Manuale d’uso / di manutenzione del prodotto 7.11 del fabbricante Nortel Networks
Vai alla pagina of 67
© 2008 Nortel Networks Nortel Net works VPN Router v7.0 5 and Client Workstation v7.11 Security Target Evaluation Assurance Level : EAL 4 + Document Versio n: 3.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 2 of 67 © 2008 Nortel Networks Revision Histor y Version Modification Date Modified By Description of Changes 1.0 2005 - 05 - 31 Kiran Kadambari Initial draft.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 3 of 67 © 2008 Nortel Networks Table of Contents REVISION HISTORY .................................................................................
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 4 of 67 © 2008 Nortel Networks 7 PROTECTION PROFI LE CLAIMS ................................................................ ......................
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 5 of 67 © 2008 Nortel Networks 1 Security T arget Introduction This section identifies the Security Target (ST), Target of Evaluatio n (T OE) identificatio n, ST conventions, ST conformance clai ms, and the ST organizatio n.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 6 of 67 © 2008 Nortel Networks Ke y w ords VPN, Router, Firewall, IPSec 1.3 Conven tions, A cronyms, and Terminology 1.3.1 Conventions There are several f ont variat ions used within this ST .
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 7 of 67 © 2008 Nortel Networks Term Explanation Manage Nortel VPN Router Grants administrative rights to view (monitor) and manage (configure) Nortel VPN Router configuration settings or user rights settings.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 8 of 67 © 2008 Nortel Networks 2 T OE Descripti on This section pro vides a general overview o f the TOE as an aid to understanding the general capabilities and security requirements provided b y the TOE .
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 9 of 67 © 2008 Nortel Networks mode, a No rtel VPN Rou ter on one Enterprise net work segment will establish a VPN tunnel with a nother Nortel VPN Ro uter on another Enterprise net w ork segment.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 10 of 67 © 2008 Nortel Networks Configuration of the T OE is performed via a Co mmand Line Interface ( CLI) by physicall y connecti ng a device (such as a laptop) to the serial interface of t he TOE and utilizing dumb-terminal software.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 11 of 67 © 2008 Nortel Networks In Figure 3 above, the T OE is installed at the boun dar y of the private (“Enterprise”) network a nd the p ublic (“Internet”) network .
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 12 of 67 © 2008 Nortel Networks Legend: TOE Boundary The World Enterprise Corporate Network Inte.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 13 of 67 © 2008 Nortel Networks Nortel VPN Router: E ach of the logical components contained within t he physical Nortel VPN Router ar e included within the TOE boundary.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 14 of 67 © 2008 Nortel Networks Nortel VPN Rou ters, as well as p roviding protection agai nst external attac k.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 15 of 67 © 2008 Nortel Networks 2.3.3 Excluded TOE Functionality The following prod uct features.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 16 of 67 © 2008 Nortel Networks 3 T OE Securi ty Environment This sectio n d escribes the security aspects of the environ ment in whic h t he TOE will be us ed and the manner i n which the TOE is expected to b e employed.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 17 of 67 © 2008 Nortel Networks Attackers w ho a re no t TOE users: T hese attackers have no kno.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 18 of 67 © 2008 Nortel Networks 4 Security Objectives This section identifie s the security objectives for the T OE and its supp orting environ m ent .
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 19 of 67 © 2008 Nortel Networks 4.2 Security Objectives for the Env ironment 4.2.1 IT Security Objectives The following IT security objectives are to be satisfied b y the environment: OE.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 20 of 67 © 2008 Nortel Networks 5 IT Securit y Req uirement s This section d efines the Sec urity F unctional Requirements (SFRs) and Security Assurance Req uirements (SARs) met by the T OE as well as SFRs met by the T OE IT environment.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 21 of 67 © 2008 Nortel Networks SFR ID Description ST Operation FMT_MSA.1(b) Management of Security Attributes FMT_MSA.1(c) Management of Security Attributes FMT_MSA.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 22 of 67 © 2008 Nortel Networks 5.1.1 Class FAU: Security A udit FAU_GEN.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 23 of 67 © 2008 Nortel Networks The TSF shall provide the a udit records in a manner suitable for the user to interpret the information. Dependencies: FAU_GEN.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 24 of 67 © 2008 Nortel Networks 5.1.2 Class FCS: Cryptographic Support FCS_CKM.1(a) Cryptographic key generation (Diffie-Hellman) Hierarchical to : No other components.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 25 of 67 © 2008 Nortel Networks FCS_COP.1.1 (a) The T SF shall perform [ encry ption and decrypt.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 26 of 67 © 2008 Nortel Networks Dependencies: [FDP_ITC.1 Import of user data without security a ttributes, or FDP_ITC.2 Import of user data with security attributes, or FCS_CKM .
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 27 of 67 © 2008 Nortel Networks 5.1.3 Class FDP: User Data Protection FDP_ACC.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 28 of 67 © 2008 Nortel Networks The TSF shall enforce the [ VPN Information Flow Con trol SFP ] .
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 29 of 67 © 2008 Nortel Networks FDP_IFF.1. 3(a) The TSF shall enforce t he [ none ]. FDP_IFF.1.4 (a) The TSF shall provide the following [ sta teful Firewall, Network Ad dress Translation (NAT), IPS ec ].
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 30 of 67 © 2008 Nortel Networks Dependencies: FDP_IFC.1 Subset infor mation flow control FMT_M SA.3 Static attribute initialisation FDP_UCT.1 Basic data exchange confidentiality Hierarchical to : No other components.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 31 of 67 © 2008 Nortel Networks 5.1.4 Class FI A : Identification and Authentication FIA_UAU.1 Timing of authentication Hierarchical to : No other components.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 32 of 67 © 2008 Nortel Networks The TSF shall require ea ch user to identif y itself be fore allowing any other 4 TSF-med iated actions on behalf of that user.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 33 of 67 © 2008 Nortel Networks 5.1.5 Class FMT: Security Management FMT_MOF.1(a) Management of security functions behaviour Hierarchical to : No other components.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 34 of 67 © 2008 Nortel Networks Dependencies: [FDP_ACC.1 Subset a ccess control or FDP_IFC.1 Subset infor mation flow control] FMT_SM F.1 Specification of m anage m ent functio ns FMT_SM R.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 35 of 67 © 2008 Nortel Networks FMT_MSA.3(b) Static attribute initialisation Hierarchical to : No other components.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 36 of 67 © 2008 Nortel Networks The TSF shall maintai n the roles [ Primary Admin, Restricted Ad min, VPN Us er ]. FMT_SM R.1.2 The TSF shall be able to associate users with roles.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 37 of 67 © 2008 Nortel Networks 5.1.6 Class FPT: Protection of the TSF FPT_AMT.1 Abstract machine testing Hierarchical to : No other components. FPT_AMT.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 38 of 67 © 2008 Nortel Networks 5.1.7 Class FTP: Trusted Path/Channels FTP_TRP.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 39 of 67 © 2008 Nortel Networks 5.2 Security Functional Requiremen ts on the IT Environmen t The T OE has the following se curity requirement for its IT environment.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 40 of 67 © 2008 Nortel Networks The TSF TOE Env ironment shall be able to provide reliable time stamps for it’s the TO E’s own use.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 41 of 67 © 2008 Nortel Networks 5.3 A ssurance Requirements This section defines the assur ance requirements for the TOE. The assurance requ irements are taken fro m Part 3 of the CC and are EAL 4 augmented with ALC_F LR.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 42 of 67 © 2008 Nortel Networks 6 T OE Summar y Specif icatio n This section presents infor mation to detail how the TOE meets the functional a nd ass urance requirements described in previous sections of thi s ST.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 43 of 67 © 2008 Nortel Networks TOE Security Function SFR ID Description FMT_MSA.3(b) Static Attribute Initialization FMT_MSA.3(c) Static Attribute Initialization FMT_SMF.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 44 of 67 © 2008 Nortel Networks System Log The System Log records data about System eve nts which are considered significant enoug h to b e written to disk, including t hose displa y ed in the Conf ig uration and Sec urity logs.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 45 of 67 © 2008 Nortel Networks 6.1.2 Cryptographic Support The T OE ’s cr y ptograph ic functionalit y is provided by a FIPS 140 -2-validated cryptographic m odule.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 46 of 67 © 2008 Nortel Networks for reuse. T his ensures that the keys a re co m pletely destroyed before an y other pro cess might have ac cess to that memory location.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 47 of 67 © 2008 Nortel Networks VPN Information Flow Control SFP and Firewall Information Flow Control SFP: B oth S FPs e nforce a stateful Fire wall.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 48 of 67 © 2008 Nortel Networks functions. The VPN User has no acce ss to administrative functions and may only aut henticate to the Nortel VP N Router through the Nor tel VPN Client in order to access the private network.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 49 of 67 © 2008 Nortel Networks o Runs when a rando m number needs to be generated. Continuous RN G for Entropy Gathering : Verifi es that t he seed for the FIP S 182 -2 PRNG is not failing to a constant value.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 50 of 67 © 2008 Nortel Networks Assurance Component Assurance Measure ALC_DVS.1 Nortel Networks Virtual Private Network Router v7.05 Life Cycle Support ALC_FLR.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 51 of 67 © 2008 Nortel Networks 7 Protection Profile Claim s This section provides t he identification and justificatio n for any Protection Pr ofile conformance claims.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 52 of 67 © 2008 Nortel Networks 8 Rationale This section provides th e rationale for the selection o f the sec urity require m e nts, o bjectives, assumptions, and threats.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 53 of 67 © 2008 Nortel Networks T. AUTH- ERROR An authorized user may acc identally alter the co.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 54 of 67 © 2008 Nortel Networks TE.PHYSICAL An attacker may physicall y attack the Ha rdware appliance in o rder to co m pro m ise its secure operation.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 55 of 67 © 2008 Nortel Networks This may mean t he environ ment pro vides a co nnection to a trusted Certificate Autho rity, or that the required certificates are o therwise av ailable to the TO E.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 56 of 67 © 2008 Nortel Networks Table 12 - Rel ationship of Securit y Requirements to Objectiv es Objectives Requirements O.I&A O.AUDIT O.SELFPROTECT O.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 57 of 67 © 2008 Nortel Networks Objectives Requirements O.I&A O.AUDIT O.SELFPROTECT O.CONFIDENT O.FUNCTIONS O.ADMIN O.INTEGRITY O.REPLAY O.FILTER O.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 58 of 67 © 2008 Nortel Networks required to us e SH A-1 and i t must b e implemented acco rding to RFC 3 174 [ FCS_CKM.1(a) , FCS_CKM.4, and FCS_ COP.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 59 of 67 © 2008 Nortel Networks The TSF is required to perfo rm security management functions such as create users and assign roles to users [FMT_SMF.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 60 of 67 © 2008 Nortel Networks authorized users with t he ability to verify the integrit y of TSF Data and T SF executable co de [FPT_AMT. 1 and FPT_TST.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 61 of 67 © 2008 Nortel Networks SFR ID Dependencies Dependency Met FCS.CKM.4 FCS_CKM.1(a) FMT_MSA.2 FCS_COP.1 FCS_CKM.1(a) FCS_CKM.4 F MT _MSA.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 62 of 67 © 2008 Nortel Networks SFR ID Dependencies Dependency Met FPT_TST.1 FPT_AMT.1 FTP_TRP.1 [n one] 8.6 TOE Summary Specification Ration ale 8.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 63 of 67 © 2008 Nortel Networks 8.6.2 TOE Summary Spe cification Rationale for the Security Assurance Requirements 8.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 64 of 67 © 2008 Nortel Networks Corresponding CC Ass urance Components: Functional Specification.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 65 of 67 © 2008 Nortel Networks Corresponding CC Ass urance Components: Analysis of Coverage High-Level Design Functional Testing Independent Testing 8.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 66 of 67 © 2008 Nortel Networks 9 Acronyms Table 15 - Acronyms Ac ron y m Definition 3DES Triple.
Security Target, Version 3.9 March 18, 2008 Nortel VPN Router v7.05 and Client W orkstation v7.11 Page 67 of 67 © 2008 Nortel Networks Ac ron y m Definition SHA Secure Hash Algorithm SOF Strength of .
Un punto importante, dopo l’acquisto del dispositivo (o anche prima di acquisto) è quello di leggere il manuale. Dobbiamo farlo per diversi motivi semplici:
Se non hai ancora comprato il Nortel Networks 7.11 è un buon momento per familiarizzare con i dati di base del prodotto. Prime consultare le pagine iniziali del manuale d’uso, che si trova al di sopra. Dovresti trovare lì i dati tecnici più importanti del Nortel Networks 7.11 - in questo modo è possibile verificare se l’apparecchio soddisfa le tue esigenze. Esplorando le pagine segenti del manuali d’uso Nortel Networks 7.11 imparerai tutte le caratteristiche del prodotto e le informazioni sul suo funzionamento. Le informazioni sul Nortel Networks 7.11 ti aiuteranno sicuramente a prendere una decisione relativa all’acquisto.
In una situazione in cui hai già il Nortel Networks 7.11, ma non hai ancora letto il manuale d’uso, dovresti farlo per le ragioni sopra descritte. Saprai quindi se hai correttamente usato le funzioni disponibili, e se hai commesso errori che possono ridurre la durata di vita del Nortel Networks 7.11.
Tuttavia, uno dei ruoli più importanti per l’utente svolti dal manuale d’uso è quello di aiutare a risolvere i problemi con il Nortel Networks 7.11. Quasi sempre, ci troverai Troubleshooting, cioè i guasti più frequenti e malfunzionamenti del dispositivo Nortel Networks 7.11 insieme con le istruzioni su come risolverli. Anche se non si riesci a risolvere il problema, il manuale d’uso ti mostrerà il percorso di ulteriori procedimenti – il contatto con il centro servizio clienti o il servizio più vicino.