Version | Date | Comment |
---|---|---|
1.0 | 2013-10-21 | Initial Release |
1.1 | 2014-01-12 | Typographical changes and additional clarifications in application notes. Removed assignment from FCS_TLS_EXT.1 and limited testing to those ciphersuites in both FCS_TLS_EXT.1 and FCS_TLS_EXT.2. |
2.0 | 2015-09-14 | Included changes based on Technical Rapid Response Team Decisions. Clarified many
requirements and assurance activities. Mandated objective requirements:
Included hardware-isolated REK and key storage selections. Allowed key derivation by REK. Clarified FTP_ITC_EXT.1 and added FDP_UPC_EXT.1. Mandated HTTPS and TLS for application use. (FDP_UPC_EXT.1) Removed Dual_EC_DRBG as an approved DRBG. Adopted new TLS requirements. Mandated TSF Wipe upon authentication failure limit and required number of authentication failures be maintained across reboot. Clarified Management Class. Included more domain isolation discussion and tests. Updated Audit requirements and added Auditable Events table. Added SFR Category Mapping Table. Updated Use Case Templates. Moved Glossary to Introduction. |
3.0 | 2015-09-17 | Included changes based on Technical Rapid Response Team Decisions. Clarified many requirements and assurance activities. Mandated objective requirements:
Added SFRs to support BYOD Use Case BYOD Use Case Updated key destruction SFR |
3.1 | 2017-04-05 | Included changes based on Technical Rapid Response Team Decisions and incorporated
Technical Decisions. Modified biometric requirements:
FCS_STG_EXT.2.2 - Modified to require long term trusted channel key material be encrypted by an approved method. FIA_UAU_EXT.1.1 - Modified to allow the long term trusted channel key material to be available prior to password being entered at start-up. |
3.2 | 2021-04-15 | Removed TLS SFRs and utilized TLS Functional Package Removed Bluetooth SFRs and utilized Bluetooth Module. Bluetooth SFR moved to Implementation Dependent. FPT_TUD_EXT.2.4 renumbered to FPT_TUD_EXT.3.1. FPT_TUD_EXT.3 renumbered to FPT_TUD_EXT.4. FPT_TUD_EXT.4.1 renumbered to FPT_TUD_EXT.5.1. FPT_TUD_EXT.4.2 renumbered to FPT_TUD_EXT.6.1. |
3.3 | 2022-09-12 |
Integrated Biometrics cPP Module, Included changes based on Technical Rapid Response
Team Decisions and open issues from GitHub.
|
3.4 | 2024-09-06 |
|
Assurance | Grounds for confidence that a TOE meets the SFRs [CC]. |
Base Protection Profile (Base-PP) | Protection Profile used as a basis to build a PP-Configuration. |
Collaborative Protection Profile (cPP) | A Protection Profile developed by international technical communities and approved by multiple schemes. |
Common Criteria (CC) | Common Criteria for Information Technology Security Evaluation (International Standard ISO/IEC 15408). |
Common Criteria Testing Laboratory | Within the context of the Common Criteria Evaluation and Validation Scheme (CCEVS), an IT security evaluation facility accredited by the National Voluntary Laboratory Accreditation Program (NVLAP) and approved by the NIAP Validation Body to conduct Common Criteria-based evaluations. |
Common Evaluation Methodology (CEM) | Common Evaluation Methodology for Information Technology Security Evaluation. |
Distributed TOE | A TOE composed of multiple components operating as a logical whole. |
Extended Package (EP) | A deprecated document form for collecting SFRs that implement a particular protocol, technology, or functionality. See Functional Packages. |
Functional Package (FP) | A document that collects SFRs for a particular protocol, technology, or functionality. |
Operational Environment (OE) | Hardware and software that are outside the TOE boundary that support the TOE functionality and security policy. |
Protection Profile (PP) | An implementation-independent set of security requirements for a category of products. |
Protection Profile Configuration (PP-Configuration) | A comprehensive set of security requirements for a product type that consists of at least one Base-PP and at least one PP-Module. |
Protection Profile Module (PP-Module) | An implementation-independent statement of security needs for a TOE type complementary to one or more Base-PPs. |
Security Assurance Requirement (SAR) | A requirement to assure the security of the TOE. |
Security Functional Requirement (SFR) | A requirement for security enforcement by the TOE. |
Security Target (ST) | A set of implementation-dependent security requirements for a specific product. |
Target of Evaluation (TOE) | The product under evaluation. |
TOE Security Functionality (TSF) | The security functionality of the product under evaluation. |
TOE Summary Specification (TSS) | A description of how a TOE satisfies the SFRs in an ST. |
Adaptive Template | A type of authentication template that evolves with each sample that is verified and introduced into the biometrics database or gallery. |
Address Space Layout Randomization (ASLR) | An anti-exploitation feature, which loads memory mappings into unpredictable locations. ASLR makes it more difficult for an attacker to redirect control to code that they have introduced into the address space of a process or the kernel. |
Administrator | The Administrator is responsible for management activities, including setting the policy that is applied by the enterprise on the Mobile Device. This administrator is likely to be acting remotely and could be the Mobile Device Management (MDM) Administrator acting through an MDM Agent. If the device is unenrolled, the user is the administrator. |
Authentication Template | A digital representation of an individual’s distinct characteristics, representing information extracted from a biometric sample. Such templates are used during biometric authentication and verification as the basis for comparison. Unlike enrollment templates, these templates can be adaptive. |
Auxiliary Boot Modes | Auxiliary boot modes are states in which the device provides power to one or more components to provide an interface that enables an unauthenticated user to interact with either a specific component or several components that exist outside of the device’s fully authenticated, operational state. |
Biometric Authentication Factor (BAF) | Authentication factor, which uses biometric sample, matched to a biometric authentication template to help establish identity. |
Biometric Data | Digital data created during a biometric process. It encompasses raw sensor observations, biometric samples, models, templates, and/or similarity scores, among other data. This data is used to describe the information collected during an enrollment, verification, or identification process, but does not apply to end user information such as user name, password (unless tied to the biometric modality), demographic information, and authorizations. |
Biometric Sample | Information or computer data obtained from a biometric sensor device or captured from an individual to the sensor. |
Biometric System | Multiple individual components (such as sensor, matching
algorithm, and result display) that combine to make a fully operational system completely
contained within the TOE. A biometric system is automated and capable of:
|
Common Application Developer | Application developers (or software companies) often produce many applications under the same name. Mobile devices often allow shared resources by such applications where otherwise resources would not be shared. |
Critical Security Parameter (CSP) | Security-related information whose disclosure or modification can compromise the security of a cryptographic module and/or authentication system. |
Data | Program/application or data files that are stored or transmitted by a server or Mobile Device (MD). |
Data Encryption Key (DEK) | A key used to encrypt data-at-rest. |
Developer Modes | Developer modes are states in which additional services are available to a user in order to provide enhanced system access for debugging of software. |
Encrypted Software Keys | These keys are stored in the main file system encrypted by another key and can be changed and sanitized. |
Enrolled State | The state in which the Mobile Device is managed with active policy settings from the administrator. |
Enrollment (Biometrics) | The process of collecting a biometric sample from an end user, converting it into an enrollment and/or authentication template, and storing it in the biometric system’s database. If an enrollment template is generated, it is used during the enrollment process for later comparison to other enrollment templates already stored. If there are multiple enrollment templates, they may be fused, averaged, or otherwise, in order to create authentication templates, which are used for later comparison in verification. |
Enrollment Template | A digital representation of an individual’s distinct characteristics, representing information extracted from a biometric sample. Such templates are generated during the enrollment process and utilized in various ways (including averaging, fusion, etc.) in order to generate an authentication template. |
Enterprise Applications | Applications that are provided and managed by the enterprise. |
Enterprise Data | Enterprise data is any data residing in the enterprise servers, or temporarily stored on Mobile Devices to which the Mobile Device user is allowed access according to security policy defined by the enterprise and implemented by the administrator. |
Ephemeral Keys | These keys are stored in volatile memory. |
False Accept Rate (FAR) | A statistic used to measure biometric performance when operating in verification, defined as the percentage of times a system produces a false accept, which occurs when an individual is incorrectly matched to another individual’s existing biometric. For example, Mallory claims to be Alice and the system verifies the claim. |
False Reject Rate (FRR) | A statistic used to measure biometric performance in verification, defined as the percentage of times the system produces a false reject. A false reject occurs when an individual is not matched to his or her own existing biometric template. For example, John claims to be John, but the system incorrectly denies the claim. |
Feature(s) (Biometrics) | Distinctive mathematical characteristic(s) derived from a biometric sample, used to generate enrollment or authentication templates. |
File Encryption Key (FEK) | A DEK used to encrypt a file or a director when File Encryption is used. FEKs are unique to each encrypted file or directory. |
Hardware-Isolated Keys | The OS can only access these keys by reference, if at all, during runtime. |
Hybrid Authentication | A hybrid authentication factor is one where a user has to submit a combination of a biometric sample and a PIN or password and both to pass. If either factor fails, the entire attempt fails. The user shall not be made aware of which factor failed, if either fails. |
Immutable Hardware Key | These keys are stored as hardware-protected raw key and cannot be changed or sanitized. |
Key Chaining | The method of using multiple layers of encryption keys to protect data. A top layer key encrypts a lower layer key, which encrypts the data; this method can have any number of layers. |
Key Encryption Key (KEK) | A key used to encrypt other keys, such as DEKs or storage that contains keys. |
Liveness Detection | A technique used to ensure that the biometric sample submitted is from an end user. A liveness detection method can help protect the system against some types of spoofing attacks. |
Locked State | Powered on but most functionality is unavailable for use. User authentication is required to access functionality. |
MDM Agent | The MDM Agent is installed on a Mobile Device as an application or is part of the Mobile Device’s OS. The MDM Agent establishes a secure connection back to the MDM Server controlled by the administrator. |
Minutia Point | Friction ridge characteristics that are used to individualize a fingerprint image. Minutia are the points where friction ridges begin, terminate, or split into two or more ridges. In many fingerprint systems, the minutia points are compared for recognition purposes. |
Mobile Device (MD) | A device which is composed of a hardware platform and its system software. The device typically provides wireless connectivity and may include software for functions like secure messaging, email, web, VPN (Virtual Private Network) connection, and VoIP (Voice over IP), for access to the protected enterprise network, enterprise data and applications, and for communicating to other Mobile Devices. |
Mobile Device Management (MDM) | Mobile device management (MDM) products allow enterprises to apply security policies to mobile devices. This system consists of two primary components: the MDM Server and the MDM Agent. |
Mobile Device User (User) | The individual authorized to physically control and operate the Mobile Device. Depending on the use case, this can be the device owner or an individual authorized by the device owner. |
Modality (Biometrics) | A type or class of biometric system, such as fingerprint recognition, facial recognition, iris recognition, voice recognition, signature/sign, and others. |
Mutable Hardware Key | These keys are stored as hardware-protected raw key and can be changed or sanitized. |
NIST Fingerprint Image Quality (NFIQ) | A machine-learning algorithm that
reflects the predictive positive or negative contribution of an individual sample to the
overall performance of a fingerprint matching system. NFIQ 1.0 scores are calculated on a scale from 1 to 5, where NFIQ = 1 indicates high quality samples and NFIQ = 5 indicates poor quality samples [NFIQ 1.0]. NFIQ 2.0 scores are calculated on a scale from 0 to 100, where NFIQ = 0 indicates poor quality samples and NFIQ = 100 indicates high quality samples [NFIQ 2.0]. |
Operating System (OS) | Software that runs at the highest privilege level and can directly control hardware resources. Modern Mobile Devices typically have at least two primary operating systems: one, which runs on the application processor and one, which runs on the cellular baseband processor. The OS of the application processor handles most user interactions and provides the execution environment for apps. The OS of the cellular baseband processor handles communications with the cellular network and may control other peripherals. The term OS, without context, may be assumed to refer to the OS of the application processor. |
PIN Authentication Factor | A PIN is a set of numeric or alphabetic characters that may be used in addition to a biometric factor to provide a hybrid authentication factor. At this time it is not considered as a stand-alone authentication mechanism. A PIN is distinct from a password in that the allowed character set and required length of a PIN is typically smaller than that of a password as it is designed to be input quickly. |
Password Authentication Factor | A type of authentication factor requiring the user to provide a secret set of characters to gain access. |
Powered Off State | The device has been shut down such that no TOE function can be performed. |
Presentation Attack Detection (PAD) | A technique used to ensure that the biometric sample submitted is from an end user. A presentation attack detection method can help protect the system against some types of spoofing attacks. |
Protected Data (PD) | Protected data is all non-TSF data, including all user or enterprise data. Some or all of this data may be considered sensitive data as well. |
Root Encryption Key (REK) | A key tied to the device used to encrypt other keys. |
Sensitive data | Sensitive data shall be identified in the TSS section of the Security Target (ST) by the ST author. Sensitive data is a subset or all of the Protected data. Sensitive data may include all user or enterprise data or may be specific application data such as emails, messaging, documents, calendar items, and contacts. Sensitive data is protected while in the locked state (FDP_DAR_EXT.2). |
Software Keys | The OS access the raw bytes of these keys during runtime. |
TSF Data | Data for the operation of the TSF upon which the enforcement of the requirements relies. |
Template (Biometrics) | A digital representation of an individual’s distinct characteristics, representing information extracted from a biometric sample. This PP further defines enrollment templates and authentication templates. |
Threshold | A user setting for biometric systems operating in verification. Thresholds are also used in enrollment if enrollment templates are created and compared to each other. The acceptance or rejection of biometric data in verification is dependent on the match score falling above or below the threshold. The threshold is adjustable so that the biometric system can be more or less strict, depending on the requirements of any given biometric application. |
Trust Anchor Database | A list of trusted root Certificate Authority certificates. |
Unenrolled State | The state in which the Mobile Device is not managed. |
Unlocked State | Powered on and device functionality is available for use. Implies user authentication has occurred (when so configured). |
Verification (Biometrics) | A task where the biometric system attempts to confirm an individual’s claimed identity by comparing a submitted sample to one or more previously enrolled authentication templates. |
If this feature is implemented by the TOE, the following requirements must be claimed in the ST:
Assumption or OSP | Security Objectives | Rationale |
A.CONFIG | OE.CONFIG | The operational environment objective OE.CONFIG is realized through A.CONFIG. |
A.NOTIFY | OE.NOTIFY | The operational environment objective OE.NOTIFY is realized through A.NOTIFY. |
A.PRECAUTION | OE.PRECAUTION | The operational environment objective OE.PRECAUTION is realized through A.PRECAUTION. |
A.PROPER_USER | OE.DATA_PROPER_USER | The operational environment objective OE.DATA_PROPER_USER is realized through A.PROPER_USER. |
Requirement | Auditable Events | Additional Audit Record Contents |
FAU_GEN.1 | None. | |
FAU_STG.1 | None. | |
FAU_STG.4 | None. | |
FCS_CKM_EXT.1 | [selection: generation of a REK, None]. | No additional information. |
FCS_CKM_EXT.2 | None. | |
FCS_CKM_EXT.3 | None. | |
FCS_CKM_EXT.4 | None. | |
FCS_CKM_EXT.5 | [selection: Failure of the wipe, None]. | No additional information. |
FCS_CKM_EXT.6 | None. | |
FCS_CKM.1 | [selection: Failure of key generation activity for authentication keys, None]. | No additional information. |
FCS_CKM.2/UNLOCKED | None. | |
FCS_CKM.2/LOCKED | None. | |
FCS_COP.1/ENCRYPT | None. | |
FCS_COP.1/HASH | None. | |
FCS_COP.1/SIGN | None. | |
FCS_COP.1/KEYHMAC | None. | |
FCS_COP.1/CONDITION | None. | |
FCS_IV_EXT.1 | None. | |
FCS_SRV_EXT.1 | None. | |
FCS_STG_EXT.1 | Import or destruction of key. | Identity of key. Role and identity of requester. |
[selection: Exceptions to use and destruction rules, No other events] | ||
FCS_STG_EXT.2 | None. | |
FCS_STG_EXT.3 | Failure to verify integrity of stored key. | Identity of key being verified. |
FDP_DAR_EXT.1 | [selection: Failure to encrypt/decrypt data, None]. | No additional information. |
FDP_DAR_EXT.2 | Failure to encrypt/decrypt data. | No additional information. |
FDP_IFC_EXT.1 | None. | |
FDP_STG_EXT.1 | Addition or removal of certificate from Trust Anchor Database. | Subject name of certificate. |
FIA_PMG_EXT.1 | None. | |
FIA_TRT_EXT.1 | None. | |
FIA_UAU_EXT.1 | None. | |
FIA_UAU.5 | None. | |
FIA_UAU.7 | None. | |
FMT_MOF_EXT.1 | None. | |
FPT_AEX_EXT.1 | None. | |
FPT_AEX_EXT.2 | None. | |
FPT_AEX_EXT.3 | None. | |
FPT_JTA_EXT.1 | None. | |
FPT_KST_EXT.1 | None. | |
FPT_KST_EXT.2 | None. | |
FPT_KST_EXT.3 | None. | |
FPT_NOT_EXT.1 | [selection: Measurement of TSF software, None]. | [selection: Integrity verification value, No additional information]. |
FPT_STM.1 | None. | |
FPT_TST_EXT.1 | Initiation of self-test. | [selection: Algorithm that caused the failure, none] |
Failure of self-test. | ||
FPT_TST_EXT.2/PREKERNEL | Start-up of TOE. | No additional information. |
[selection: Detected integrity violation, none] | [selection: The TSF code file that caused the integrity violation, No additional information] | |
FPT_TUD_EXT.1 | None. | |
FTA_SSL_EXT.1 | None. |
Requirement | Auditable Events | Additional Audit Record Contents |
FAU_SAR.1 | None. | |
FAU_SEL.1 | All modifications to the audit configuration that occur while the audit collection functions are operating. | No additional information. |
FCS_CKM_EXT.7 | None. | |
FCS_HTTPS_EXT.1 | Failure of the certificate validity check. | Issuer Name and Subject Name of certificate. [selection: User’s authorization decision, No additional information]. |
FCS_RBG_EXT.2 | None. | |
FCS_RBG_EXT.3 | None. | |
FCS_SRV_EXT.2 | None. | |
FDP_ACF_EXT.1 | None. | |
FDP_ACF_EXT.2 | None. | |
FDP_ACF_EXT.3 | None. | |
FDP_BCK_EXT.1 | None. | |
FDP_PBA_EXT.1 | None. | |
FDP_UPC_EXT.1/APPS | Application initiation of trusted channel. | Name of application. Trusted channel protocol. Non-TOE endpoint of connection. |
FDP_UPC_EXT.1/BLUETOOTH | Application initiation of trusted channel. | Name of application. Trusted channel protocol. Non-TOE endpoint of connection. |
FIA_AFL_EXT.1 | Excess of authentication failure limit. | Authentication factor used. |
FIA_BMG_EXT.1 | None. | |
FIA_BMG_EXT.2 | None. | |
FIA_BMG_EXT.3 | None. | |
FIA_BMG_EXT.4 | None. | |
FIA_BMG_EXT.5 | None. | |
FIA_BMG_EXT.6 | None. | |
FIA_UAU_EXT.2 | Action performed before authentication. | No additional information. |
FIA_UAU.6 | User changes Password Authentication Factor. | No additional information. |
FIA_UAU_EXT.4 | None. | |
FIA_X509_EXT.4 | Generation of Certificate Enrollment Request. | Issuer and Subject name of EST Server. Method of authentication. Issuer and Subject name of certificate used to authenticate. Content of Certificate Request Message. |
Success or failure of enrollment. | Issuer and Subject name of added certificate or reason for failure. | |
Update of EST Trust Anchor Database | Subject name of added Root CA. | |
FIA_X509_EXT.5 | None. | |
FIA_X509_EXT.6 | None. | |
FMT_SMF_EXT.1 | [selection: Initiation of policy update, none]. | [selection: Policy name, none]. |
[selection: Change of settings, none] | [selection: Role of user that changed setting, Value of new setting, none]. | |
[selection: Success or failure of function, none] | [selection: Role of user that performed function, Function performed, Reason for failure, none]. | |
Initiation of software update. | Version of update. | |
Initiation of application installation or update. | Name and version of application. | |
FMT_SMF_EXT.2 | [selection: Unenrollment, Initiation of unenrollment, none] | [selection: Identity of administrator Remediation action performed, failure of accepting command to unenroll, none] |
FMT_SMF_EXT.3 | None. | |
FPT_AEX_EXT.4 | None. | |
FPT_AEX_EXT.5 | None. | |
FPT_AEX_EXT.6 | None. | |
FPT_AEX_EXT.7 | None. | |
FPT_BBD_EXT.1 | None. | |
FPT_BLT_EXT.1 | None. | |
FPT_NOT_EXT.2 | None. | |
FPT_TST_EXT.2/POSTKERNEL | [selection: Detected integrity violation, none] | [selection: The TSF code file that caused the integrity violation, No additional information] |
FPT_TST_EXT.3 | None. | |
FPT_TUD_EXT.2 | Success or failure of signature verification for software updates. | No additional information. |
FPT_TUD_EXT.3 | Success or failure of signature verification for applications. | No additional information. |
FPT_TUD_EXT.4 | None. | |
FPT_TUD_EXT.5 | None. | |
FPT_TUD_EXT.6 | None. | |
FTA_TAB.1 | None. | |
FTP_ITC_EXT.1 | Initiation and termination of trusted channel. | Trusted channel protocol. Non-TOE endpoint of connection. |
The ST author may select either software or hardware noise sources. A hardware noise source is a component that produces data that cannot be explained by a deterministic rule, due to its physical nature. In other words, a hardware based noise source generates sequences of random numbers from a physical process that cannot be predicted. For example, a sampled ring oscillator consists of an odd number of inverter gates chained into a loop, with an electrical pulse traveling from inverter to inverter around the loop. The inverters are not clocked, so the precise time required for a complete circuit around the loop varies slightly as various physical effects modify the small delay time at each inverter on the line to the next inverter. This variance results in an approximate natural frequency that contains drift and jitter over time. The output of the ring oscillator consists of the oscillating binary value sampled at a constant rate from one of the inverters – a rate that is significantly slower than the oscillator’s natural frequency.
For the
selection in this requirement, the ST author selects "TSF noise source" if
a single noise source is used as input to the DRBG. The ST author selects "multiple TSF noise sources" if the seed is formed from a combination of two or more noise sources. If the TSF implements two or more separate DRBGs, this SFR should be isolated. It multiple distinct noise sources exist such that each DRBG only uses one of them, then each iteration would select "TSF noise source."
If "TSF noise source" is selected, FCS_RBG.3 must be claimed.
If "multiple TSF noise sources" is selected, FCS_RBG.4 and FCS_RBG.5 must be claimed.
If "TSF interface for seeding" is selected, FCS_RBG.2 must be claimed.
A subset of the User Data Protection focuses on protecting Data-At-Rest, namely FDP_DAR_EXT.1 and FDP_DAR_EXT.2. Three levels of data-at-rest protection are addressed: TSF data, Protected Data (and keys), and sensitive data. Table 6 addresses the level of protection required for each level of data-at-rest.
Table 6: Protection of Data LevelsData Level | Protection Required |
TSF Data | TSF data does not require confidentiality, but does require integrity protection. (FPT_TST_EXT.2/PREKERNEL) |
Protected Data | Protected data is encrypted while powered off. (FDP_DAR_EXT.1) |
Sensitive Data | Sensitive data is encrypted while in the locked state, in addition to while powered off. (FDP_DAR_EXT.2) |
# | Management Function | Impl. | User Only | Admin | Admin Only |
1 |
configure password policy:
| MMandatory | -N/A | MMandatory | MMandatory |
2 |
configure session
locking policy:
| MMandatory | -N/A | MMandatory | MMandatory |
3 |
enable/disable the VPN
protection:
[selection:
| MMandatory | OOptional | OOptional | OOptional |
4 | enable/disable [assignment: list of all radios] | MMandatory | OOptional | OOptional | OOptional |
5 |
enable/disable
[assignment:
list of audio or visual collection devices]:
[selection:
| MMandatory | OOptional | OOptional | OOptional |
6 | transition to the locked state | MMandatory | -N/A | MMandatory | -N/A |
7 | TSF wipe of protected data | MMandatory | -N/A | MMandatory | -N/A |
8 |
configure
application installation policy by [selection:
| MMandatory | -N/A | MMandatory | MMandatory |
9 | import keys/secrets into the secure key storage | MMandatory | OOptional | OOptional | -N/A |
10 | destroy imported keys/secrets and [selection: no other keys/secrets, [assignment: list of other categories of keys/secrets]] in the secure key storage | MMandatory | OOptional | OOptional | -N/A |
11 | import X.509v3 certificates into the Trust Anchor Database | MMandatory | -N/A | MMandatory | OOptional |
12 | remove imported X.509v3 certificates and [selection: no other X.509v3 certificates, [assignment: list of other categories of X.509v3 certificates]] in the Trust Anchor Database | MMandatory | OOptional | OOptional | -N/A |
13 | enroll the TOE in management | MMandatory | OOptional | OOptional | OOptional |
14 | remove applications | MMandatory | -N/A | MMandatory | OOptional |
15 | update system software | MMandatory | -N/A | MMandatory | OOptional |
16 | install applications | MMandatory | -N/A | MMandatory | OOptional |
17 | remove Enterprise applications | MMandatory | -N/A | MMandatory | -N/A |
18 |
enable/disable
display notification in the locked state of: [selection:
| MMandatory | OOptional | OOptional | OOptional |
19 | enable data-at rest protection | MMandatory | OOptional | OOptional | OOptional |
20 | enable removable media’s data-at-rest protection | MMandatory | OOptional | OOptional | OOptional |
21 |
enable/disable location
services:
[selection:
| MMandatory | OOptional | OOptional | OOptional |
22 | enable/disable the use of [selection: Biometric Authentication Factor, Hybrid Authentication Factor] | MMandatory | OOptional | OOptional | OOptional |
23 | configure whether to allow/disallow establishment of a trusted channel if the peer/server certificate is deemed invalid. | MMandatory | OOptional | OOptional | OOptional |
24 | enable/disable all data signaling over [assignment: list of externally accessible hardware ports] | OOptional | OOptional | OOptional | OOptional |
25 | enable/disable [assignment: list of protocols where the device acts as a server] | OOptional | OOptional | OOptional | OOptional |
26 | enable/disable developer modes | OOptional | OOptional | OOptional | OOptional |
27 | enable/disable bypass of local user authentication | OOptional | OOptional | OOptional | OOptional |
28 | wipe Enterprise data | OOptional | OOptional | OOptional | -N/A |
29 | approve [selection: import, removal] by applications of X.509v3 certificates in the Trust Anchor Database | OOptional | OOptional | OOptional | OOptional |
30 | configure whether to allow/disallow establishment of a trusted channel if the TSF cannot establish a connection to determine the validity of a certificate | OOptional | OOptional | OOptional | OOptional |
31 | enable/disable the cellular protocols used to connect to cellular network base stations | OOptional | OOptional | OOptional | OOptional |
32 | read audit logs kept by the TSF | OOptional | OOptional | OOptional | -N/A |
33 | configure [selection: certificate, public-key] used to validate digital signature on applications | OOptional | OOptional | OOptional | OOptional |
34 | approve exceptions for shared use of keys/secrets by multiple applications | OOptional | OOptional | OOptional | OOptional |
35 | approve exceptions for destruction of keys/secrets by applications that did not import the key/secret | OOptional | OOptional | OOptional | OOptional |
36 | configure the unlock banner | OOptional | -N/A | OOptional | OOptional |
37 | configure the auditable items | OOptional | -N/A | OOptional | OOptional |
38 | retrieve TSF-software integrity verification values | OOptional | OOptional | OOptional | OOptional |
39 | enable/disable [selection: ] | OOptional | OOptional | OOptional | OOptional |
40 | enable/disable backup of [selection: all applications, selected applications, selected groups of applications, configuration data] to [selection: locally connected system, remote system] | OOptional | OOptional | OOptional | OOptional |
41 |
enable/disable [selection:
| OOptional | OOptional | OOptional | OOptional |
42 | approve exceptions for sharing data between [selection: applications, groups of applications] | OOptional | OOptional | OOptional | OOptional |
43 | place applications into application groups based on [assignment: enterprise configuration settings] | OOptional | OOptional | OOptional | OOptional |
44 | unenroll the TOE from management | OOptional | OOptional | OOptional | OOptional |
45 |
enable/disable the
Always On VPN protection:
[selection:
| OOptional | OOptional | OOptional | OOptional |
46 | revoke Biometric template | OOptional | OOptional | OOptional | OOptional |
47 | [assignment: list of other management functions to be provided by the TSF] | OOptional | OOptional | OOptional | OOptional |
Functions 3 , 5 , and 21 must be implemented on a device-wide basis but may also be implemented on a per-app basis or on a per-group of applications basis in which the configuration includes the list of applications or groups of applications to which the enable/disable applies.
Function 3 addresses enabling and disabling the IPsec VPN only. The configuration of the VPN Client itself (with information such as VPN Gateway, certificates, and algorithms) is addressed by the PP-Module for VPN Client. The administrator options should only be listed if the administrator can remotely enable/disable the VPN connection.
Function 3 optionally allows the VPN to be configured per-app or per-groups of apps. If this configuration is selected, it does not void FDP_IFC_EXT.1. Instead FDP_IFC_EXT.1 is applied to the application or group of applications the VPN is applied to. In other words, all traffic destined for the VPN-enabled application or group of applications, must travel through the VPN, but traffic not destined for that application or group of applications can travel outside the VPN. When the VPN is configured across the device FDP_IFC_EXT.1 applies to all traffic and the VPN must not split tunnel.
The assignment in function 4 consists of all radios present on the TSF, such as Wi-Fi, cellular, NFC, Bluetooth BR/EDR, and Bluetooth LE, which can be enabled and disabled. In the future, if both Bluetooth BR/EDR and Bluetooth LE are supported, they will be required to be enabled and disabled separately. Disablement of the cellular radio does not imply that the radio may not be enabled in order to place emergency phone calls; however, it is not expected that a device in "airplane mode", where all radios are disabled, will automatically (without authorization) turn on the cellular radio to place emergency calls.
The assignment in function 5 consists of at least one audio and/or visual device, such as camera and microphone, which can be enabled and disabled by either the user or administrator. Disablement of the microphone does not imply that the microphone may not be enabled in order to place emergency phone calls. If certain devices are able to be restricted to the enterprise (either device-wide, per-app or per-group of applications) and others are able to be restricted to users, then this function should be iterated in the table with the appropriate table entries.
Regarding functions 4 and 5, disablement of a particular radio or audio/visual device must be effective as soon as the TOE has power. Disablement must also apply when the TOE is booted into auxiliary boot modes, for example, associated with updates or backup. If the TOE supports states in which security management policy is inaccessible, for example, due to data-at-rest protection, it is acceptable to meet this requirement by ensuring that these devices are disabled by default while in these states. That these devices are disabled during auxiliary boot modes does not imply that the device (particularly the cellular radio) may not be enabled in order to perform emergency phone calls.
Wipe of the TSF (function 7) is performed according to FCS_CKM_EXT.5. Protected data is all non-TSF data, including all user or enterprise data. Some or all of this data may be considered sensitive data as well.
The selection in function 8 allows the ST author to select which mechanisms are available to the administrator through the MDM Agent to restrict the applications which the user may install. The ST author must state if application allowlist is applied device-wide or if it can be specified to apply to either the Enterprise and/or Personal applications.
In the future, function 12 may require destruction or disabling of any default trusted CA certificates, excepting those CA certificates necessary for continued operation of the TSF, such as the developer’s certificate. At this time, the ST author must indicate in the assignment whether pre-installed or any other category of X.509v3 certificates may be removed from the Trust Anchor Database.
For function 13, the enrollment function may be installing an MDM agent and includes the policies to be applied to the device. It is acceptable for the user approval notice to require the user to intentionally opt to view the policies (for example, by "tapping" on a "View" icon) rather than listing the policies in full in the notice.
For function 15, the administrator capability to update the system software may be limited to causing a prompt to the user to update rather than the ability to initiate the update itself. As the administrator is likely to be acting remotely, he/she would be unaware of inopportune situations, such as low power, which may cause the update to fail and the device to become inoperable. The user can refuse to accept the update in such situations. It is expected that system architects will be cognizant of this limitation and will enforce network access controls in order to enforce enterprise-critical updates.
Function 16 addresses both installation and update. This protection profile does not distinguish between installation and update of applications because mobile devices typically completely overwrite the previous installation with a new installation during an application update.
For function 17, "Enterprise applications" are those applications that belong to the Enterprise application group. Applications installed by the enterprise administrator (including automatic installation by the administrator after being requested by the user from a catalog of enterprise applications) are by default placed in the Enterprise application group unless an exception has been made in function 43 of FMT_SMF_EXT.1.1.
If the display of notifications in the locked state is supported, the configuration of these notifications (function 18) must be included in the selection.
Function 19 must be included in the selection if data-at-rest protection is not natively enabled.
Function 20 is implicitly met if the TSF does not support removable media.
For function 21, location services include location information gathered from GPS, cellular, and Wi-Fi.
Function 22 is implicitly met if the TOE does not contain a BAF. This selection must correspond with the selection made in FIA_UAU.5.1. If a BAF is selected in FIA_UAU.5.1, "Biometric Authentication Factor" must be selected and the user or admin must have the option to disable the use of it. If multiple BAFs are selected in FIA_UAU.5.1, this applies to all different modalities. If "hybrid" is selected in FIA_UAU.5.1 it must be selected and the user or admin must have the option to disable the use of it.
For function 23, the configuration can be different depending on the specific trusted channel.
The assignment in function 24 consists of all externally accessible hardware ports, such as USB, the SD card, and HDMI, whose data transfer capabilities can be enabled and disabled by either the user or administrator. Disablement of data transfer over an external port must be effective during and after boot into the normal operative mode of the device. If the TOE supports states in which configured security management policy is inaccessible, for example, due to data-at-rest protection, it is acceptable to meet this requirement by ensuring that data transfer is disabled by default while in these states. Each of the ports may be enabled or disabled separately. The configuration policy need not disable all ports together. In the case of USB, chagrining is still allowed if data transfer capabilities have been disabled.
The assignment in function 25 consists of all protocols where the TSF acts as a server, which can be enabled and disabled by either the user or administrator.
Function 26 must be included in the selection if developer modes are supported by the TSF.
Function 27 must be included in the selection if bypass of local user authentication, such as a "Forgot Password", password hint, or remote authentication feature, is supported.
Function 29 must be included in the selection if the TSF allows applications, other than the MDM Agents, to import or remove X.509v3 certificates from the Trust Anchor Database. The MDM Agent is considered the administrator. This function does not apply to applications trusting a certificate for its own validations. The function only applies to situations where the application modifies the device-wide Trust Anchor Database, affecting the validations performed by the TSF for other applications. The user or administrator may be provided the ability to globally allow or deny any application requests in order to meet this requirement.
Function 30 must be included in the ST if "administrator is allowed to configure certificate acceptance" is selected in FIA_X509_EXT.2.2 in the Functional Package for X.509.
Function 33 should be included in the selection if FPT_TUD_EXT.5.1 is included in the ST and the configurable option is selected.
Function 34 should be included in the selection if user or administrator is selected in FCS_STG_EXT.1.4.
Function 35 should be included in the selection if user or administrator is selected in FCS_STG_EXT.1.5.
Function 36 must be included in the selection if FTA_TAB.1 is included in the ST.
Function 37 must be included in the selection if FAU_SEL.1 is included in the ST.
For function 41, hotspot functionality refers to the condition in which the mobile device is serving as an access point to other devices, not the connection of the TOE to external hotspots.
Functions 42 and 43 correspond to FDP_ACF_EXT.1.2.
For function 44, FMT_SMF_EXT.2.1 specifies actions to be performed when the TOE is unenrolled from management.
For function 45, must be included in the ST if IPsec is selected in FTP_ITC_EXT.1 and the native IPsec VPN client can be configured to be Always-On. Always-On is defined as when the TOE has a network connection the VPN attempts to connect, all data leaving the device uses the VPN when the VPN is connected and no data leaves that device when the VPN is disconnected. The configuration of the VPN Client itself (with information such as VPN Gateway, certificates, and algorithms) is addressed by the PP-Module for VPN Client.
The following rationale provides justification for each SFR for the TOE,
showing that the SFRs are suitable to address the specified threats:
Threat | Addressed by | Rationale |
---|---|---|
T.NETWORK_EAVESDROP | FCS_CKM.1 | FCS_CKM.1 helps mitigate the threat of network eavesdrop by ensuring the generation of strong keys used for trusted communications. |
FCS_CKM.2/UNLOCKED | FCS_CKM.2/UNLOCKED helps mitigate the threat of network eavesdrop by performing key establishment for trusted communications. | |
FCS_CKM_EXT.6 | FCS_CKM_EXT.6 helps mitigate the threat of network eavesdrop by using salts using where appropriate for cryptographic functions. | |
FCS_COP.1/ENCRYPT | FCS_COP.1/ENCRYPT helps mitigate the threat of network eavesdrop by ensuring that secure symmetric algorithms are used for trusted communications. | |
FCS_COP.1/HASH | FCS_COP.1/HASH helps mitigate the threat of network eavesdrop by ensuring that secure hash algorithms are used for trusted communications. | |
FCS_COP.1/KEYHMAC | FCS_COP.1/KEYHMAC helps mitigate the threat of a network eavesdrop by ensuring that secure HMAC algorithms are used for trusted communications. | |
FCS_COP.1/SIGN | FCS_COP.1/SIGN helps mitigate the threat of network eavesdrop by ensuring that secure digital signature algorithms are used for trusted communications. | |
FCS_HTTPS_EXT.1 | FCS_HTTPS_EXT.1 helps mitigate the threat of network eavesdrop by implementing a secure protocol (HTTPS) for trusted communications. | |
FCS_RBG.6 | FCS_RBG.6 helps mitigate the threat of a network eavesdrop by providing a secure DRBG service for third-party applications running on the TOE which may use this service to generate their own cryptographic keys for trusted communications. | |
FCS_SRV_EXT.1 | FCS_SRV_EXT.1 helps mitigate the threat of network eavesdrop by ensuring applications have the proper mechanism to perform cryptographic operations. | |
FDP_IFC_EXT.1 | FDP_IFC_EXT.1 helps mitigate the threat of network eavesdrop by ensuring that the TOE has the ability to enforce the use of an IPsec VPN for all network traffic. | |
FDP_STG_EXT.1 | FDP_STG_EXT.1 helps mitigate the threat of network eavesdrop by protecting the X.509 certificates used for trusted communications. | |
FDP_UPC_EXT.1/APPS | FDP_UPC_EXT.1/APPS helps mitigate the threat of network eavesdrop by implementing a means for applications to communicate securely via a trusted channel. | |
FPT_FLS.1 | FPT_FLS.1 helps mitigate the threat of network eavesdrop by ensuring that a malfunctioning DRBG function cannot be used to generate potentially insecure keys. | |
FPT_TST.1 | FPT_TST.1 helps mitigate the threat of network eavesdrop by implementing a mechanism to detect when the DRBG may be failing to generate secure cryptographic keys. | |
FTP_ITC_EXT.1 | FTP_ITC_EXT.1 helps mitigate the threat of network eavesdrop by requiring the TSF to implement trusted protocols for network communication. | |
FCS_RBG_EXT.2 (Objective) | FCS_RBG_EXT.2 helps mitigate the threat of network eavesdrop by defining requirements for secure DRBG implementation. | |
FCS_RBG_EXT.3 (Objective) | FCS_RBG_EXT.3 helps mitigate the threat of network eavesdrop by defining requirements for secure DRBG implementation. | |
FDP_BLT_EXT.1 (Objective) | FDP_BLT_EXT.1 helps mitigate the threat of network eavesdrop by managing which applications communicate with Bluetooth devices. | |
FPT_BLT_EXT.1 (Objective) | FPT_BLT_EXT.1 helps mitigate the threat of network eavesdrop by enforcing least functionality of the TOE's Bluetooth interface. | |
FDP_UPC_EXT.1/BLUETOOTH (implementation-dependent) | FDP_UPC_EXT.1/BLUETOOTH helps mitigate the threat of network eavesdrop by protecting communication channels using Bluetooth functionality via a trusted channel. | |
FCS_RBG.2 (selection-based) | FCS_RBG.2 helps mitigate the threat of network eavesdrop by ensuring that the TOE's DRBG is seeded with sufficient entropy to ensure the generation of strong cryptographic keys. | |
FCS_RBG.3 (selection-based) | FCS_RBG.3 helps mitigate the threat of network eavesdrop by ensuring that the TOE's DRBG is seeded with sufficient entropy to ensure the generation of strong cryptographic keys. | |
FCS_RBG.4 (selection-based) | FCS_RBG.4 helps mitigate the threat of network eavesdrop by ensuring that the TOE's DRBG is seeded with sufficient entropy to ensure the generation of strong cryptographic keys. | |
FCS_RBG.5 (selection-based) | FCS_RBG.5 helps mitigate the threat of network eavesdrop by ensuring that the TOE's DRBG is seeded with sufficient entropy to ensure the generation of strong cryptographic keys. | |
FCS_SSH_EXT.1 (SSH Package) | Helps mitigate the threat of network eavesdrop by defining the TOE's implementation of SSH if this protocol is used for protected communications. | |
FCS_SSHC_EXT.1 (SSH Package) | Helps mitigate the threat of network eavesdrop by defining the TOE's implementation of SSH as a client if this protocol is used for protected communications. | |
FCS_SSHS_EXT.1 (SSH Package) | Helps mitigate the threat of network eavesdrop by defining the TOE's implementation of SSH as a server if this protocol is used for protected communications. | |
FCS_TLS_EXT.1 (TLS Package) | Helps mitigate the threat by identifying the TOE's support for TLS or DTLS as trusted communications channels. | |
FCS_DTLSC_EXT.1 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSC_EXT.2 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSC_EXT.3 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSC_EXT.4 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSC_EXT.5 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSC_EXT.6 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSS_EXT.1 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSS_EXT.2 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSS_EXT.3 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSS_EXT.4 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSS_EXT.5 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSS_EXT.6 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_TLSC_EXT.1 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSC_EXT.2 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSC_EXT.3 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSC_EXT.4 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSC_EXT.5 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSC_EXT.6 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSS_EXT.1 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSS_EXT.2 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSS_EXT.3 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSS_EXT.4 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSS_EXT.5 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSS_EXT.6 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FIA_ESTC_EXT.1 (X.509 Package | FIA_ESTC_EXT.1 helps mitigate the threat of a network eavesdrop by using a secure method to obtain X.509 certificates for the TOE's own use. | |
FIA_XCU_EXT.1 (X.509 Package) | Helps mitigate the threat of network eavesdrop by requiring the use of X.509 certificates to validate the authenticity of network entities. | |
FIA_X509_EXT.1 (X.509 Package) | FIA_X509_EXT.1 helps mitigate the threat of network eavesdrop by defining how X.509 certificates are validated and where they are used. | |
FIA_X509_EXT.2 (X.509 Package) | FIA_X509_EXT.2 helps mitigate the threat of network eavesdrop by authenticating peers in protocols that support certificates and verifying integrity. | |
FIA_X509_EXT.3 (X.509 Package) | FIA_X509_EXT.3 helps mitigate the threat of network eavesdrop by defining a secure mechanism by which the TSF can acquire certificates for its own use. | |
T.NETWORK_ATTACK | FAU_GEN.1 | FAU_GEN.1 helps mitigate the threat of a network attack by maintaining an audit trail of potential malicious activity. |
FAU_STG.1 | FAU_STG.1 helps mitigate the threat of a network attack by maintaining the availability of the audit trail. | |
FAU_STG.4 | FAU_STG.4 helps mitigate the threat of a network attack by maintaining the availability of the audit trail. | |
FCS_CKM.1 | FCS_CKM.1 helps mitigate the threat of a network attack by ensuring the generation of strong keys used for trusted communications. | |
FCS_CKM.2/UNLOCKED | FCS_CKM.2/UNLOCKED helps mitigate the threat of a network attack by performing key establishment for trusted communications. | |
FCS_CKM_EXT.6 | FCS_CKM_EXT.6 helps mitigate the threat of newtork eavesdrop by using salts using where appropriate for cryptographic functions. | |
FCS_COP.1/ENCRYPT | FCS_COP.1/ENCRYPT helps mitigate the threat of a network attack by ensuring that secure symmetric algorithms are used for trusted communications. | |
FCS_COP.1/HASH | FCS_COP.1/HASH helps mitigate the threat of a network attack by ensuring that secure hash algorithms are used for trusted communications. | |
FCS_COP.1/KEYHMAC | FCS_COP.1/KEYHMAC helps mitigate the threat of a network attack by ensuring that secure HMAC algorithms are used for trusted communications. | |
FCS_COP.1/SIGN | FCS_COP.1/SIGN helps mitigate the threat of a network attack by ensuring that secure digital signature algorithms are used for trusted communications. | |
FCS_HTTPS_EXT.1 | FCS_HTTPS_EXT.1 helps mitigate the threat of a network attack by implementing a secure protocol (HTTPS) for trusted communications. | |
FCS_RBG.1 | FCS_RBG.1 helps mitigate the threat of a network attack by ensuring that keys used for trusted communications are generated using a secure DRBG. | |
FCS_RBG.6 | FCS_RBG.6 helps mitigate the threat of a network attack by providing a secure DRBG service for third-party applications running on the TOE which may use this service to generate their own cryptographic keys for trusted communications. | |
FCS_SRV_EXT.1 | FCS_SRV_EXT.1 helps mitigate the threat of a network attack by ensuring applications have the proper mechanism to perform cryptographic operations. | |
FDP_IFC_EXT.1 | FDP_IFC_EXT.1 helps mitigate the threat of a network attack by ensuring that the TOE has the ability to enforce the use of an IPsec VPN for all network traffic. | |
FDP_STG_EXT.1 | FDP_STG_EXT.1 helps mitigate the threat of network eavesdrop by protecting the X.509 certificates used for trusted communications. | |
FDP_UPC_EXT.1/APPS | FDP_UPC_EXT.1/APPS helps mitigate the threat of network eavesdrop by implementing a means for applications to communicate securely via a trusted channel. | |
FIA_AFL_EXT.1 | FIA_AFL_EXT.1 helps mitigate the threat of a network attack by managing unsuccessful attempts and limiting the number of attempts for each method, including wiping protected data after all mechanisms are used. | |
FIA_PMG_EXT.1 | FIA_PMG_EXT.1 helps mitigate the threat of a network attack by defining password characteristics. | |
FIA_TRT_EXT.1 | FIA_TRT_EXT.1 helps mitigate the threat of a network attack by limiting authentication attempts, including the number of attempts in a set time. | |
FIA_UAU.5 | FIA_UAU.5 helps mitigate the threat of a network attack by providing specified authentication mechanisms for network user authentication. | |
FIA_UAU.6 | FIA_UAU.6 helps mitigate the threat of a network attack by requiring re-authenticating the user under certain conditions. | |
FIA_UAU.7 | FIA_UAU.7 helps mitigate the threat of a network attack by providing only limited information during authentication. | |
FIA_UAU_EXT.1 | FIA_UAU_EXT.1 helps mitigate the threat of a network attack by preventing decryption prior to proper authorization to the device. | |
FIA_UAU_EXT.2 | FIA_UAU_EXT.2 helps mitigate the threat of a network attack by requiring successful authentication before allowing the user to take action on the TOE. | |
FMT_MOF_EXT.1 | FMT_MOF_EXT.1 helps mitigate the threat of a network attack by limiting the management functions that are available to a given user. | |
FMT_SMF_EXT.1 | FMT_SMF_EXT.1 helps mitigate the threat of a network attack by providing a list of specific management functions. | |
FMT_SMF_EXT.2 | FMT_SMF_EXT.2 helps mitigate the threat of a network attack by specifying the remediation actions allowed upon enrollment. | |
FPT_FLS.1 | FPT_FLS.1 helps mitigate the threat of a network attack by ensuring that a malfunctioning DRBG function cannot be used to generate potentially insecure keys. | |
FPT_TST.1 | FPT_TST.1 helps mitigate the threat of a network attack by implementing a mechanism to detect when the DRBG may be failing to generate secure cryptographic keys. | |
FTA_SSL_EXT.1 | FTA_SSL_EXT.1 helps mitigate the threat of a network attack by managing the transition to a locked state after a set time or operation. | |
FPT_STM.1 | FPT_STM.1 helps mitigate the threat of a malicious app by providing reliable time stamps for the audit trail. | |
FTA_TAB.1 | FTA_TAB.1 helps mitigate the threat of a network attack by providing actionable consequences for misuse of the TSF. | |
FTP_ITC_EXT.1 | FTP_ITC_EXT.1 helps mitigate the threat of a network attack by requiring the TSF to implement trusted protocols for network communication. | |
FIA_UAU_EXT.4 (optional) | FIA_UAU_EXT.4 helps mitigate the threat of a network attack by preventing decryption of the enterprise application prior to providing secondary authentication. | |
FAU_SAR.1 (objective) | FAU_SAR.1 helps mitigate the threat of a network attack by providing a mechanism to read the audit trail. | |
FAU_SEL.1 (objective) | FAU_SEL.1 helps mitigate the threat of a network attack by allowing the TSF to determine the behavior that indicates potential malicious activity in the audit trail. | |
FCS_RBG_EXT.2 (objective) | FCS_RBG_EXT.2 helps mitigate the threat of a network attack by ensuring the DRBG state at power-off and startup remains the same. | |
FCS_SRV_EXT.2 (objective) | FCS_SRV_EXT.2 helps mitigate the threat of a network attack by ensuring applications have the proper mechanism to perform cryptographic operations with keys in secure storage. | |
FDP_BLT_EXT.1 (objective) | FDP_BLT_EXT.1 helps mitigate the threat of a network attack by managing which applications communicate with Bluetooth devices. | |
FPT_BLT_EXT.1 (objective) | FPT_BLT_EXT.1 helps mitigate the threat of a network attack by enforcing least functionality of the TOE's Bluetooth interface. | |
FDP_UPC_EXT.1/BLUETOOTH (implementation-dependent) | FDP_UPC_EXT.1/BLUETOOTH helps mitigate the threat of a network attack by protecting communication channels using Bluetooth functionality via a trusted channel. | |
FCS_RBG.2 (selection-based) | FCS_RBG.2 helps mitigate the threat of network eavesdrop by ensuring that the TOE's DRBG is seeded with sufficient entropy to ensure the generation of strong cryptographic keys. | |
FCS_RBG.3 (selection-based) | FCS_RBG.3 helps mitigate the threat of a network attack by ensuring that the TOE's DRBG is seeded with sufficient entropy to ensure the generation of strong cryptographic keys. | |
FCS_RBG.4 (selection-based) | FCS_RBG.4 helps mitigate the threat of a network attack by ensuring that the TOE's DRBG is seeded with sufficient entropy to ensure the generation of strong cryptographic keys. | |
FCS_RBG.5 (selection-based) | FCS_RBG.5 helps mitigate the threat of a network attack by ensuring that the TOE's DRBG is seeded with sufficient entropy to ensure the generation of strong cryptographic keys. | |
FCS_SSH_EXT.1 (SSH Package) | Helps mitigate the threat of a network attack by defining the TOE's implementation of SSH if this protocol is used for protected communications. | |
FCS_SSHC_EXT.1 (SSH Package) | Helps mitigate the threat of a network attack by defining the TOE's implementation of SSH as a client if this protocol is used for protected communications. | |
FCS_SSHS_EXT.1 (SSH Package) | Helps mitigate the threat of a network attack by defining the TOE's implementation of SSH as a server if this protocol is used for protected communications. | |
FCS_TLS_EXT.1 (TLS Package) | Helps mitigate the threat by identifying the TOE's support for TLS or DTLS as trusted communications channels. | |
FCS_DTLSC_EXT.1 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSC_EXT.2 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSC_EXT.3 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSC_EXT.4 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSC_EXT.5 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSC_EXT.6 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSS_EXT.1 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSS_EXT.2 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSS_EXT.3 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSS_EXT.4 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSS_EXT.5 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_DTLSS_EXT.6 (TLS Package) | Helps mitigate the threat by defining the use of DTLS as a trusted network communications channel. | |
FCS_TLSC_EXT.1 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSC_EXT.2 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSC_EXT.3 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSC_EXT.4 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSC_EXT.5 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSC_EXT.6 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSS_EXT.1 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSS_EXT.2 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSS_EXT.3 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSS_EXT.4 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSS_EXT.5 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FCS_TLSS_EXT.6 (TLS Package) | Helps mitigate the threat by defining the use of TLS as a trusted network communications channel. | |
FIA_ESTC_EXT.1 (X.509 Package | FIA_ESTC_EXT.1 helps mitigate the threat of a network attack by using a secure method to obtain X.509 certificates for the TOE's own use. | |
FIA_XCU_EXT.1 (X.509 Package) | Helps mitigate the threat of a network attack by requiring the use of X.509 certificates to validate the authenticity of network entities. | |
FIA_X509_EXT.1 (X.509 Package) | FIA_X509_EXT.1 helps mitigate the threat of a network attack by defining how X.509 certificates are validated and where they are used. | |
FIA_X509_EXT.2 (X.509 Package) | FIA_X509_EXT.2 helps mitigate the threat of a network attack by authenticating peers in protocols that support certificates and verifying integrity. | |
FIA_X509_EXT.3 (X.509 Package) | FIA_X509_EXT.3 helps mitigate the threat of a network attack by defining a secure mechanism by which the TSF can acquire certificates for its own use. | |
T.PHYSICAL_ACCESS | FCS_CKM.2/LOCKED | FCS_CKM.2/LOCKED helps mitigate the threat of physical access by implementing a method of protecting data at rest while the TOE is in a locked state. |
FCS_CKM_EXT.1 | FCS_CKM_EXT.1 helps mitigate the threat of physical access by implementing a method of protecting data at rest while the TOE is in a locked state. | |
FCS_CKM_EXT.2 | FCS_CKM_EXT.2 helps mitigate the threat of physical access by implementing a method of protecting data at rest while the TOE is in a locked state. | |
FCS_CKM_EXT.3 | FCS_CKM_EXT.3 helps mitigate the threat of physical access by implementing a method of protecting data at rest while the TOE is in a locked state. | |
FCS_CKM_EXT.4 | FCS_CKM_EXT.4 helps mitigate the threat of physical access by ensuring that keys used for trusted communications are destroyed in a secure manner. | |
FCS_CKM_EXT.5 | FCS_CKM_EXT.5 helps mitigate the threat of physical access by implementing a secure mechanism to erase protected data from the TOE. | |
FCS_CKM_EXT.6 | FCS_CKM_EXT.6 helps mitigate the threat of physical access by generating salts using RBG. | |
FCS_COP.1/CONDITION | FCS_COP.1/CONDITION helps mitigate the threat of physical access by performing password conditioning to increase the difficulty of deriving a key from a password. | |
FCS_COP.1/ENCRYPT | FCS_COP.1/ENCRYPT helps mitigate the threat of physical access by using symmetric encryption to protect data at rest. | |
FCS_COP.1/HASH | FCS_COP.1/HASH helps mitigate the threat of physical access by implementing an integrity mechanism used to verify stored keys. | |
FCS_COP.1/KEYHMAC | FCS_COP.1/KEYHMAC helps mitigate the threat of physical access by implementing an integrity mechanism used to verify stored keys. | |
FCS_COP.1/SIGN | FCS_COP.1/SIGN helps mitigate the threat of physical access by implementing an authenticity and integrity mechanism used to verify stored keys. | |
FCS_IV_EXT.1 | FCS_IV_EXT.1 helps mitigate the threat of physical access by ensuring that appropriate IVs are used for symmetric keys. | |
FCS_RBG.1 | FCS_RBG.1 helps mitigate the threat of physical access by ensuring that keys used for protected storage are generated using a secure DRBG. | |
FCS_STG_EXT.1 | FCS_STG_EXT.1 helps mitigate the threat of physical access by implementing a secure key storage for keys used to protect data at rest. | |
FCS_STG_EXT.2 | FCS_STG_EXT.2 helps mitigate the threat of physical access by enforcing confidentiality for key storage. | |
FCS_STG_EXT.3 | FCS_STG_EXT.3 helps mitigate the threat of physical access by enforcing integrity for key storage. | |
FDP_DAR_EXT.1 | FDP_DAR_EXT.1 helps mitigate the threat of physical access by encrypting sensitive data at rest. | |
FDP_DAR_EXT.2 | FDP_DAR_EXT.2 helps mitigate the threat of physical access by allowing data to be marked as sensitive such that it is encrypted while at rest. | |
FIA_AFL_EXT.1 | FIA_AFL_EXT.1 helps mitigate the threat of physical access by limiting the extent to which brute force authentication attempts to the TOE can be made. | |
FIA_PMG_EXT.1 | FIA_PMG_EXT.1 helps mitigate the threat of physical access by defining strong password characteristics. | |
FIA_TRT_EXT.1 | FIA_AFL_EXT.1 helps mitigate the threat of physical access by limiting the extent to which brute force authentication attempts to the TOE can be made. | |
FIA_UAU.5 | FIA_UAU.5 helps mitigate the threat of physical access by defining the supported authentication mechanisms. | |
FIA_UAU.6 | FIA_UAU.6 helps mitigate the threat of physical access by implementing functionality to require re-authentication in certain situations. | |
FIA_UAU.7 | FIA_UAU.7 helps mitigate the threat of physical access by providing only limited information during authentication. | |
FIA_UAU_EXT.1 | FIA_UAU_EXT.1 helps mitigate the threat of physical access by preventing decryption prior to proper authorization to the device. | |
FIA_UAU_EXT.2 | FIA_UAU_EXT.2 helps mitigate the threat of physical access by requiring successful authentication before allowing the user to take action on the TOE. | |
FPT_FLS.1 | FPT_FLS.1 helps mitigate the threat of physical access by ensuring that a malfunctioning DRBG function cannot be used to generate potentially insecure keys. | |
FPT_JTA_EXT.1 | FPT_JTA_EXT.1 helps mitigate the threat of physical access by specifying the mechanism used to control access to JTAG. | |
FPT_KST_EXT.1 | FPT_KST_EXT.1 helps mitigate the threat of physical access by ensuring plaintext key material is not stored in readable non-volatile memory. | |
FPT_KST_EXT.2 | FPT_KST_EXT.2 helps mitigate the threat of physical access by preventing transmission of plaintext key material outside the secure boundary of the TOE. | |
FPT_KST_EXT.3 | FPT_KST_EXT.3 helps mitigate the threat of physical access by ensuring TOE users cannot export plaintext keys. | |
FPT_TST.1 | FPT_TST.1 helps mitigate the threat of physical access by implementing a mechanism to detect when the DRBG may be failing to generate secure cryptographic keys. | |
FTA_SSL_EXT.1 | FTA_SSL_EXT.1 helps mitigate the threat of physical access by managing the transition to a locked state after a set time or operation. | |
FIA_UAU_EXT.4 (optional) | FIA_UAU_EXT.4 helps mitigate the threat of physical access by enforcing a secondary authentication mechanism for accessing enterprise resources. | |
FIA_BMG_EXT.2 (objective) | FIA_BMG_EXT.2 helps mitigate the threat of physical access by ensuring that biometric authentication cannot be exploited by an improper user. | |
FIA_BMG_EXT.3 (objective) | FIA_BMG_EXT.3 helps mitigate the threat of physical access by ensuring that biometric authentication cannot be exploited by an improper user. | |
FIA_BMG_EXT.4 (objective) | FIA_BMG_EXT.4 helps mitigate the threat of physical access by ensuring that biometric authentication cannot be exploited by an improper user. | |
FIA_BMG_EXT.5 (objective) | FIA_BMG_EXT.5 helps mitigate the threat of physical access by ensuring that biometric authentication cannot be exploited by an improper user. | |
FIA_BMG_EXT.6 (objective) | FIA_BMG_EXT.6 helps mitigate the threat of physical access by ensuring that biometric authentication cannot be exploited by an improper user. | |
FCS_CKM_EXT.7 (selection-based) | FCS_CKM_EXT.7 helps mitigate the threat of physical access by preventing REKs from being read or exported. | |
FCS_RBG.2 (selection-based) | FCS_RBG.2 helps mitigate the threat of network eavesdrop by ensuring that the TOE's DRBG is seeded with sufficient entropy to ensure the generation of strong cryptographic keys. | |
FCS_RBG.3 (selection-based) | FCS_RBG.3 helps mitigate the threat of physical access by ensuring that the TOE's DRBG is seeded with sufficient entropy to ensure the generation of strong cryptographic keys. | |
FCS_RBG.4 (selection-based) | FCS_RBG.4 helps mitigate the threat of physical access by ensuring that the TOE's DRBG is seeded with sufficient entropy to ensure the generation of strong cryptographic keys. | |
FCS_RBG.5 (selection-based) | FCS_RBG.5 helps mitigate the threat of physical access by ensuring that the TOE's DRBG is seeded with sufficient entropy to ensure the generation of strong cryptographic keys. | |
T.MALICIOUS_APP | FAU_GEN.1 | FAU_GEN.1 helps mitigate the threat of a malicious app by logging evidence of potential malicious activity. |
FAU_STG.1 | FAU_STG.1 helps mitigate the threat of a malicious app by maintaining the availability of the audit trail. | |
FAU_STG.4 | FAU_STG.4 helps mitigate the threat of a malicious app by maintaining the availability of the audit trail. | |
FCS_RBG.6 | FCS_RBG.6 helps mitigate the threat of a malicious app by providing a secure and legitimate interface that can be invoked by apps to perform DRBG functionality. | |
FCS_SRV_EXT.1 | FCS_SRV_EXT.1 helps mitigate the threat of a malicious app by providing a secure and legitimate interface that can be invoked by apps to perform cryptographic functionality. | |
FDP_ACF_EXT.1 | FDP_ACF_EXT.1 helps mitigate the threat of a malicious app by restricting the system services that are accessible to applications. | |
FMT_MOF_EXT.1 | FMT_MOF_EXT.1 helps mitigate the threat of a malicious app by limiting the management functions that are available to a given user. | |
FMT_SMF_EXT.1 | FMT_SMF_EXT.1 helps mitigate the threat of a malicious app by defining the management functions that are provided by the TOE. | |
FMT_SMF_EXT.2 | FMT_SMF_EXT.2 helps mitigate the threat of a malicious app by ensuring that sensitive data is purged from the TOE when it is no longer enrolled in mobile device management. | |
FPT_AEX_EXT.1 | FPT_AEX_EXT.1 helps mitigate the threat of a malicious app by using address space layout randomization for all applications. | |
FPT_AEX_EXT.2 | FPT_AEX_EXT.2 helps mitigate the threat of a malicious app by enforcing memory access permissions. | |
FPT_AEX_EXT.3 | FPT_AEX_EXT.3 helps mitigate the threat of a malicious app by implementing stack-based buffer overflow protection running on non-privileged domains. | |
FPT_AEX_EXT.4 | FPT_AEX_EXT.4 helps mitigate the threat of a malicious app by enforcing address space isolation. | |
FPT_NOT_EXT.1 | FPT_NOT_EXT.1 helps mitigate the threat of a malicious app by failing to a secure state when self-test failures occur. | |
FPT_STM.1 | FPT_STM.1 helps mitigate the threat of a malicious app by providing reliable time stamps for the audit trail. | |
FPT_TST_EXT.1 | FPT_TST_EXT.1 helps mitigate the threat of a malicious app by performing self-tests that may detect a compromise of the TSF. | |
FPT_TST_EXT.2/PREKERNEL | FPT_TST_EXT.2/PREKERNEL helps mitigate the threat of a malicious app by performing self-tests that may detect a compromise of the TSF. | |
FPT_TUD_EXT.1 | FPT_TUD_EXT.1 helps mitigate the threat of a malicious app by enforcing mechanisms that allow for the identification of the TSF and of applications running on it. | |
FPT_TUD_EXT.2 | FPT_TUD_EXT.2 helps mitigate the threat of a malicious app by enforcing mechanisms that allow for maintaining the authenticity and integrity of the TSF. | |
FPT_TUD_EXT.3 | FPT_TUD_EXT.3 helps mitigate the threat of a malicious app by enforcing mechanisms that allow for maintaining the authenticity and integrity of installed apps. | |
FAU_SAR.1 (objective) | FAU_SAR.1 helps mitigate the threat of a malicious app by providing a mechanism to read the audit trail. | |
FAU_SEL.1 (objective) | FAU_SEL.1 helps mitigate the threat of a network attack by allowing the TSF to determine the behavior that indicates potential malicious activity in the audit trail. | |
FCS_SRV_EXT.2 (objective) | FCS_SRV_EXT.1 helps mitigate the threat of a malicious app by providing a secure and legitimate interface that can be invoked by apps to interact with protected storage. | |
FDP_ACF_EXT.3 (objective) | FDP_ACF_EXT.3 helps mitigate the threat of a malicious app by enforcing policies on applications that prohibit write and execute permissions from being granted simultaneously. | |
FDP_BCK_EXT.1 (objective) | FDP_BCK_EXT.1 helps mitigate the threat of a malicious app by determining which data to include in backup operations. | |
FDP_BLT_EXT.1 (objective) | FDP_BLT_EXT.1 helps mitigate the threat of a malicious app by managing which applications communicate with Bluetooth devices. | |
FMT_SMF_EXT.3 (objective) | FMT_SMF_EXT.3 helps mitigate the threat of a malicious app by providing a current list of authorized administrators and their authorized management functions. | |
FPT_AEX_EXT.5 (objective) | FPT_AEX_EXT.5 helps mitigate the threat of a malicious app by enforcing kernel level ASLR. | |
FPT_AEX_EXT.6 (objective) | FPT_AEX_EXT.6 helps mitigate the threat of a malicious app by preventing non-privileged execution domains from being writable and executable. | |
FPT_AEX_EXT.7 (objective) | FPT_AEX_EXT.7 helps mitigate the threat of a malicious app by enforcing heap-based buffer overflow protections. | |
FPT_BBD_EXT.1 (objective) | FPT_BBD_EXT.1 helps mitigate the threat of a malicious app by preventing the application processor's executable memory from being modified by the baseband processor. | |
FPT_BLT_EXT.1 (objective) | FPT_BLT_EXT.1 helps mitigate the threat of a malicious app by enforcing least functionality of the TOE's Bluetooth interface. | |
FPT_NOT_EXT.2 (objective) | FPT_NOT_EXT.2 helps mitigate the threat of a malicious app by enforcing remote attestation to ensure that the TSF has not been compromised. | |
FPT_TST_EXT.2/POSTKERNEL (objective) | FPT_TST_EXT.2/POSTKERNEL helps mitigate the threat of a malicious app by verifying the integrity of executable code after the kernel is loaded. | |
FPT_TUD_EXT.5 (objective) | FPT_TUD_EXT.5 helps mitigate the threat of a malicious app by enforcing installation of only trusted mobile application software. | |
FPT_TUD_EXT.6 (objective) | FPT_TUD_EXT.6 helps mitigate the threat of a malicious app by preventing intentional rollback of software updates. | |
FDP_ACF_EXT.2 (selection-based) | FDP_ACF_EXT.2 helps mitigate the threat of a malicious app by providing separate copies of system resources for different application groups. | |
FPT_TST_EXT.3 (selection-based) | FPT_TST_EXT.3 helps mitigate the threat of a malicious app by preventing the execution of untrusted application code. | |
FPT_TUD_EXT.4 (selection-based) | FPT_TUD_EXT.4 helps mitigate the threat of a malicious app by preventing the execution of untrusted updates. | |
T.PERSISTENT_PRESENCE | FMT_MOF_EXT.1 | FMT_MOF_EXT.1 helps mitigate the threat of persistent presence by enforcing limitations on TSF usage when it is enrolled in mobile device management. |
FMT_SMF_EXT.1 | FMT_SMF_EXT.1 helps mitigate the threat of persistent presence by defining the management functions that are supported by the TOE. | |
FMT_SMF_EXT.2 | FMT_SMF_EXT.2 helps mitigate the threat of persistent presence by maintaining a secure state of the TOE if it is unenrolled from mobile device management. | |
FPT_NOT_EXT.1 | FPT_NOT_EXT.1 helps mitigate the threat of persistent presence by having the TOE enter a secure failure state when self-test integrity failures occur. | |
FPT_TST_EXT.1 | FPT_TST_EXT.1 helps mitigate the threat of a persistent presence by performing self-tests to verify the integrity of the TSF. | |
FPT_TST_EXT.2/PREKERNEL | FPT_TST_EXT.2/PREKERNEL helps mitigate the threat of a persistent presence by performing self-tests to verify the integrity of the TSF. | |
FPT_TUD_EXT.2 | FPT_TUD_EXT.2 helps mitigate the threat of a persistent presence by ensuring that only legitimate updates are applied to the TOE. | |
FPT_TUD_EXT.3 | FPT_TUD_EXT.3 helps mitigate the threat of a persistent presence by ensuring mobile application software updates are digitally signed prior to installation. | |
FPT_TUD_EXT.5 (objective) | FPT_TUD_EXT.5 helps mitigate the threat of a persistent presence by enforcing mobile application software verification by X.509v3 prior to installation. | |
FPT_TUD_EXT.6 (objective) | FPT_TUD_EXT.6 helps mitigate the threat of a persistent presence by preventing intentional rollback of software updates. | |
FPT_TST_EXT.3 (selection-based) | FPT_TST_EXT.3 helps mitigate the threat of a persistent presence by preventing the execution of untrusted application code. | |
FPT_TUD_EXT.4 (selection-based) | FPT_TUD_EXT.4 helps mitigate the threat of a persistent presence by preventing the execution of untrusted updates. |
Assurance Class | Assurance Components |
Security Target (ASE) | Conformance Claims (ASE_CCL.1) |
Extended Components Definition (ASE_ECD.1) | |
ST Introduction (ASE_INT.1) | |
Security Objectives for the Operational Environment (ASE_OBJ.1) | |
Stated Security Requirements (ASE_REQ.1) | |
Security Problem Definition (ASE_SPD.1) | |
TOE Summary Specification (ASE_TSS.1) | |
Development (ADV) | Basic Functional Specification (ADV_FSP.1) |
Guidance Documents (AGD) | Operational User Guidance (AGD_OPE.1) |
Preparative Procedures (AGD_PRE.1) | |
Life Cycle Support (ALC) | Labeling of the TOE (ALC_CMC.1) |
TOE CM Coverage (ALC_CMS.1) | |
Timely Security Updates (ALC_TSU_EXT) | |
Tests (ATE) | Independent Testing – Sample (ATE_IND.1) |
Vulnerability Assessment (AVA) | Vulnerability Survey (AVA_VAN.1) |
As indicated in the introduction to this PP, the baseline requirements (those that must be performed by the TOE or its underlying platform) are contained in the body of this PP. There are additional requirements based on selections in the body of the PP: if certain selections are made, then additional requirements below must be included.
This appendix lists requirements that should be considered satisfied by products successfully evaluated against this PP. These requirements are not featured explicitly as SFRs and should not be included in the ST. They are not included as standalone SFRs because it would increase the time, cost, and complexity of evaluation. This approach is permitted by [CC] Part 1, 8.3 Dependencies between components.
This information benefits systems engineering activities which call for inclusion of particular security controls. Evaluation against the PP provides evidence that these controls are present and have been evaluated.
Requirement | Rationale for Satisfaction |
---|---|
FAU_SEL.1 - Selective Audit | FAU_SEL.1 has a dependency on FMT_MTD.1 since configuration of audit data is a subset of managing TSF data. This dependency is met by the extended SFR FMT_SMF_EXT.1, which defines "configure the auditable items" as a management function and specifies the roles that may perform this, consistent with how FMT_MTD.1 would typically satisfy the dependency. |
FCS_CKM.1 - Cryptographic Key Generation | FCS_CKM.1 has a dependency on FCS_CKM.4 for the subsequent destruction of any keys that the TSF generates. This dependency is met by the extended SFR FCS_CKM_EXT.4, which serves the same purpose. |
FCS_CKM.1 - Cryptographic Key Generation | FCS_CKM.1 has a dependency on FCS_CKM.4 for the subsequent destruction of any keys that the TSF generates. This dependency is met by the extended SFR FCS_CKM_EXT.4, which serves the same purpose as its CC Part 2 equivalent. |
FCS_CKM.2 - Cryptographic Key Establishment | Both iterations of FCS_CKM.2 have a dependency on FCS_CKM.4 for the subsequent destruction of any keys that the TSF establishes. This dependency is met by the extended SFR FCS_CKM_EXT.4, which serves the same purpose as its CC Part 2 equivalent. |
FCS_COP.1 - Cryptographic Operation | All iterations of FCS_COP.1 have a dependency on FCS_CKM.4 for the subsequent destruction of any residual key material the TSF creates as part of the operation. This dependency is met by the extended SFR FCS_CKM_EXT.4, which serves the same purpose as its CC Part 2 equivalent. |
FIA_UAU.7 - Protected Authentication Feedback | FIA_UAU.7 has a dependency on FIA_UAU.1 since protected authentication feedback is not possible without an authentication mechanism. This dependency is met by the extended SFR FIA_UAU_EXT.1, which serves the same purpose as its CC Part 2 equivalent. |
Requirement | Action |
FCS_STG_EXT.1.4 | Do not select "the user." |
FMT_MOF_EXT.1.2 Function 21 | Include in the ST. |
FMT_MOF_EXT.1.2 Function 25 | Include in ST. Assign personal Hotspot connections (if feature exists). |
FMT_MOF_EXT.1.2 Function 36 | Include in ST. |
FMT_MOF_EXT.1.2 Function 39 | Include in ST. Select "USB Mass storage mode." |
FMT_MOF_EXT.1.2 Function 41 | Include in ST. Select "USB tethering." |
FMT_SMF_EXT.1.1 Function 25 | Include in ST. Assign personal Hotspot connections (if feature exists). |
FMT_SMF_EXT.1.1 Function 36 | Include in ST. |
FMT_SMF_EXT.1.1 Function 39 | Include in ST. Select "USB Mass storage mode." |
FMT_SMF_EXT.1.1 Function 41 | Include in ST. Select both options. |
FPT_BBD_EXT.1.1 | Include in ST. |
FPT_TST_EXT.2.1/POSTKERNEL | Include in ST and Select "all executable code stored in mutable media." |
FPT_TUD_EXT.5.1 | Include in ST. |
FTA_TAB.1.1 | Include in ST. |
Requirement | Action |
FCS_CKM.1.1 | Select RSA with key size of 3072 or select ECC schemes. |
FCS_CKM.2.1/UNLOCKED | Select ECC schemes, if ECC schemes are selected in FCS_CKM.1.1. |
FCS_CKM.2.1/LOCKED | Select "RSA schemes" or select "ECC schemes that meet NIST SP 800-56A Revision 3". |
FCS_CKM_EXT.1.1 | If "symmetric" is selected then "256 bits" must be selected. If "asymmetric" is selected and RSA scheme is selected in FCS_CKM.1.1 then "128 bits" can be selected. If "asymmetric" is selected and ECC scheme is selected in FCS_CKM.1.1, then "192 bits" can be selected. |
FCS_CKM_EXT.2.1 | Select 256 bits. |
FCS_CKM_EXT.3.1 | If asymmetric KEKs is selected and RSA scheme is selected in FCS_CKM.1.1 then assign 128 bits security strength. If asymmetric KEKs is selected and ECC scheme is selected in FCS_CKM.1.1 then assign 192 bits security strength. If symmetric KEKs is selected, select 256 bit security strength. |
FCS_COP.1.1/ENCRYPT | Select 256 bits. |
FCS_COP.1.1/HASH | Select SHA-384. |
FCS_COP.1.1/SIGN | Assign a key size of 3072 for RSA or select ECDSA schemes. |
FCS_COP.1.1/CONDITION | Select 256 bits. |
FCS_RBG.2.1, FCS_RBG.3.1, or FCS_RBG.5.1 | Complete the min-entropy assignment with 256 bits. |
FCS_TLSC_EXT.1.2 (TLS Package) | Select TLS_RSA_WITH_AES_256_GCM_SHA384 or TLS_ECDHE_ECDSA_WITH AES_256_GCM_SHA384. |
FCS_TLSC_EXT.1.4 (TLS Package) | Select "supported_groups extension..." and secp384r1, if included in ST (if ECC schemes are selected in FCS_CKM.1.1). |
FDP_DAR_EXT.1.2 | Select 256 bits. |
FIA_X509_EXT.2.2 (X.509 Package) | Select either "administrator is allowed to configure..." or "certificate is not accepted". |
FMT_MOF_EXT.1.2 Function 3 | Include in ST. |
FMT_MOF_EXT.1.2 Function 4 | Assign all radios on TSF. |
FMT_MOF_EXT.1.2 Function 5 | Assign all audio or visual collection devices on TSF. |
FMT_MOF_EXT.1.2 Function 19 | Include in ST. |
FMT_MOF_EXT.1.2 Function 21 | Include in ST. |
FMT_MOF_EXT.1.2 Function 44 | Include in ST. |
FMT_MOF_EXT.1.2 Function 45 | Include in ST (if IPsec is selected in FTP_ITC_EXT.1). |
FMT_SMF_EXT.1.1 Function 12 | Assign all X.509v3 certificates in the Trust Anchor Database. |
FMT_SMF_EXT.1.1 Function 18 | Select "f. all notifications". |
FMT_SMF_EXT.1.1 Function 24 | Include in ST. Assign at least USB. |
FMT_SMF_EXT.1.1 Function 25 | Include in ST. Assign all protocols where the TSF acts as a server. |
FMT_SMF_EXT.1.1 Function 36 | Include in ST. |
FMT_SMF_EXT.2.1 | Select "wipe of protected data" and "wipe of sensitive data". |
FAU_SAR.1.1 | Include in ST. |
FAU_SAR.1.2 | Include in ST. |
FAU_SEL.1.1 | Include in ST. Select "event type", "success of auditable security events", and "failure of auditable security events". |
FCS_SRV_EXT.2.1 | Include in ST. |
FPT_AEX_EXT.5.1 | Include in ST. |
FPT_AEX_EXT.5.2 | Include in ST. |
FPT_BBD_EXT.1.1 | Include in ST. |
FTA_TAB.1.1 | Include in ST. |
Requirement | Action |
FMT_SMF_EXT.1.1 Function 3 | Select "b. on a per-app basis", "c. on a per-groups of application basis" or both |
FMT_SMF_EXT.1.1 Function 5 | Select "b. on a per-app basis", "c. on a per-groups of application basis" or both |
FMT_SMF_EXT.1.1 Function 17 | Include in ST. |
FMT_SMF_EXT.1.1 Function 28 | Include in ST. |
FMT_SMF_EXT.1.1 Function 44 | Include in ST (M-M-) |
FMT_SMF_EXT.2.1 | Select "Remove Enterprise Applications" |
FDP_ACF_EXT.1.2 | Select "Groups of Applications" |
FDP_ACF_EXT.2.1 | Include in ST. |
Cipher Mode | Reference | IV Requirements |
Electronic Codebook (ECB) | SP 800-38A | No IV |
Counter (CTR) | SP 800-38A | "Initial Counter" shall be non-repeating. No counter value shall be repeated across multiple messages with the same secret key. |
Cipher Block Chaining (CBC) | SP 800-38A | IVs shall be unpredictable. Repeating IVs leak information about whether the first one or more blocks are shared between two messages, so IVs should be non-repeating in such situations. |
Output Feedback (OFB) | SP 800-38A | IVs shall be non-repeating and shall not be generated by invoking the cipher on another IV. |
Cipher Feedback (CFB) | SP 800-38A | IVs should be non-repeating as repeating IVs leak information about the first plaintext block and about common shared prefixes in messages. |
XEX (XOR Encrypt XOR) Tweakable Block Cipher with Ciphertext Stealing (XTS) | SP 800-38E | No IV. Tweak values shall be non-negative integers, assigned consecutively, and starting at an arbitrary non-negative integer. |
Cipher-based Message Authentication Code (CMAC) | SP 800-38B | No IV |
Key Wrap and Key Wrap with Padding | SP 800-38F | No IV |
Counter with CBC-Message Authentication Code (CCM) | SP 800-38C | No IV. Nonces shall be non-repeating. |
Galois Counter Mode (GCM) | SP 800-38D | IV shall be non-repeating. The number of invocations of GCM shall not exceed $2^{32}$ for a given secret key unless an implementation only uses 96-bit IVs (default length). |
False Error Rate | False error rates, 90% confidence, c = 0.95 | Number of errors (rounded) | Number of test subjects needed |
1% (1:100) | 1% ± 0.95% | 3 | 297 |
0.1% (1:1000) | 0.1% ± 0.095% | 3 | 2995 |
0.01% (1:10000) | 0.01% ± 0.0095% | 3 | 29977 |
0.001% (1:100000) | 0.001% ± 0.00095% | 3 | 299797 |
0.0001% (1:1000000) | 0.0001% ± 0.000095% | 3 | 2997998 |
False Error Rate | False error rates, 90% confidence, c = 0.95 | Number of errors (rounded) | Number of test subjects needed |
1% (1:100) | 1% ± 0.95% | 3 | 297/ND |
0.1% (1:1000) | 0.1% ± 0.095% | 3 | 2995/ND |
0.01% (1:10000) | 0.01% ± 0.0095% | 3 | 29977/ND |
0.001% (1:100000) | 0.001% ± 0.00095% | 3 | 299797/ND |
0.0001% (1:1000000) | 0.0001% ± 0.000095% | 3 | 2997998/ND |
False Error Rate | False error rates, 90% confidence, c = 0.95 | Number of errors (rounded) | Number of test subjects needed |
1% (1:100) | 1% ± 0.95% | 3 | 25 |
0.1% (1:1000) | 0.1% ± 0.095% | 3 | 78 |
0.01% (1:10000) | 0.01% ± 0.0095% | 3 | 246 |
0.001% (1:100000) | 0.001% ± 0.00095% | 3 | 776 |
0.0001% (1:1000000) | 0.0001% ± 0.000095% | 3 | 2450 |
False Error Rate | False error rates, 90% confidence, c = 0.95 | Number of errors (rounded) | Number of test subjects needed |
10% (1:10) | 10% ± 9.5% | 3 | 27 |
5% (1:20) | 5% ± 4.75% | 3 | 57 |
2% (1:50) | 2% ± 1.9% | 3 | 147 |
1% (1:100) | 1% ± 0.95% | 3 | 297 |
Acronym | Meaning |
---|---|
AEAD | Authenticated Encryption with Associated Data |
AES | Advanced Encryption Standard |
ANSI | American National Standards Institute |
AP | Application Processor |
API | Application Programming Interface |
ASLR | Address Space Layout Randomization |
BAF | Biometric Authentication Factor |
Base-PP | Base Protection Profile |
BP | Baseband Processor |
BR/EDR | (Bluetooth) Basic Rate/Enhanced Data Rate |
BYOD | Bring Your Own Device |
CA | Certificate Authority |
CBC | Cipher Block Chaining |
CC | Common Criteria |
CCM | Counter with CBC-Message Authentication Code |
CCMP | CCM Protocol |
CEM | Common Evaluation Methodology |
CMC | Certificate Management over Cryptographic Message Syntax (CMS) |
cPP | Collaborative Protection Profile |
CPU | Central Processing Unit |
CRL | Certificate Revocation List |
CSP | Critical Security Parameter |
DAR | Data At Rest |
DEK | Data Encryption Key |
DEP | Data Execution Prevention |
DH | Diffie-Hellman |
DNS | Domain Name System |
DSA | Digital Signature Algorithm |
DTLS | Datagram Transport Layer Security |
EAP | Extensible Authentication Protocol |
EAPOL | EAP Over LAN |
ECDH | Elliptic Curve Diffie Hellman |
ECDSA | Elliptic Curve Digital Signature Algorithm |
EEPROM | Electrically Erasable Programmable Read-Only Memory |
EP | Extended Package |
EST | Enrollment over Secure Transport |
FAR | False Accept Rate |
FEK | File Encryption Key |
FFC | Finite Field Cryptography |
FIPS | Federal Information Processing Standards |
FM | Frequency Modulation |
FP | Functional Package |
FQDN | Fully Qualified Domain Name |
FRR | False Reject Rate |
GCM | Galois Counter Mode |
GPS | Global Positioning System |
GPU | Graphics Processing Unit |
HDMI | High Definition Multimedia Interface |
HMAC | Keyed-Hash Message Authentication Code |
HTTPS | HyperText Transfer Protocol Secure |
IEEE | Institute of Electrical and Electronics Engineers |
IP | Internet Protocol |
IPC | Inter-Process Communication |
IPsec | Internet Protocol Security |
KAT | Known Answer Test |
KDF | Key Derivation Function |
KEK | Key Encryption Key |
LE | (Bluetooth) Low Energy |
LTE | Long Term Evolution |
MD | Mobile Device |
MDM | Mobile Device Management |
MMI | Man-Machine Interface |
MMS | Multimedia Messaging Service |
MMU | Memory Management Unit |
NFC | Near Field Communication |
NFIQ | NIST Fingerprint Image Quality |
NIST | National Institute of Standards and Technology |
NTP | Network Time Protocol |
NX | Never Execute |
OCSP | Online Certificate Status Protocol |
OE | Operational Environment |
OID | Object Identifier |
OS | Operating System |
OTA | Over the Air |
PAD | Presentation Attack Detection |
PAE | Port Access Entity |
PBKDF | Password-Based Key Derivation Function |
PD | Protected Data |
PIV | Personal Identity Verification |
PMK | Pairwise Master Key |
PP | Protection Profile |
PP-Configuration | Protection Profile Configuration |
PP-Module | Protection Profile Module |
PRF | Pseudorandom Function |
PSK | Pre-Shared Key |
PTK | Pairwise Temporal Key |
RA | Registration Authority |
RBG | Random Bit Generator |
REK | Root Encryption Key |
ROM | Read-only memory |
RSA | Rivest Shamir Adleman Algorithm |
SAFAR | System Authentication False Accept Rate |
SAR | Security Assurance Requirement |
SFR | Security Functional Requirement |
SHA | Secure Hash Algorithm |
SMS | Short Messaging Service |
SoC | System On a Chip |
SPI | Security Parameter Index |
SSH | Secure Shell |
SSID | Service Set Identifier |
ST | Security Target |
TLS | Transport Layer Security |
TOE | Target of Evaluation |
TSF | TOE Security Functionality |
TSFI | TSF Interface |
TSS | TOE Summary Specification |
URI | Uniform Resource Identifier |
USB | Universal Serial Bus |
USSD | Unstructured Supplementary Service Data |
VPN | Virtual Private Network |
XCCDF | eXtensible Configuration Checklist Description Format |
XTS | XEX (XOR Encrypt XOR) Tweakable Block Cipher with Ciphertext Stealing |
Identifier | Title |
---|---|
[ANSI 409.1] | ANSI/CITS 409.1-2005. Biometrics Performance Testing and Reporting—Part 1: Principles and Findings." Annex B. ANSI/CITS, 2005. |
[BROWN] | Interval Estimation for a Binomial Proportion.Brown, Cai, and DasGupta. |
[CC] | Common Criteria for Information Technology Security Evaluation -
|
[CEM] | Common Methodology for Information Technology Security Evaluation -
|
[IBPC] | On security evaluation of fingerprint recognition systems-- IBPC Presentation., Henniger, Scheuermann, and Kniess.International Biometric Performance Testing Conference (IBPC), 2010. Retrieved June 12, 2015. |
[ISO 19989] | ISO/IEC NP 19989: Evaluation of presentation attack detection for biometrics International Organization for Standardization (ISO), 2014. |
[NFIQ 1.0] | NIST Fingerprint Image Quality and relation to PIV, Tabassi, Elham. NIST Information Technology Laboratory, 2005. Retrieved June 13, 2015. |
[NFIQ 2.0] | Biometric Quality: The push towards zero error biometrics., Tabassi, Elham et al. International Biometrics Performance Conference (IBPC), 2016. Retrieved May 30, 2016. |
[NIST] | The NIST speaker recognition evaluation—Overview, methodology, systems, results, perspective, Doddington, Przybocki, Martin, and Reynolds. Speech Communication 31: Elsevier, 2000, Retrieved June 10, 2015. |