims conformance to the PP [1]
implements additional security features, then it is strongly recommended the ST author
to define additional security functional requirements in accordance with the TOE
implementation.
7. Acronyms and Glossary
CC Common Criteria
EAL Evaluation Assurance Level
ETR Evaluation Technical Report
PP Protection Profile
SAR Security Assurance Requirement
SFR Security Functional Requirement
ST Security Target
TOE Target of Evaluation
TSF TOE Security Functionality
8. Bibliography
The certification body has used following documents to produce this report.
[1] Korean National Protection Profile for Database Encryption V3.1
[2] Common Criteria for Information Technology Security Evaluation, CC:2022
Revision 1, CCMB-2022-11-001 ~ CCMB-2022-11-005, November, 2022
Errata and Interpretation for CC:2022(Release 1) and CEM:2022(Release 1),
Version 1.1, CCMB-2024-07-002, July, 2024
[3] Common Methodology for Information Technology Security Evaluation,
CEM:2022 Revision 1, CCMB-2022-11-006, November, 2022
Errata and Interpretation for CC:2022(Release 1) and CEM:2022(Release 1),
Version 1.1, CCMB-2024-07-002, July, 2024
[4] Korea IT Security Evaluation and Certification Guidelines (Ministry of Science
Certification Report Page 12
and ICT Guidance No. 2022-61)
[5] Korea IT Security Evaluation and Certification Regulation (Ministry of Science
and ICT·ITSCC, May 17, 2021)
[6] Korean National Protection Profile for Database Encryption V3.1 Evaluation
Technical Report V1.00, 10 Oct 2024