Version | Date | Comment |
---|---|---|
1.0 | 2013-10-21 | Initial Release |
1.1 | 2014-01-12 | Typographical changes and additional clarifications in application notes. Removed assignment from FCS_TLS_EXT.1 and limited testing to those ciphersuites in both FCS_TLS_EXT.1 and FCS_TLS_EXT.2. |
2.0 | 2015-09-14 | Included changes based on Technical Rapid Response Team Decisions. Clarified many
requirements and evaluation activities. Mandated objective requirements:
Included hardware-isolated REK and key storage selections. Allowed key derivation by REK. Clarified FTP_ITC_EXT.1 and added FDP_UPC_EXT.1. Mandated HTTPS and TLS for application use. (FDP_UPC_EXT.1) Removed Dual_EC_DRBG as an approved DRBG. Adopted new TLS requirements. Mandated TSF Wipe upon authentication failure limit and required number of authentication failures be maintained across reboot. Clarified Management Class. Included more domain isolation discussion and tests. Updated Audit requirements and added Auditable Events table. Added SFR Category Mapping Table. Updated Use Case Templates. Moved Glossary to Introduction. |
3.0 | 2015-09-17 | Included changes based on Technical Rapid Response Team Decisions. Clarified many requirements and evaluation activities. Mandated objective requirements:
Added SFRs to support BYOD Use Case BYOD Use Case Updated key destruction SFR |
3.1 | 2017-04-05 | Included changes based on Technical Rapid Response Team Decisions and incorporated
Technical Decisions. Modified biometric requirements:
FCS_STG_EXT.2.2 - Modified to require long term trusted channel key material be encrypted by an approved method. FIA_UAU_EXT.1.1 - Modified to allow the long term trusted channel key material to be available prior to password being entered at start-up. |
3.2 | 2021-04-15 | Removed TLS SFRs and utilized TLS Functional Package Removed Bluetooth SFRs and utilized Bluetooth Module. Bluetooth SFR moved to Implementation Dependent. FPT_TUD_EXT.4.2 renumbered to FPT_TUD_EXT.5.1 |
3.3 | 2022-09-12 | Integrated Biometrics cPP Module, Included changes based on Technical Rapid Response Team Decisions and open issues from GitHub. |
Assurance | Grounds for confidence that a TOE meets the SFRs [CC]. |
Base Protection Profile (Base-PP) | Protection Profile used as a basis to build a PP-Configuration. |
Collaborative Protection Profile (cPP) | A Protection Profile developed by international technical communities and approved by multiple schemes. |
Common Criteria (CC) | Common Criteria for Information Technology Security Evaluation (International Standard ISO/IEC 15408). |
Common Criteria Testing Laboratory | Within the context of the Common Criteria Evaluation and Validation Scheme (CCEVS), an IT security evaluation facility accredited by the National Voluntary Laboratory Accreditation Program (NVLAP) and approved by the NIAP Validation Body to conduct Common Criteria-based evaluations. |
Common Evaluation Methodology (CEM) | Common Evaluation Methodology for Information Technology Security Evaluation. |
Distributed TOE | A TOE composed of multiple components operating as a logical whole. |
Extended Package (EP) | A deprecated document form for collecting SFRs that implement a particular protocol, technology, or functionality. See Functional Packages. |
Functional Package (FP) | A document that collects SFRs for a particular protocol, technology, or functionality. |
Operational Environment (OE) | Hardware and software that are outside the TOE boundary that support the TOE functionality and security policy. |
Protection Profile (PP) | An implementation-independent set of security requirements for a category of products. |
Protection Profile Configuration (PP-Configuration) | A comprehensive set of security requirements for a product type that consists of at least one Base-PP and at least one PP-Module. |
Protection Profile Module (PP-Module) | An implementation-independent statement of security needs for a TOE type complementary to one or more Base-PPs. |
Security Assurance Requirement (SAR) | A requirement to assure the security of the TOE. |
Security Functional Requirement (SFR) | A requirement for security enforcement by the TOE. |
Security Target (ST) | A set of implementation-dependent security requirements for a specific product. |
Target of Evaluation (TOE) | The product under evaluation. |
TOE Security Functionality (TSF) | The security functionality of the product under evaluation. |
TOE Summary Specification (TSS) | A description of how a TOE satisfies the SFRs in an ST. |
Address Space Layout Randomization (ASLR) | An anti-exploitation feature, which loads memory mappings into unpredictable locations. ASLR makes it more difficult for an attacker to redirect control to code that they have introduced into the address space of a process or the kernel. |
Administrator | The Administrator is responsible for management activities, including setting the policy that is applied by the enterprise on the Mobile Device. This administrator is likely to be acting remotely and could be the Mobile Device Management (MDM) Administrator acting through an MDM Agent. If the device is unenrolled, the user is the administrator. |
Auxiliary Boot Modes | Auxiliary boot modes are states in which the device provides power to one or more components to provide an interface that enables an unauthenticated user to interact with either a specific component or several components that exist outside of the device’s fully authenticated, operational state. |
Biometric Authentication Factor (BAF) | Authentication factor, which uses biometric sample, matched to a biometric authentication template to help establish identity. |
Common Application Developer | Application developers (or software companies) often produce many applications under the same name. Mobile devices often allow shared resources by such applications where otherwise resources would not be shared. |
Critical Security Parameter (CSP) | Security-related information whose disclosure or modification can compromise the security of a cryptographic module or authentication system. |
Data | Program/application or data files that are stored or transmitted by a server or Mobile Device (MD). |
Data Encryption Key (DEK) | A key used to encrypt data-at-rest. |
Developer Modes | Developer modes are states in which additional services are available to a user in order to provide enhanced system access for debugging of software. |
Encrypted Software Keys | These keys are stored in the main file system encrypted by another key and can be changed and sanitized. |
Enrolled State | The state in which the Mobile Device is managed with active policy settings from the administrator. |
Enterprise Data | Enterprise data is any data residing in the enterprise servers, or temporarily stored on Mobile Devices to which the Mobile Device user is allowed access according to security policy defined by the enterprise and implemented by the administrator. |
Ephemeral Keys | These keys are stored in volatile memory. |
File Encryption Key (FEK) | A DEK used to encrypt a file or a director when File Encryption is used. FEKs are unique to each encrypted file or directory. |
Hardware-Isolated Keys | The OS can only access these keys by reference, if at all, during runtime. |
Hybrid Authentication | A hybrid authentication factor is one where a user has to submit a combination of a biometric sample and a PIN or password and both must pass. If either factor fails, the entire attempt fails. The user shall not be made aware of which factor failed, if either fails. |
Immutable Hardware Key | These keys are stored as hardware-protected raw key and cannot be changed or sanitized. |
Key Chaining | The method of using multiple layers of encryption keys to protect data. A top layer key encrypts a lower layer key, which encrypts the data; this method can have any number of layers. |
Key Encryption Key (KEK) | A key used to encrypt other keys, such as DEKs or storage that contains keys. |
Locked State | Powered on but most functionality is unavailable for use. User authentication is required to access functionality. |
MDM Agent | The MDM Agent is installed on a Mobile Device as an application or is part of the Mobile Device’s OS. The MDM Agent establishes a secure connection back to the MDM Server controlled by the administrator. |
Minutia Point | Friction ridge characteristics that are used to individualize a fingerprint image. Minutia are the points where friction ridges begin, terminate, or split into two or more ridges. In many fingerprint systems, the minutia points are compared for recognition purposes. |
Mobile Device (MD) | A device which is composed of a hardware platform and its system software. The device typically provides wireless connectivity and may include software for functions like secure messaging, email, web, VPN (Virtual Private Network) connection, and VoIP (Voice over IP), for access to the protected enterprise network, enterprise data and applications, and for communicating to other Mobile Devices. |
Mobile Device Management (MDM) | Mobile device management (MDM) products allow enterprises to apply security policies to mobile devices. This system consists of two primary components: the MDM Server and the MDM Agent. |
Mobile Device User (User) | The individual authorized to physically control and operate the Mobile Device. Depending on the use case, this can be the device owner or an individual authorized by the device owner. |
Modality (Biometrics) | A type or class of biometric system, such as fingerprint recognition, facial recognition, iris recognition, voice recognition, signature/sign, and others. |
Mutable Hardware Key | These keys are stored as hardware-protected raw key and can be changed or sanitized. |
Operating System (OS) | Software that runs at the highest privilege level and can directly control hardware resources. Modern Mobile Devices typically have at least two primary operating systems: one, which runs on the application processor and one, which runs on the cellular baseband processor. The OS of the application processor handles most user interactions and provides the execution environment for apps. The OS of the cellular baseband processor handles communications with the cellular network and may control other peripherals. The term OS, without context, may be assumed to refer to the OS of the application processor. |
PIN Authentication Factor | A PIN is a set of numeric or alphabetic characters that may be used in addition to a biometric factor to provide a hybrid authentication factor. At this time it is not considered as a stand-alone authentication mechanism. A PIN is distinct from a password in that the allowed character set and required length of a PIN is typically smaller than that of a password as it is designed to be input quickly. |
Password Authentication Factor | A type of authentication factor requiring the user to provide a secret set of characters to gain access. |
Powered Off State | The device has been shut down such that no TOE function can be performed. |
Protected Data (PD) | Protected data is all non-TSF data, including all user or enterprise data. Some or all of this data may be considered sensitive data as well. |
Root Encryption Key (REK) | A key tied to the device used to encrypt other keys. |
Sensitive data | Sensitive data shall be identified in the TSS section of the Security Target (ST) by the ST author. Sensitive data is a subset or all of the Protected data. Sensitive data may include all user or enterprise data or may be specific application data such as emails, messaging, documents, calendar items, and contacts. Sensitive data is protected while in the locked state (FDP_DAR_EXT.2). |
Software Keys | The OS access the raw bytes of these keys during runtime. |
TSF Data | Data for the operation of the TSF upon which the enforcement of the requirements relies. |
Trust Anchor Database | A list of trusted root Certificate Authority certificates. |
Unenrolled State | The state in which the Mobile Device is not managed. |
Unlocked State | Powered on and device functionality is available for use. Implies user authentication has occurred (when so configured). |
Verification (Biometrics) | A task where the biometric system attempts to confirm an individual’s claimed identity by comparing a submitted sample to one or more previously enrolled authentication templates. |
The Mobile Device may be operated in a number of use cases. use-case-appendix provides use case templates that list those selections, assignments, and objective requirements that best support the use cases identified by this Protection Profile. In addition to providing essential security services, the Mobile Device includes the necessary security functionality to support configurations for these various use cases. Each use case may require additional configuration and applications to achieve the desired security. A selection of these use cases is elaborated below.
Several of the use case templates include objective requirements that are strongly desired for the indicated use cases. Readers can expect those requirements to be made mandatory in a future revision of this protection profile, and industry should aim to include that security functionality in products in the near-term.
As of publication of this version of the Protection Profile, meeting the requirements in Section 5 Security Requirements is necessary for all use cases.
For changes to included SFRs, selections, and assignments required for this use case, see H.1 Enterprise-owned device for general-purpose enterprise use and limited personal use.
For changes to included SFRs, selections, and assignments required for this use case, see H.2 Enterprise-owned device for specialized, high security use.
For changes to included SFRs, selections, and assignments required for this use case, see H.3 Personally-owned device for personal and enterprise use.
An ST must claim exact conformance to this PP, as defined in the CC and CEM addenda for Exact Conformance, Selection-based SFRs, and Optional SFRs (dated May 2017).
The following PP-Modules are allowed to be specified in a PP-Configuration with this PP.
Threat, Assumption, or OSP | Security Objectives | Rationale |
T.NETWORK_EAVESDROP | O.PROTECTED_COMMS | The threat T.NETWORK_EAVESDROP is countered by O.PROTECTED_COMMS as this provides the capability to communicate using one (or more) standard protocols as a means to maintain the confidentiality of data that are transmitted outside of the TOE. |
O.CONFIG | The threat T.NETWORK_EAVESDROP is countered by O.CONFIG as this provides a secure configuration of the mobile device to protect data that it processes. | |
O.AUTH | The threat T.NETWORK_EAVESDROP is countered by O.AUTH as this provides authentication of the endpoints of a trusted communication path. | |
T.NETWORK_ATTACK | O.PROTECTED_COMMS | The threat T.NETWORK_ATTACK is countered by O.PROTECTED_COMMS as this provides the capability to communicate using one (or more) standard protocols as a means to maintain the confidentiality of data that are transmitted outside of the TOE. |
O.CONFIG | The threat T.NETWORK_ATTACK is countered by O.CONFIG as this provides a secure configuration of the mobile device to protect data that it processes. | |
O.AUTH | The threat T.NETWORK_ATTACK is countered by O.AUTH as this provides authentication of the endpoints of a trusted communication path. | |
T.PHYSICAL_ACCESS | O.STORAGE | The threat T.PHYSICAL_ACCESS is countered by O.STORAGE as this provides the capability to encrypt all user and enterprise data and authentication keys to ensure the confidentiality of data that it stores. |
O.AUTH | The threat T.PHYSICAL_ACCESS is countered by O.AUTH as this provides the capability to authenticate the user prior to accessing protected functionality and data. | |
T.MALICIOUS_APP | O.PROTECTED_COMMS | The threat T.MALICIOUS_APP is countered by O.PROTECTED_COMMS as this provides the capability to communicate using one (or more) standard protocols as a means to maintain the confidentiality of data that are transmitted outside of the TOE. |
O.CONFIG | The threat T.MALICIOUS_APP is countered by O.CONFIG as this provides the capability to configure and apply security policies to ensure the Mobile Device can protect user and enterprise data that it may store or process. | |
O.AUTH | The threat T.MALICIOUS_APP is countered by O.AUTH as this provides the capability to authenticate the user and endpoints of a trusted path to ensure they are communicating with an authorized entity with appropriate privileges. | |
O.INTEGRITY | The threat T.MALICIOUS_APP is countered by O.INTEGRITY as this provides the capability to perform self-tests to ensure the integrity of critical functionality, software/firmware and data has been maintained. | |
O.PRIVACY | The threat T.MALICIOUS_APP is countered by O.PRIVACY as this provides separation and privacy between user activities. | |
T.PERSISTENT_PRESENCE | O.INTEGRITY | The threat T.PERSISTENT_PRESENCE is countered by O.INTEGRITY as this provides the capability to perform self-tests to ensure the integrity of critical functionality, software/firmware and data has been maintained. |
O.PRIVACY | The threat T.PERSISTENT_PRESENCE is countered by O.PRIVACY as this provides separation and privacy between user activities. | |
A.CONFIG | OE.CONFIG | The operational environment objective OE.CONFIG is realized through A.CONFIG. |
A.NOTIFY | OE.NOTIFY | The operational environment objective OE.NOTIFY is realized through A.NOTIFY. |
A.PRECAUTION | OE.PRECAUTION | The operational environment objective OE.PRECAUTION is realized through A.PRECAUTION. |
A.PROPER_USER | OE.DATA_PROPER_USER | The operational environment objective OE.DATA_PROPER_USER is realized through A.PROPER_USER. |
Requirement | Auditable Events | Additional Audit Record Contents |
---|---|---|
FAU_GEN.1 | ||
No events specified | N/A | |
FAU_SAR.1 | ||
No events specified | N/A | |
FAU_STG.1 | ||
No events specified | N/A | |
FAU_STG.4 | ||
No events specified | N/A | |
FCS_CKM.1 | ||
[selection, choose one of: Failure of key generation activity for authentication keys, None ] | No additional information | |
FCS_CKM.2/LOCKED | ||
No events specified | N/A | |
FCS_CKM.2/UNLOCKED | ||
No events specified | N/A | |
FCS_CKM_EXT.1 | ||
[selection, choose one of: generation of a REK, none ] | No additional information | |
FCS_CKM_EXT.2 | ||
No events specified | N/A | |
FCS_CKM_EXT.3 | ||
No events specified | N/A | |
FCS_CKM_EXT.4 | ||
No events specified | N/A | |
FCS_CKM_EXT.5 | ||
[selection, choose one of: Failure of the wipe, none ] | No additional information | |
FCS_CKM_EXT.6 | ||
No events specified | N/A | |
FCS_COP.1/CONDITION | ||
No events specified | N/A | |
FCS_COP.1/ENCRYPT | ||
No events specified | N/A | |
FCS_COP.1/HASH | ||
No events specified | N/A | |
FCS_COP.1/KEYHMAC | ||
No events specified | N/A | |
FCS_COP.1/SIGN | ||
No events specified | N/A | |
FCS_IV_EXT.1 | ||
No events specified | N/A | |
FCS_SRV_EXT.1 | ||
No events specified | N/A | |
FCS_STG_EXT.1 | ||
[selection, choose one of: Exceptions to use and destruction rules, none ] | Identity of key, role and identity of requester | |
Import or destruction of key | Identity of key, role and identity of requester | |
FCS_STG_EXT.2 | ||
No events specified | N/A | |
FCS_STG_EXT.3 | ||
Failure to verify integrity of stored key | Identity of key being verified | |
FDP_ACF_EXT.1 | ||
No events specified | N/A | |
FDP_DAR_EXT.1 | ||
[selection, choose one of: Failure to encrypt/decrypt data, none ] | No additional information | |
FDP_DAR_EXT.2 | ||
[selection, choose one of: Failure to encrypt/decrypt data, none ] | No additional information | |
FDP_IFC_EXT.1 | ||
No events specified | N/A | |
FDP_STG_EXT.1 | ||
Addition or removal of certificate from Trust Anchor Database | Subject name of certificate. | |
FIA_PMG_EXT.1 | ||
No events specified | N/A | |
FIA_TRT_EXT.1 | ||
No events specified | N/A | |
FIA_UAU.5 | ||
No events specified | N/A | |
FIA_UAU.7 | ||
No events specified | N/A | |
FIA_UAU_EXT.1 | ||
No events specified | N/A | |
FIA_X509_EXT.1 | ||
Failure to validate X.509v3 certificate | Reason for failure of validation | |
FIA_X509_EXT.2 | ||
No events specified | N/A | |
FMT_MOF_EXT.1 | ||
No events specified | N/A | |
FPT_AEX_EXT.1 | ||
No events specified | N/A | |
FPT_AEX_EXT.2 | ||
No events specified | N/A | |
FPT_AEX_EXT.3 | ||
No events specified | N/A | |
FPT_JTA_EXT.1 | ||
No events specified | N/A | |
FPT_KST_EXT.1 | ||
No events specified | N/A | |
FPT_KST_EXT.2 | ||
No events specified | N/A | |
FPT_KST_EXT.3 | ||
No events specified | N/A | |
FPT_NOT_EXT.1 | ||
[selection, choose one of: Measurement of TSF software, none ] | [selection, choose one of: Integrity verification value, No additional information ] | |
FPT_STM.1 | ||
No events specified | N/A | |
FPT_TST_EXT.1 | ||
Initiation of self-test | No additional information | |
Failure of self-test | [selection, choose one of: Algorithm that caused the failure, No additional information ] | |
FPT_TST_EXT.2/PREKERNEL | ||
Start-up of TOE | No additional information | |
[selection, choose one of: Detected integrity violation, none ] | [selection, choose one of: The TSF code file that caused the integrity violation, No additional information ] | |
FPT_TUD_EXT.1 | ||
No events specified | N/A | |
FTA_SSL_EXT.1 | ||
No events specified | N/A | |
FTA_TAB.1 | ||
No events specified | N/A |
Requirement | Auditable Events | Additional Audit Record Contents |
---|---|---|
FAU_SEL.1 | ||
All modifications to the audit configuration that occur while the audit collection functions are operating | No additional information | |
FCS_CKM_EXT.7 | ||
No events specified | N/A | |
FCS_HTTPS_EXT.1 | ||
Failure of the certificate validity check. |
| |
FCS_RBG_EXT.1 | ||
Failure of the randomization process | No additional information | |
FCS_RBG_EXT.2 | ||
No events specified | N/A | |
FCS_RBG_EXT.3 | ||
No events specified | N/A | |
FCS_SRV_EXT.2 | ||
No events specified | N/A | |
FDP_ACF_EXT.1 | ||
No events specified | N/A | |
FDP_ACF_EXT.2 | ||
No events specified | N/A | |
FDP_ACF_EXT.3 | ||
No events specified | N/A | |
FDP_BCK_EXT.1 | ||
No events specified | N/A | |
FDP_UPC_EXT.1/APPS | ||
Application initiation of trusted channel | Name of application. Trusted channel protocol. Non-TOE endpoint of connection | |
FDP_UPC_EXT.1/BLUETOOTH | ||
Application initiation of trusted channel | Name of application. Trusted channel protocol. Non-TOE endpoint of connection | |
FIA_AFL_EXT.1 | ||
Excess of authentication failure limit | Authentication factor used | |
FIA_UAU.6/LOCKED | ||
User changes Password Authentication Factor | No additional information | |
FIA_UAU_EXT.2 | ||
Action performed before authentication. | No additional information | |
FIA_UAU_EXT.4 | ||
No events specified | N/A | |
FIA_X509_EXT.2 | ||
Failure to establish connection to determine revocation status | No additional information | |
FIA_X509_EXT.3 | ||
No events specified | N/A | |
FIA_X509_EXT.4 | ||
Generation of Certificate Enrollment Request | Issuer and Subject name of EST Server. Method of authentication. Issuer and Subject name of certificate used to authenticate. Content of Certificate Request Message | |
Success or failure of enrollment | Issuer and Subject name of added certificate or reason for failure | |
Update of EST Trust Anchor Database | Subject name of added Root CA | |
FIA_X509_EXT.5 | ||
No events specified | N/A | |
FMT_SMF.1 | ||
Initiation of policy update | Policy name | |
Change of settings | Role of user that changed setting, Value of new setting | |
Success or failure of function | Role of user that performed function, Function performed, Reason for failure | |
Initiation of software update | Version of update | |
Initiation of application installation or update | Name and version of application | |
FMT_SMF_EXT.2 | ||
Unenrollment, Initiation of unenrollment | Identity of administrator Remediation action performed, failure of accepting command to unenroll | |
FMT_SMF_EXT.3 | ||
No events specified | N/A | |
FPT_AEX_EXT.4 | ||
No events specified | N/A | |
FPT_AEX_EXT.5 | ||
No events specified | N/A | |
FPT_AEX_EXT.6 | ||
No events specified | N/A | |
FPT_AEX_EXT.7 | ||
No events specified | N/A | |
FPT_BBD_EXT.1 | ||
No events specified | N/A | |
FPT_BLT_EXT.1 | ||
No events specified | N/A | |
FPT_NOT_EXT.2 | ||
No events specified | N/A | |
FPT_TST_EXT.2/POSTKERNEL | ||
[selection, choose one of: Detected integrity violation, None ] | [selection, choose one of: The TSF code file that cause the integrity violation, No additional information ] | |
FPT_TST_EXT.3 | ||
No events specified | N/A | |
FPT_TUD_EXT.2 | ||
Success or failure of signature verification for software updates | No additional information | |
FPT_TUD_EXT.3 | ||
Success or failure of signature verification for applications | No additional information | |
FPT_TUD_EXT.4 | ||
No events specified | N/A | |
FPT_TUD_EXT.5 | ||
No events specified | N/A | |
FPT_TUD_EXT.6 | ||
No events specified | N/A | |
FTP_ITC_EXT.1 | ||
Initiation and termination of trusted channel | Trusted channel protocol, non-TOE endpoint of connection |
A subset of the User Data Protection focuses on protecting Data-At-Rest, namely FDP_DAR_EXT.1 and FDP_DAR_EXT.2. Three levels of data-at-rest protection are addressed: TSF data, Protected Data (and keys), and sensitive data. Table 6 addresses the level of protection required for each level of data-at-rest.
Table 6: Protection of Data LevelsData Level | Protection Required |
TSF Data | TSF data does not require confidentiality, but does require integrity protection. (FPT_TST_EXT.2/PREKERNEL) |
Protected Data | Protected data is encrypted while powered off. (FDP_DAR_EXT.1) |
Sensitive Data | Sensitive data is encrypted while in the locked state, in addition to while powered off. (FDP_DAR_EXT.2) |
# | Management Function | Impl. | User Only | Admin | Admin Only |
1 |
configure password policy:
| MMandatory | -N/A | MMandatory | MMandatory |
2 |
configure session
locking policy:
| MMandatory | -N/A | MMandatory | MMandatory |
3 |
enable/disable the VPN
protection:
[selection:
| MMandatory | OOptional | OOptional | OOptional |
4 | enable/disable [assignment: list of all radios] | MMandatory | OOptional | OOptional | OOptional |
5 |
enable/disable
[assignment:
list of audio or visual collection devices]:
[selection:
| MMandatory | OOptional | OOptional | OOptional |
6 | transition to the locked state | MMandatory | -N/A | MMandatory | -N/A |
7 | TSF wipe of protected data | MMandatory | -N/A | MMandatory | -N/A |
8 |
configure
application installation policy by [selection:
| MMandatory | -N/A | MMandatory | MMandatory |
9 | import keys or secrets into the secure key storage | MMandatory | OOptional | OOptional | -N/A |
10 | destroy imported keys or secrets and [selection: no other keys or secrets, [assignment: list of other categories of keys or secrets] ] in the secure key storage | MMandatory | OOptional | OOptional | -N/A |
11 | import X.509v3 certificates into the Trust Anchor Database | MMandatory | -N/A | MMandatory | OOptional |
12 | remove imported X.509v3 certificates and [selection: no other X.509v3 certificates, [assignment: list of other categories of X.509v3 certificates] ] in the Trust Anchor Database | MMandatory | OOptional | OOptional | -N/A |
13 | enroll the TOE in management | MMandatory | OOptional | OOptional | OOptional |
14 | remove applications | MMandatory | -N/A | MMandatory | OOptional |
15 | update system software | MMandatory | -N/A | MMandatory | OOptional |
16 | install applications | MMandatory | -N/A | MMandatory | OOptional |
17 | remove Enterprise applications | MMandatory | -N/A | MMandatory | -N/A |
18 |
enable/disable
display notification in the locked state of: [selection:
| MMandatory | OOptional | OOptional | OOptional |
19 | enable data-at rest protection | MMandatory | OOptional | OOptional | OOptional |
20 | enable removable media’s data-at-rest protection | MMandatory | OOptional | OOptional | OOptional |
21 |
enable/disable location
services:
[selection:
| MMandatory | OOptional | OOptional | OOptional |
22 | enable/disable the use of [selection: Biometric Authentication Factor, Hybrid Authentication Factor ] | OOptional | OOptional | OOptional | OOptional |
23 | configure whether to allow or disallow establishment of [assignment: configurable trusted channel in FTP_ITC_EXT.1.1 or FDP_UPC_EXT.1.1/APPS] if the peer or server certificate is deemed invalid. | OOptional | OOptional | OOptional | OOptional |
24 | enable/disable all data signaling over [assignment: list of externally accessible hardware ports] | OOptional | OOptional | OOptional | OOptional |
25 | enable/disable [assignment: list of protocols where the device acts as a server] | OOptional | OOptional | OOptional | OOptional |
26 | enable/disable developer modes | OOptional | OOptional | OOptional | OOptional |
27 | enable/disable bypass of local user authentication | OOptional | OOptional | OOptional | OOptional |
28 | wipe Enterprise data | OOptional | OOptional | OOptional | -N/A |
29 | approve [selection: import, removal ] by applications of X.509v3 certificates in the Trust Anchor Database | OOptional | OOptional | OOptional | OOptional |
30 | configure whether to allow or disallow establishment of a trusted channel if the TSF cannot establish a connection to determine the validity of a certificate | OOptional | OOptional | OOptional | OOptional |
31 | enable/disable the cellular protocols used to connect to cellular network base stations | OOptional | OOptional | OOptional | OOptional |
32 | read audit logs kept by the TSF | OOptional | OOptional | OOptional | -N/A |
33 | configure [selection: certificate, public-key ] used to validate digital signature on applications | OOptional | OOptional | OOptional | OOptional |
34 | approve exceptions for shared use of keys or secrets by multiple applications | OOptional | OOptional | OOptional | OOptional |
35 | approve exceptions for destruction of keys or secrets by applications that did not import the key or secret | OOptional | OOptional | OOptional | OOptional |
36 | configure the unlock banner | MMandatory | -N/A | OOptional | OOptional |
37 | configure the auditable items | OOptional | -N/A | OOptional | OOptional |
38 | retrieve TSF-software integrity verification values | OOptional | OOptional | OOptional | OOptional |
39 | enable/disable [selection: ] | OOptional | OOptional | OOptional | OOptional |
40 | enable/disable backup of [selection: all applications, selected applications, selected groups of applications, configuration data ] to [selection: locally connected system, remote system ] | OOptional | OOptional | OOptional | OOptional |
41 |
enable/disable [selection:
| OOptional | OOptional | OOptional | OOptional |
42 | approve exceptions for sharing data between [selection: applications, groups of applications ] | OOptional | OOptional | OOptional | OOptional |
43 | place applications into application groups based on [assignment: enterprise configuration settings] | OOptional | OOptional | OOptional | OOptional |
44 | unenroll the TOE from management | OOptional | OOptional | OOptional | OOptional |
45 |
enable/disable the
Always On VPN protection:
[selection:
| OOptional | OOptional | OOptional | OOptional |
46 | revoke Biometric template | OOptional | OOptional | OOptional | OOptional |
47 | [assignment: list of other management functions to be provided by the TSF] | OOptional | OOptional | OOptional | OOptional |
Functions 3 , 5 , and 21 must be implemented on a device-wide basis but may also be implemented on a per-app basis or on a per-group of applications basis in which the configuration includes the list of applications or groups of applications to which the enable/disable applies.
Function 3 addresses enabling and disabling the IPsec VPN only. The configuration of the VPN Client itself (with information such as VPN Gateway, certificates, and algorithms) is addressed by the PP-Module for Virtual Private Network (VPN) Clients, version 2.4. The administrator options should only be listed if the administrator can remotely enable/disable the VPN connection.
Function 3 optionally allows the VPN to be configured per-app or per-groups of apps. If this configuration is selected, it does not void FDP_IFC_EXT.1. Instead FDP_IFC_EXT.1 is applied to the application or group of applications the VPN is applied to. In other words, all traffic destined for the VPN-enabled application or group of applications, must travel through the VPN, but traffic not destined for that application or group of applications can travel outside the VPN. When the VPN is configured across the device FDP_IFC_EXT.1 applies to all traffic and the VPN must not split tunnel.
The assignment in function 4 consists of all radios present on the TSF, such as Wi-Fi, cellular, NFC, Bluetooth BR/EDR, and Bluetooth LE, which can be enabled and disabled. In the future, if both Bluetooth BR/EDR and Bluetooth LE are supported, they will be required to be enabled and disabled separately. Disablement of the cellular radio does not imply that the radio may not be enabled in order to place emergency phone calls; however, it is not expected that a device in "airplane mode", where all radios are disabled, will automatically (without authorization) turn on the cellular radio to place emergency calls.
The assignment in function 5 consists of at least one audio or visual device, such as camera and microphone, which can be enabled and disabled by either the user or administrator. Disablement of the microphone does not imply that the microphone may not be enabled in order to place emergency phone calls. If certain devices are able to be restricted to the enterprise (either device-wide, per-app or per-group of applications) and others are able to be restricted to users, then this function should be iterated in the table with the appropriate table entries.
Regarding functions 4 and 5, disablement of a particular radio or audio/visual device must be effective as soon as the TOE has power. Disablement must also apply when the TOE is booted into auxiliary boot modes, for example, associated with updates or backup. If the TOE supports states in which security management policy is inaccessible, for example, due to data-at-rest protection, it is acceptable to meet this requirement by ensuring that these devices are disabled by default while in these states. That these devices are disabled during auxiliary boot modes does not imply that the device (particularly the cellular radio) may not be enabled in order to perform emergency phone calls.
Wipe of the TSF (function 7) is performed according to FCS_CKM_EXT.5. Protected data is all non-TSF data, including all user or enterprise data. Some or all of this data may be considered sensitive data as well.
The selection in function 8 allows the ST author to select which mechanisms are available to the administrator through the MDM Agent to restrict the applications which the user may install. The ST author must state if application allowlist is applied device-wide or if it can be specified to apply to either the Enterprise or Personal applications.
In the future, function 12 may require destruction or disabling of any default trusted CA certificates, excepting those CA certificates necessary for continued operation of the TSF, such as the developer’s certificate. At this time, the ST author must indicate in the assignment whether pre-installed or any other category of X.509v3 certificates may be removed from the Trust Anchor Database.
For function 13, the enrollment function may be installing an MDM agent and includes the policies to be applied to the device. It is acceptable for the user approval notice to require the user to intentionally opt to view the policies (for example, by "tapping" on a "View" icon) rather than listing the policies in full in the notice.
For function 15, the administrator capability to update the system software may be limited to causing a prompt to the user to update rather than the ability to initiate the update itself. As the administrator is likely to be acting remotely, he/she would be unaware of inopportune situations, such as low power, which may cause the update to fail and the device to become inoperable. The user can refuse to accept the update in such situations. It is expected that system architects will be cognizant of this limitation and will enforce network access controls in order to enforce enterprise-critical updates.
Function 16 addresses both installation and update. This protection profile does not distinguish between installation and update of applications because mobile devices typically completely overwrite the previous installation with a new installation during an application update.
For function 17, "Enterprise applications" are those applications that belong to the Enterprise application group. Applications installed by the enterprise administrator (including automatic installation by the administrator after being requested by the user from a catalog of enterprise applications) are by default placed in the Enterprise application group unless an exception has been made in function 43 of FMT_SMF.1.1.
If the display of notifications in the locked state is supported, the configuration of these notifications (function 18) must be included in the selection.
Function 19 must be included in the selection if data-at-rest protection is not natively enabled.
Function 20 is implicitly met if the TSF does not support removable media.
For function 21, location services include location information gathered from GPS, cellular, and Wi-Fi.
Function 22 must be included in the ST if the TOE contains a BAF. This selection must correspond with the selection made in FIA_UAU.5.1. If biometric in accordance with the Biometric Enrollment and Verification, version 1.1 is selected in FIA_UAU.5.1, "Biometric Authentication Factor" must be selected and the user or admin must have the option to disable the use of it. If multiple BAFs are claimed in FIA_MBV_EXT.1.1 in the Biometric Enrollment and Verification, version 1.1, this applies to all different modalities. If hybrid is selected in FIA_UAU.5.1 it must be selected and the user or admin must have the option to disable the use of it.
Function 23 must be included in the ST if the function is configurable on the TOE for any of the trusted channels either mandated or selected in FTP_ITC_EXT.1.1 or FDP_UPC_EXT.1.1/APPS. The configuration can be different depending on the specific trusted channel(s) and they must be filled in for the assignment.
The assignment in function 24 consists of all externally accessible hardware ports, such as USB, the SD card, and HDMI, whose data transfer capabilities can be enabled and disabled by either the user or administrator. Disablement of data transfer over an external port must be effective during and after boot into the normal operative mode of the device. If the TOE supports states in which configured security management policy is inaccessible, for example, due to data-at-rest protection, it is acceptable to meet this requirement by ensuring that data transfer is disabled by default while in these states. Each of the ports may be enabled or disabled separately. The configuration policy need not disable all ports together. In the case of USB, charging is still allowed if data transfer capabilities have been disabled.
The assignment in function 25 consists of all protocols where the TSF acts as a server, which can be enabled and disabled by either the user or administrator.
Function 26 must be included in the selection if developer modes are supported by the TSF.
Function 27 must be included in the selection if bypass of local user authentication, such as a "Forgot Password", password hint, or remote authentication feature, is supported.
Function 29 must be included in the selection if the TSF allows applications, other than the MDM Agents, to import or remove X.509v3 certificates from the Trust Anchor Database. The MDM Agent is considered the administrator. This function does not apply to applications trusting a certificate for its own validations. The function only applies to situations where the application modifies the device-wide Trust Anchor Database, affecting the validations performed by the TSF for other applications. The user or administrator may be provided the ability to globally allow or deny any application requests in order to meet this requirement.
Function 30 must be included in the ST if "administrator-configured option" is selection in FIA_X509_EXT.2.2.
Function 33 should be included in the selection if FPT_TUD_EXT.5.1 is included in the ST and the configurable option is selected.
Function 34 should be included in the selection if user or administrator is selected in FCS_STG_EXT.1.4.
Function 35 should be included in the selection if the user or the administrator is selected in FCS_STG_EXT.1.5.
Function 37 must be included in the selection if FAU_SEL.1 is included in the ST.
For function 41, hotspot functionality refers to the condition in which the mobile device is serving as an access point to other devices, not the connection of the TOE to external hotspots.
Functions 42 and 43 correspond to FDP_ACF_EXT.1.2.
For function 44, FMT_SMF_EXT.2.1 specifies actions to be performed when the TOE is unenrolled from management.
Function 45 must be included in the ST if IPsec is selected in FTP_ITC_EXT.1 and the native IPsec VPN client can be configured to be Always-On. Always-On is defined as when the TOE has a network connection the VPN attempts to connect, all data leaving the device uses the VPN when the VPN is connected and no data leaves that device when the VPN is disconnected. The configuration of the VPN Client itself (with information such as VPN Gateway, certificates, and algorithms) is addressed by the PP-Module for Virtual Private Network (VPN) Clients, version 2.4.
The following rationale provides justification for each security objective for the TOE,
showing that the SFRs are suitable to meet and achieve the security objectives:
Objective | Addressed by | Rationale |
---|---|---|
O.PROTECTED_COMMS | FCS_CKM.1 | FCS_CKM.1 supports the objective by defining the key generation algorithms that are used for protected communications. |
FCS_CKM.2/UNLOCKED | FCS_CKM.2/UNLOCKED supports the objective by defining the key establishment algorithms that are used for protected communications. | |
FCS_COP.1/ENCRYPT | FCS_COP.1/ENCRYPT supports the objective by requiring the TSF to implement symmetric encryption algorithms that are used in support of protected communications. | |
FCS_COP.1/HASH | FCS_COP.1/HASH supports the objective by requiring the TSF to implement hash algorithms that are used in support of protected communications. | |
FCS_COP.1/SIGN | FCS_COP.1/SIGN supports the objective by requiring the TSF to implement digital signature algorithms that are used in support of protected communications. | |
FCS_COP.1/KEYHMAC | FCS_COP.1/KEYHMAC supports the objective by requiring the TSF to implement HMAC algorithms that are used in support of protected communications. | |
FCS_DTLSC_EXT.1 (TLS Package) | FCS_DTLSC_EXT.1 supports the objective by defining the TOE's implementation of DTLS as a client if this protocol is used for protected communications. | |
FCS_DTLSC_EXT.2 (TLS Package) | FCS_DTLSC_EXT.2 supports the objective by defining the TOE's implementation of mutually-authenticated DTLS as a client if this protocol is used for protected communications. | |
FCS_HTTPS_EXT.1 | FCS_HTTPS_EXT.1 supports the objective by defining the TOE's implementation of HTTPS if this protocol is used for protected communications. | |
FCS_RBG_EXT.1 | FCS_RBG_EXT.1 supports the objective by requiring the TSF to implement deterministic random bit generation algorithms that are used in support of protected communications. | |
FCS_RBG_EXT.2 (Objective) | FCS_RBG_EXT.2 supports the objective by requiring the TSF to save the DRBG state between reboots to ensure availability of this service. | |
FCS_RBG_EXT.3 (Objective) | FCS_RBG_EXT.3 supports the objective by defining the TSF's implementation of the SP 800-90A Personalization String for applications that require this. | |
FCS_SRV_EXT.1 | FCS_SRV_EXT.1 supports the objective by defining the cryptographic services that the TSF must make available to third-party applications, which includes those that can support protected communications. | |
FCS_SRV_EXT.2 (Objective) | FCS_SRV_EXT.2 supports the objective by requiring the TSF to make keys in its secure key storage available for use in encryption and signing operations. | |
FCS_TLSC_EXT.1 (TLS Package) | FCS_TLSC_EXT.1 supports the objective by defining the TOE's implementation of TLS as a client for protected communications. | |
FCS_TLSC_EXT.2 (TLS Package) | FCS_TLSC_EXT.2 supports the objective by defining the TOE's implementation of mutually-authenticated TLS as a client for protected communications. | |
FCS_TLSC_EXT.3 (TLS Package) | FCS_TLSC_EXT.3 supports the objective by requiring the TSF to support the TLS signature algorithms extension as part of establishing TLS protected communications. | |
FDP_BLT_EXT.1 (Objective) | FDP_BLT_EXT.1 supports the objective by limiting the applications that are authorized to use the Bluetooth interface, which may include a trusted channel. | |
FDP_IFC_EXT.1 | FDP_IFC_EXT.1 supports the objective by requiring the TSF to have either its own IPsec VPN client or interface that allows a third-party VPN client to be deployed on it. | |
FDP_STG_EXT.1 | FDP_STG_EXT.1 supports the objective by requiring the TSF to implement a protected key storage that can be used to protect persistent keys used for protected communications from disclosure. | |
FDP_UPC_EXT.1/APPS | FDP_UPC_EXT.1/APPS supports the objective by defining the protected communications channels that it allows third-party applications to invoke. | |
FDP_UPC_EXT.1/BLUETOOTH | FDP_UPC_EXT.1/BLUETOOTH supports the objective by defining the Bluetooth interfaces that it allows third-party applications to invoke. | |
FIA_X509_EXT.1 | FIA_X509_EXT.1 supports the objective by defining the rules the TSF uses to determine if a presented X.509 certificate is valid. | |
FIA_X509_EXT.2 | FIA_X509_EXT.2 supports the objective by requiring the TSF to enumerate its uses of X.509 certificates (including protected communications) and its behavior when a certificate's revocation status is undetermined. | |
FIA_X509_EXT.3 | FIA_X509_EXT.3 supports the objective by requiring the TSF to provide a certificate validation service to third-party applications. | |
FIA_X509_EXT.4 (Objective) | FIA_X509_EXT.4 supports the objective by defining the implementation of EST as a method by which the TSF can obtain an X.509 certificate for its own use. | |
FIA_X509_EXT.5 (Objective) | FIA_X509_EXT.5 supports the objective by defining the implementation of Certificate Request Messages as a method by which the TSF can obtain an X.509 certificate for its own use. | |
FPT_BLT_EXT.1 (Objective) | FPT_BLT_EXT.1 supports the objective by requiring the TSF to disable certain Bluetooth profiles when they are inactive such that explicit user authorization is required to re-enable them. | |
FTP_ITC_EXT.1 | FTP_ITC_EXT.1 supports the objective by defining the protected communications protocols that the TSF implements. | |
O.STORAGE | FCS_CKM.2/LOCKED | FCS_CKM.2/LOCKED supports the objective by defining the key establishment mechanism used for keys that protect data at rest when the TOE is in a locked state. |
FCS_CKM_EXT.1 | FCS_CKM_EXT.1 supports the objective by defining the TOE's root encryption key that is used to protect data at rest. | |
FCS_CKM_EXT.2 | FCS_CKM_EXT.2 supports the objective by defining how the TSF creates data encryption keys that are used to protect data at rest. | |
FCS_CKM_EXT.3 | FCS_CKM_EXT.3 supports the objective by defining the key encryption keys the TOE uses to protect data at rest and how they are created. | |
FCS_CKM_EXT.4 | FCS_CKM_EXT.4 supports the objective by requiring the TSF to destroy keys and key material that could otherwise be used to compromise data at rest. | |
FCS_CKM_EXT.5 | FCS_CKM_EXT.5 supports the objective by defining the mechanism the TSF uses to perform a wipe operation that securely destroys data at rest. | |
FCS_CKM_EXT.6 | FCS_CKM_EXT.6 supports the objective by requiring the TSF to use secure salts when performing cryptographic operations that require them. | |
FCS_CKM_EXT.7 (Sel-Based) | FCS_CKM_EXT.7 supports the objective by ensuring that the TOE's root encryption key cannot be disclosed. | |
FCS_COP.1/ENCRYPT | FCS_COP.1/ENCRYPT supports the objective by defining a symmetric encryption/decryption function that can be used to protect data at rest. | |
FCS_COP.1/HASH | FCS_COP.1/HASH supports the objective by defining a hash function that can be used to protect data at rest. | |
FCS_COP.1/SIGN | FCS_COP.1/SIGN supports the objective by defining a digital signature function that can be used to protect data at rest. | |
FCS_COP.1/KEYHMAC | FCS_COP.1/KEYHMAC supports the objective by defining an HMAC function that can be used to protect data at rest. | |
FCS_COP.1/CONDITION | FCS_COP.1/CONDITION supports the objective by defining a key derivation function that can be used to protect data at rest. | |
FCS_IV_EXT.1 | FCS_IV_EXT.1 supports the objective by ensuring that any IVs the TSF generates for AES keys are generated in an appropriate manner based on the relevant standards. | |
FCS_RBG_EXT.1 | FCS_RBG_EXT.1 supports the objective by defining random bit generation function that can be used to protect data at rest. | |
FCS_STG_EXT.1 | FCS_STG_EXT.1 supports the objective by requiring the TSF to implement a hardware or software key store to protect key data at rest. | |
FCS_STG_EXT.2 | FCS_STG_EXT.2 supports the objective by defining the confidentiality mechanism used to protect stored key data from unauthorized disclosure. | |
FCS_STG_EXT.3 | FCS_STG_EXT.3 supports the objective by defining the integrity mechanism used to protect stored key data from unauthorized modification. | |
FDP_ACF_EXT.3 (Objective) | FDP_ACF_EXT.3 supports the objective by ensuring that the TSF does not permit write and execute permissions on stored data to be granted simultaneously. | |
FDP_DAR_EXT.1 | FDP_DAR_EXT.1 supports the objective by requiring the TSF to encrypt all sensitive data using data encryption keys. | |
FDP_DAR_EXT.2 | FDP_DAR_EXT.2 supports the objective by requiring the TSF to provide a mechanism to mark data as sensitive so that it can be subject to encryption. | |
FIA_UAU_EXT.1 | FIA_UAU_EXT.1 supports the objective by requiring the presentation of a valid authorization factor in order to decrypt sensitive data at rest. | |
FPT_KST_EXT.1 | FPT_KST_EXT.1 supports the objective by requiring the TSF to prevent the storage of plaintext key data in readable non-volatile memory. | |
FPT_KST_EXT.2 | FPT_KST_EXT.2 supports the objective by requiring the TSF to prevent any transmission of plaintext key material outside of the TOE boundary. | |
FPT_KST_EXT.3 | FPT_KST_EXT.3 supports the objective by requiring the TSF to prevent export of any stored plaintext keys. | |
FPT_JTA_EXT.1 | FPT_JTA_EXT.1 supports the objective by requiring the TSF to enforce access controls against JTAG so that this interface cannot be used to disclose data at rest. | |
O.CONFIG | FMT_MOF_EXT.1 | FMT_MOF_EXT.1 supports the objective by specifying the TSF management functions that an end user is authorized to perform. |
FMT_SMF.1 | FMT_SMF.1 supports the objective by defining the TSF management functions and the users or roles that are authorized to invoke them. | |
FMT_SMF_EXT.2 | FMT_SMF_EXT.2 supports the objective by defining the configuration actions that the TSF performs automatically upon unenrollment from mobile device management. | |
FTA_TAB.1 | FTA_TAB.1 supports the objective by requiring the TSF to display a warning banner to users that governs authorized usage of the TOE. | |
O.AUTH | FIA_AFL_EXT.1 | FIA_AFL_EXT.1 supports the objective by defining the authentication mechanisms that are subject to lockout behavior and how the TSF handles repeated failed authentication attempts. |
FIA_PMG_EXT.1 | FIA_PMG_EXT.1 supports the objective by defining the minimum quality threshold for passwords that the TSF must enforce. | |
FIA_TRT_EXT.1 | FIA_TRT_EXT.1 supports the objective by enforcing an authentication throttling mechanism that limits the rate at which authentication attempts can be made to the TOE. | |
FIA_UAU_EXT.1 | FIA_UAU_EXT.1 supports the objective by requiring the TSF to be provided with a valid password before access to protected data is granted. | |
FIA_UAU_EXT.2 | FIA_UAU_EXT.2 supports the objective by defining the TOE functions that can be accessed without authentication such that all other services require authentication. | |
FIA_UAU_EXT.4 (Optional) | FIA_UAU_EXT.4 supports the objective by defining a secondary authentication mechanism for Enterprise resources. | |
FIA_UAU.5 | FIA_UAU.5 supports the objective by defining all authentication factors the TSF supports and rules for how these authentication factors are used to gain access to the TSF. | |
FIA_UAU.6/CREDENTIAL | FIA_UAU.6/CREDENTIAL supports the objective by requiring the TSF to re-authenticate users with their password prior to allowing them to change any other authentication data. | |
FIA_UAU.6/LOCKED | FIA_UAU.6/LOCKED supports the objective by requiring the TSF to re-authenticate users with a valid credential prior to allowing a locked device to be unlocked. | |
FIA_UAU.7 | FIA_UAU.7 supports the objective by ensuring that TSF does not disclose user authentication data as it is being input to the TOE. | |
FIA_X509_EXT.2 | FIA_X509_EXT.2 supports the objective by defining the functions for which the TSF uses X.509 certificates as an authentication mechanism. | |
FTA_SSL_EXT.1 | FTA_SSL_EXT.1 supports the objective by requiring the TSF to ensure that an idle user session is terminated after a given period of time. | |
O.INTEGRITY | FAU_GEN.1 | FAU_GEN.1 supports the objective by requiring the TSF to record actions performed against it to establish a record of potential malicious activity. |
FAU_SAR.1 | FAU_SAR.1 supports the objective by requiring the TSF to provide a mechanism to review the stored audit data so administrators can diagnose the root cause of malicious usage. | |
FAU_SEL.1 (Objective) | FAU_SEL.1 supports the objective by allowing the TSF to restrict the audit records that are generated so that records unrelated to potential malicious usage can be suppressed. | |
FAU_STG.1 | FAU_STG.1 supports the objective by ensuring that a malicious user cannot tamper with audit records by modifying or deleting them. | |
FAU_STG.4 | FAU_STG.4 supports the objective by ensuring the availability of audit records. | |
FCS_COP.1/HASH | FCS_COP.1/HASH supports the objective by requiring the TSF to implement hash algorithms that can be used to assert and verify integrity. | |
FCS_COP.1/SIGN | FCS_COP.1/SIGN supports the objective by requiring the TSF to implement digital signature algorithms that can be used to assert and verify integrity. | |
FDP_ACF_EXT.1 | FDP_ACF_EXT.1 supports the objective by requiring the TSF to maintain the integrity of its system services by limiting the entities that can access them. | |
FDP_ACF_EXT.3 (Objective) | FDP_ACF_EXT.3 supports the objective by requiring the TSF to ensure that writable files cannot be executed and vice versa, such that arbitrary code or scripts cannot be executed to compromise the integrity of the TOE. | |
FPT_AEX_EXT.1 | FPT_AEX_EXT.1 supports the objective by requiring the TSF to implement ASLR to prevent a compromise of the TSF. | |
FPT_AEX_EXT.2 | FPT_AEX_EXT.2 supports the objective by requiring the TSF to enforce permissions against memory pages to prevent a compromise of the TSF. | |
FPT_AEX_EXT.3 | FPT_AEX_EXT.3 supports the objective by requiring the TSF to implement stack overflow protection to prevent a compromise of the TSF. | |
FPT_AEX_EXT.4 | FPT_AEX_EXT.4 supports the objective by requiring the TSF to enforce address space separation to prevent a compromise of the TSF. | |
FPT_AEX_EXT.5 (Objective) | FPT_AEX_EXT.5 supports the objective by requiring the TSF to implement ASLR to prevent a compromise of the TSF. | |
FPT_AEX_EXT.6 (Objective) | FPT_AEX_EXT.6 supports the objective by requiring the TSF to ensure that writable files cannot be executed and vice versa, such that arbitrary code or scripts cannot be executed to compromise the integrity of the TOE. | |
FPT_AEX_EXT.7 (Objective) | FPT_AEX_EXT.7 supports the objective by requiring the TSF to implement heap overflow protection to prevent a compromise of the TSF. | |
FPT_BBD_EXT.1 (Objective) | FPT_BBD_EXT.1 supports the objective by ensuring that isolation between the TOE's baseband processor and application processor is enforced so that access to the baseband processor is strictly controlled. | |
FPT_NOT_EXT.1 | FPT_NOT_EXT.1 supports the objective by requiring the TSF to take some action to prevent its integrity in the event of various failure conditions. | |
FPT_NOT_EXT.2 (Objective) | FPT_NOT_EXT.2 supports the objective by requiring the TSF to make its integrity verification values available for the purpose of remote attestation. | |
FPT_STM.1 | FPT_STM.1 supports the objective by ensuring accurate system time data is applied to audit logs. | |
FPT_TST_EXT.1 | FPT_TST_EXT.1 supports the objective by defining the self-tests that the TSF performs to validate its own integrity. | |
FPT_TST_EXT.2/PREKERNEL | FPT_TST_EXT.2/PREKERNEL supports the objective by requiring the TSF to verify the integrity of its bootchain prior to kernel load. | |
FPT_TST_EXT.2/POSTKERNEL (Objective) | FPT_TST_EXT.2/POSTKERNEL supports the objective by requiring the TSF to verify the integrity of stored executable code prior to its execution. | |
FPT_TST_EXT.3 (Sel-Based) | FPT_TST_EXT.3 supports the objective by requiring the TSF to block code execution if its code signing certificate is invalid. | |
FPT_TUD_EXT.1 | FPT_TUD_EXT.1 supports the objective by allowing users to determine the version of the TOE's hardware, software/firmware, and installed applications. | |
FPT_TUD_EXT.2 | FPT_TUD_EXT.2 supports the objective by requiring the TSF to validate the integrity of software updates prior to installing them. | |
FPT_TUD_EXT.3 | FPT_TUD_EXT.3 supports the objective by requiring the TSF to validate the integrity of third-party applications prior to installing them. | |
FPT_TUD_EXT.4 (Sel-Based) | FPT_TUD_EXT.4 supports the objective by requiring the TSF to block installation of code if its associated code signing certificate is invalid. | |
FPT_TUD_EXT.5 (Objective) | FPT_TUD_EXT.5 supports the objective by specifying the X.509 certificate that the TSF uses to verify applications prior to their installation. | |
FPT_TUD_EXT.6 (Objective) | FPT_TUD_EXT.6 supports the objective by preventing the TSF from being rolled back to an earlier version that may have known vulnerabilities that were subsequently patched. | |
O.PRIVACY | FDP_ACF_EXT.1 | FDP_ACF_EXT.1 supports the objective by enforcing restrictions on services that could compromise user privacy if accessed inappropriately. |
FDP_ACF_EXT.2 (Sel-Based) | FDP_ACF_EXT.2 supports the objective by requiring the TSF to provide separate user data stores for application groups so that the privacy of that data can be maintained. | |
FDP_BCK_EXT.1 (Objective) | FDP_BCK_EXT.1 supports the objective by allowing data to be excluded from backup operations that could compromise user privacy if disclosed. | |
FMT_SMF.1 | FMT_SMF.1 supports the objective by requiring the TSF to implement management functions that control the extent to which user data is collected and disseminated. | |
FMT_SMF_EXT.3 (Objective) | FMT_SMF_EXT.3 supports the objective by requiring the TSF to identify its authorized administrators so that a user knows the extent to which various administrators have access to the device. |
Assurance Class | Assurance Components |
Security Target (ASE) | Conformance Claims (ASE_CCL.1) |
Extended Components Definition (ASE_ECD.1) | |
ST Introduction (ASE_INT.1) | |
Security Objectives for the Operational Environment (ASE_OBJ.1) | |
Stated Security Requirements (ASE_REQ.1) | |
Security Problem Definition (ASE_SPD.1) | |
TOE Summary Specification (ASE_TSS.1) | |
Development (ADV) | Basic Functional Specification (ADV_FSP.1) |
Guidance Documents (AGD) | Operational User Guidance (AGD_OPE.1) |
Preparative Procedures (AGD_PRE.1) | |
Life Cycle Support (ALC) | Labeling of the TOE (ALC_CMC.1) |
TOE CM Coverage (ALC_CMS.1) | |
Timely Security Updates (ALC_TSU_EXT) | |
Tests (ATE) | Independent Testing – Sample (ATE_IND.1) |
Vulnerability Assessment (AVA) | Vulnerability Survey (AVA_VAN.1) |
If this is implemented by the TOE, the following requirements must be included in the ST:
As indicated in the introduction to this PP, the baseline requirements (those that must be performed by the TOE or its underlying platform) are contained in the body of this PP. There are additional requirements based on selections in the body of the PP: if certain selections are made, then additional requirements below must be included.
Functional Class | Functional Components |
---|---|
Class: Cryptographic Support (FCS) | FCS_CKM_EXT Cryptographic Key Management FCS_HTTPS_EXT HTTPS Protocol FCS_IV_EXT Initialization Vector Generation FCS_RBG_EXT Random Bit Generation FCS_SRV_EXT Cryptographic Algorithm Services FCS_STG_EXT Cryptographic Key Storage |
Class: Identification and Authentication (FIA) | FIA_AFL_EXT Authentication Failures FIA_PMG_EXT Password Management FIA_TRT_EXT Authentication Throttling FIA_UAU_EXT User Authentication FIA_X509_EXT X.509 Certificates |
Class: Protection of the TSF (FPT) | FPT_AEX_EXT Anti-Exploitation Capabilities FPT_BBD_EXT Baseband Processing FPT_BLT_EXT Limitation of Bluetooth Profile Support FPT_JTA_EXT JTAG Disablement FPT_KST_EXT Key Storage FPT_NOT_EXT Self-Test Notification FPT_TST_EXT TSF Self Test FPT_TUD_EXT TSF Updates |
Class: Security Management (FMT) | FMT_MOF_EXT Management of Functions in TSF FMT_SMF_EXT Specification of Management Functions |
Class: TOE Access (FTA) | FTA_SSL_EXT Session Locking and Termination |
Class: Trusted Path/Channels (FTP) | FTP_ITC_EXT Inter-TSF Trusted Channel |
Class: User Data Protection (FDP) | FDP_ACF_EXT Access Control Functions FDP_BCK_EXT Application Backup FDP_BLT_EXT Limitation of Bluetooth Device Access FDP_DAR_EXT Data-at-Rest Encryption FDP_IFC_EXT Subset Information Flow Control FDP_STG_EXT User Data Storage FDP_UPC_EXT Inter-TSF User Data Transfer Protection |
FCS_CKM_EXT.1, Cryptographic Key Support, requires the TSF to implement a Root Encryption Key (REK).
FCS_CKM_EXT.2, Cryptographic Key Random Generation, requires the TSF to specify the mechanism it uses to generate Data Encryption Keys (DEKs).
FCS_CKM_EXT.3, Cryptographic Key Generation, requires the TSF to generate and manage the strength of Key Encryption Keys (KEKs).
FCS_CKM_EXT.4, Key Destruction, requires the TSF to be able to follow specified rules to destroy plaintext keying material and cryptographic keys when no longer needed.
FCS_CKM_EXT.5, TSF Wipe, requires the TSF to implement a cryptographic or other mechanism to make TSF data unreadable.
FCS_CKM_EXT.6, Salt Generation, requires the TSF to generate salts in a specified manner.
FCS_CKM_EXT.7, Cryptographic Key Support (REK), requires the TSF to prevent the reading or exporting of REKs.
There are no management activities foreseen.
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to: FCS_RBG_EXT.1 Random Bit Generation
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FCS_RBG_EXT.1 Random Bit Generation
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FCS_CKM.1 Cryptographic Key Generation
FCS_COP.1 Cryptographic Operation
FCS_RBG_EXT.1 Random Bit Generation
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FCS_RBG_EXT.1 Random Bit Generation
The following actions could be considered for the management functions in FMT:
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to: FCS_RBG_EXT.1 Random Bit Generation
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FCS_RBG_EXT.1 Random Bit Generation
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FCS_CKM_EXT.1 Cryptographic Key Support
FCS_HTTPS_EXT.1, HTTPS Protocol, requires the TSF to implement the HTTPS protocol in accordance with the specified standard, using TLS, and notifying the application if invalid.
The following actions could be considered for the management functions in FMT:
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to: FIA_X509_EXT.1 X.509 Validation of Certificates
FMT_SMF.1 Specification of Management Functions
FCS_IV_EXT.1, Initialization Vector Generation, requires the TSF to generate IVs in accordance with a set of approved modes.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: No dependencies.
FCS_RBG_EXT.1, Random Bit Generation, requires the TSF to generate random data with a certain amount of entropy and in accordance with applicable standards.
FCS_RBG_EXT.2, Random Bit Generator State Preservation, requires the TSF to save and restore the state of the RBG when powering off and starting up.
FCS_RBG_EXT.3, Support for Personalization String, requires the TSF to support a personalization string as a DRBG input parameter.
There are no management activities foreseen.
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to: No dependencies.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FCS_RBG_EXT.1 Random Bit Generation
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FCS_RBG_EXT.1 Random Bit Generation
FCS_SRV_EXT.1, Cryptographic Algorithm Services, requires the TSF to have externally-accessible cryptographic services for making algorithm functions available to applications.
FCS_SRV_EXT.2, Cryptographic Key Storage Services, requires the TSF to support its stored keys being usable by external applications through cryptographic algorithm services.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FCS_CKM.1 Cryptographic Key Generation
FCS_COP.1 Cryptographic Operation
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FCS_COP.1 Cryptographic Operation
FCS_STG_EXT.1, Cryptographic Key Storage, requires the TSF to implement a secure key storage and defines the access restrictions to be enforced on this.
FCS_STG_EXT.2, Encrypted Cryptographic Key Storage, requires the TSF to implement confidentiality measures to protect the key storage.
FCS_STG_EXT.3, Integrity of Encrypted Key Storage, requires the TSF to implement integrity measures to protect the key storage.
The following actions could be considered for the management functions in FMT:
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to:
[FCS_CKM.1 Cryptographic Key Generation, or
FDP_ITC.1 Import of User Data without Security Attributes, or
FDP_ITC.2 Import of User Data with Security Attributes]
FMT_SMR.1 Security Roles
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to:
FCS_COP.1 Cryptographic Operation
FCS_STG_EXT.1 Cryptographic Key Storage
There are no management activities foreseen.
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to:
FCS_COP.1 Cryptographic Operation
FCS_STG_EXT.2 Encrypted Cryptographic Key Storage
FIA_AFL_EXT.1, Authentication Failure Handling, requires the TSF be able to manage unsuccessful authentication attempts and limit the number of attempts for each method.
The following actions could be considered for the management functions in FMT:
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to: FCS_CKM_EXT.5 TSF Wipe
FIA_UAU.1 Timing of Authentication
FIA_PMG_EXT.1, Password Management, requires the TSF to enforce character length and composition requirements for password credentials.
The following actions could be considered for the management functions in FMT:
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FIA_UAU.1 Timing of Authentication
FIA_TRT_EXT.1, Authentication Throttling, requires the TSF to limit authentication attempts by number of attempts in a set amount of time.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FIA_UAU.5 Multiple Authentication Mechanisms
FIA_UAU_EXT.1, Authentication for Cryptographic Operation, requires the TSF enforce data-at-rest protection until successful authentication has occurred.
FIA_UAU_EXT.2, Timing of Authentication, requires the TSF to prevent a subject’s use of TOE until the user is authenticated.
FIA_UAU_EXT.4, Secondary User Authentication, requires the TSF to enforce the use of a secondary authentication factor to access certain user data.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FDP_DAR_EXT.1 Protected Data Encryption
FDP_DAR_EXT.2 Sensitive Data Encryption
The following actions could be considered for the management functions in FMT:
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to: No dependencies.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FDP_ACF_EXT.2 Access Control for System Resources
FIA_UAU.5 Multiple Authentication Mechanisms
FIA_X509_EXT.1, X.509 Validation of Certificates, specifies the rules the TSF must follow to determine if a particular X.509 certificate is valid.
FIA_X509_EXT.2, X.509 Certificate Authentication, defines the TSF’s usage of X.509 certificates and how it reacts to certificates with undetermined revocation status.
FIA_X509_EXT.3, Request Validation of Certificates, requires the TSF to make a certificate validation service available to environmental components.
FIA_X509_EXT.4, X509 Certificate Enrollment, requires the TSF to implement Enrollment over Secure Transport (EST) as a mechanism to obtain X.509 certificates.
FIA_X509_EXT.5, X.509 Certificate Requests, requires the TSF to generate X.509 certificate requests and validate the responses.
There are no management activities foreseen.
The following action is be auditable:
Hierarchical to: No other components.
Dependencies to: FCS_COP.1 Cryptographic Operation
The following actions could be considered for the management functions in FMT:
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to: FIA_X509_EXT.1 X.509 Validation of Certificates
FTP_ITC_EXT.1 Trusted Channel Communication
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FIA_X509_EXT.1 X.509 Validation of Certificates
There are no management activities foreseen.
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to: FCS_CKM.1 Cryptographic Key Generation
FIA_X509_EXT.1 X.509 Validation of Certificates
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FCS_CKM.1 Cryptographic Key Generation
FIA_X509_EXT.1 X.509 Validation of Certificates
FPT_AEX_EXT.1, Application Address Space Layout Randomization, requires the TSF to support address space layout randomization (ASLR).
FPT_AEX_EXT.2, Memory Page Permissions, requires the TSF to enforce access permissions on physical memory.
FPT_AEX_EXT.3, Stack Overflow Protection, requires the TSF to implement stack overflow protection.
FPT_AEX_EXT.4, Domain Isolation, requires the TSF to protect itself from untrusted subjects and enforce address space isolation.
FPT_AEX_EXT.5, Kernel Address Space Layout Randomization, requires the TSF to provide ASLR to the kernel.
FPT_AEX_EXT.6, Write or Execute Memory Page Permissions, requires the TSF to prevent physical memory from being both writable and executable.
FPT_AEX_EXT.7, Heap Overflow Protection, requires the TSF to support heap-based buffer overflow protection.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FCS_RBG_EXT.1 Random Bit Generation
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: No dependencies.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: No dependencies.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: No dependencies.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: No dependencies.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: No dependencies.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: No dependencies.
FPT_BBD_EXT.1, Application Processor Mediation, requires the TSF to enforce separation between baseband and application processor execution except through application processor mechanisms.
There are no management activities foreseen.
There are no auditable events foreseen.
FPT_BLT_EXT.1, Limitation of Bluetooth Profile Support, requires the TSF to maintain a disabled by default posture for Bluetooth profiles.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: No dependencies.
FPT_JTA_EXT.1, JTAG Disablement, requires the TSF to specify the mechanism used to restrict access to its JTAG interface.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: No dependencies.
FPT_KST_EXT.1, Key Storage, requires the TSF to avoid storage of plaintext keys in readable memory.
FPT_KST_EXT.2, No Key Transmission, requires the TSF to prevent transmitting plaintext key material to the operational environment.
FPT_KST_EXT.3, No Plaintext Key Export, requires the TSF to prevent the export of plaintext keys.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: No dependencies.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: No dependencies.
There are no management activities foreseen.
There are no auditable events foreseen.
FPT_NOT_EXT.1, Self-Test Notification, requires the TSF to become non-operational when certain failures occur.
FPT_NOT_EXT.2, Software Integrity Verification, requires the TSF to generate and sign software integrity verification values.
There are no management activities foreseen.
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to: FPT_TST_EXT.1 TSF Cryptographic Functionality Testing
FPT_TST_EXT.2 TSF Integrity Checking
The following actions could be considered for the management functions in FMT:
There are no auditable events foreseen.
FPT_TST_EXT.1, TSF Cryptographic Functionality Testing, requires the TSF to run self-test at start-up to verify correct operation.
FPT_TST_EXT.3, TSF Integrity Testing, requires the TSF to validate a code signing certificate before the associated code is executed.
There are no management activities foreseen.
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to: FCS_COP.1 Cryptographic Operation
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FPT_TST_EXT.2 TSF Integrity Checking
FIA_X509_EXT.1 X.509 Validation of Certificates
FIA_X509_EXT.2 X.509 Certificate Authentication
FPT_TUD_EXT.1, TSF Version Query, requires the TSF to provide authorized users the ability to query the version of the TOE hardware, TOE software, and installed applications.
FPT_TUD_EXT.2, TSF Update Verification, requires the TSF to ensure that system software updates are digitally signed prior to installation.
FPT_TUD_EXT.3, Application Signing, requires the TSF to ensure that application software updates are digitally signed prior to installation.
FPT_TUD_EXT.4, Trusted Update Verification, requires the TSF to enforce validity of system software’s code signing certificate prior to installation.
FPT_TUD_EXT.5, Application Verification, requires the TSF to enforce validity of application software’s code signing certificate prior to installation.
FPT_TUD_EXT.6, Trusted Update Verification, requires the TSF to prevent the intentional rollback of software updates.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: No dependencies.
The following actions could be considered for the management functions in FMT:
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to: FCS_COP.1 Cryptographic Operation
There are no management activities foreseen.
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to: FIA_X509_EXT.1 X.509 Validation of Certificates
FIA_X509_EXT.2 X.509 Certificate Authentication
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FIA_X509_EXT.1 X.509 Validation of Certificates
FIA_X509_EXT.2 X.509 Certificate Authentication
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FIA_X509_EXT.1 X.509 Validation of Certificates
FIA_X509_EXT.2 X.509 Certificate Authentication
There are no management activities foreseen.
There are no auditable events foreseen.
FMT_MOF_EXT.1, Management of Security Functions Behavior, requires the TSF to apply restrictions to access its management functions to the authorized roles.
The following actions could be considered for the management functions in FMT:
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FMT_SMF.1 Specification of Management Functions
FMT_SMF_EXT.2, Specification of Remediation Actions, requires the TSF to automatically perform specific management functions in response to a specific event.
FMT_SMF_EXT.3, Current Administrator, requires the TSF to provide users with a list of administrators and their specified functions.
The following actions could be considered for the management functions in FMT:
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to: No dependencies.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FMT_SMR.1 Security Roles
FTA_SSL_EXT.1, TSF- and User-initiated Locked State , requires the TSF to manage the transition to a locked state and what operations can be performed.
The following actions could be considered for the management functions in FMT:
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: No dependencies.
FTP_ITC_EXT.1, Trusted Channel Communication, requires the TSF to manage the communication channel between itself and other trusted products.
The following actions could be considered for the management functions in FMT:
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to: No dependencies.
FDP_ACF_EXT.1, Access Control for System Services, requires the TSF to be able to control access to its own services.
FDP_ACF_EXT.2, Access Control for System Resources, requires the TSF to be able to provide separate copies of system resources for different application groups.
FDP_ACF_EXT.3, Security Attribute Based Access Control, requires the TSF to enforce policies on applications that prohibit write and execute permissions from being granted simultaneously.
The following actions could be considered for the management functions in FMT:
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FMT_SMR.1 Security Roles
The following actions could be considered for the management functions in FMT:
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FDP_ACF_EXT.1 Access Control for System Services
FMT_SMR.1 Security Roles
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: No dependencies.
FDP_BCK_EXT.1, Application Backup, requires the TSF to be able to determine which data to include in backup operations.
The following actions could be considered for the management functions in FMT:
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: No dependencies.
FDP_BLT_EXT.1, Limitation of Bluetooth Device Access, requires the TSF to manage which applications communicate with Bluetooth devices.
There are no management activities foreseen.
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: No dependencies.
FDP_DAR_EXT.1, Protected Data Encryption, requires the TSF to be able to protect all data with a chosen method of encryption.
FDP_DAR_EXT.2, Sensitive Data Encryption, requires the TSF to protect the Trust Anchor Database.
The following actions could be considered for the management functions in FMT:
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to: FCS_COP.1 Cryptographic Operation
The following actions could be considered for the management functions in FMT:
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to: FCS_COP.1 Cryptographic Operation
FCS_CKM.2 Cryptographic Key Establishment
FCS_STG_EXT.2 Encrypted Cryptographic Key Storage
FDP_IFC_EXT.1, Subset Information Flow Control, requires the TSF to be able to support the use of an IPsec VPN to protect data in transit.
The following actions could be considered for the management functions in FMT:
There are no auditable events foreseen.
Hierarchical to: No other components.
Dependencies to: FTP_ITC_EXT.1 Trusted Channel Communication
FDP_STG_EXT.1, User Data Storage, requires the TSF to be able to label, encrypt, store, and decrypt sensitive data and keys.
There are no management activities foreseen.
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to: FCS_COP.1 Cryptographic Operation
FCS_CKM.2 Cryptographic Key Establishment
FCS_STG_EXT.2 Encrypted Cryptographic Key Storage
FDP_UPC_EXT.1, Inter-TSF User Data Transfer Protection, requires the TSF to be able to protect communication channels between products using a chosen secure method.
There are no management activities foreseen.
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
Hierarchical to: No other components.
Dependencies to: FTP_ITC_EXT.1 Trusted Channel Communication
IF |
From FAU_GEN.1.1: * select no additional auditable events |
THEN |
From FAU_GEN.1.2: * select no additional information |
DECISION J |
CHOICE J1
From FCS_COP.1.1/HASH: * select SHA-256 * select 256 bits
|
CHOICE J2
From FCS_COP.1.1/HASH: Do not choose:
* SHA-256 Do not choose:
* 256 bits |
DECISION K |
CHOICE K1
From FCS_COP.1.1/HASH: * select SHA-384 * select 384 bits
|
CHOICE K2
From FCS_COP.1.1/HASH: Do not choose:
* SHA-384 Do not choose:
* 384 bits |
DECISION L |
CHOICE L1
From FCS_COP.1.1/HASH: * select SHA-512 * select 512 bits
|
CHOICE L2
From FCS_COP.1.1/HASH: Do not choose:
* SHA-512 Do not choose:
* 512 bits |
IF |
From FCS_HTTPS_EXT.1.3: * select not establish the connection |
THEN |
From FCS_TLSC_EXT.1.3: * select with no exceptions |
IF |
From FCS_HTTPS_EXT.1.3: |
THEN |
From FCS_TLSC_EXT.1.3: * select except when override is authorized |
IF |
From FCS_STG_EXT.1.1: * select software-based |
THEN |
From FCS_STG_EXT.2.1: * select all software-based key storage |
IF |
From FIA_X509_EXT.2.2: * select allow the administrator to choose |
THEN |
From FMT_SMF.1.1: |
IF |
From FIA_X509_EXT.2.2: * select allow the user to choose |
THEN |
From FMT_SMF.1.1: |
IF |
From FCS_STG_EXT.1.5: * select the user |
THEN |
From FMT_SMF.1.1: |
IF |
From FCS_STG_EXT.1.5: * select the administrator |
THEN |
From FMT_SMF.1.1: |
IF |
From FTP_ITC_EXT.1.1: * select mutually authenticated DTLS |
THEN |
From FCS_TLS_EXT.1.1: * select DTLS as a client
From FCS_DTLSC_EXT.1.1: * select mutual authentication
From FCS_DTLSC_EXT.1.3: * select with no exceptions |
IF |
From FTP_ITC_EXT.1.1: * select IPsec |
THEN |
Include the PP-Module for Virtual Private Network (VPN) Clients,
version
2.4 module in the ST |
This appendix lists requirements that should be considered satisfied by products successfully evaluated against this PP. These requirements are not featured explicitly as SFRs and should not be included in the ST. They are not included as standalone SFRs because it would increase the time, cost, and complexity of evaluation. This approach is permitted by [CC] Part 1, 8.2 Dependencies between components.
This information benefits systems engineering activities which call for inclusion of particular security controls. Evaluation against the PP provides evidence that these controls are present and have been evaluated.
Requirement | Rationale for Satisfaction |
---|---|
FAU_SEL.1 - Selective Audit | FAU_SEL.1 has a dependency on FMT_MTD.1 since configuration of audit data is a subset of managing TSF data. This dependency is met by FMT_SMF.1, which defines "configure the auditable items" as a management function and specifies the roles that may perform this, consistent with how FMT_MTD.1 would typically satisfy the dependency. |
FCS_CKM.1 - Cryptographic Key Generation | FCS_CKM.1 has a dependency on FCS_CKM.4 for the subsequent destruction of any keys that the TSF generates. This dependency is met by the extended SFR FCS_CKM_EXT.4, which serves the same purpose. |
FCS_CKM.1 - Cryptographic Key Generation | FCS_CKM.1 has a dependency on FCS_CKM.4 for the subsequent destruction of any keys that the TSF generates. This dependency is met by the extended SFR FCS_CKM_EXT.4, which serves the same purpose as its CC Part 2 equivalent. |
FCS_CKM.2 - Cryptographic Key Establishment | Both iterations of FCS_CKM.2 have a dependency on FCS_CKM.4 for the subsequent destruction of any keys that the TSF establishes. This dependency is met by the extended SFR FCS_CKM_EXT.4, which serves the same purpose as its CC Part 2 equivalent. |
FCS_COP.1 - Cryptographic Operation | All iterations of FCS_COP.1 have a dependency on FCS_CKM.4 for the subsequent destruction of any residual key material the TSF creates as part of the operation. This dependency is met by the extended SFR FCS_CKM_EXT.4, which serves the same purpose as its CC Part 2 equivalent. |
FCS_STG_EXT.1 - Cryptographic Key Storage | FCS_STG_EXT.1 has a dependency on FMT_SMR.1 for the management roles that are authorized to manage the functionality defined by the requirement. This dependency is met by FMT_SMF.1, which implicitly defines separate management roles for the TSF. |
FDP_ACF_EXT.1 - Access Control for System Services | FDP_ACF_EXT.1 has a dependency on FMT_SMR.1 for the management roles that are authorized to manage the functionality defined by the requirement. This dependency is met by FMT_SMF.1, which implicitly defines separate management roles for the TSF. |
FDP_ACF_EXT.2 - Access Control for System Resources | FDP_ACF_EXT.2 has a dependency on FMT_SMR.1 for the management roles that are authorized to manage the functionality defined by the requirement. This dependency is met by FMT_SMF.1, which implicitly defines separate management roles for the TSF. |
FIA_AFL_EXT.1 - Authentication Failure Handling | FIA_AFL_EXT.1 has a dependency on FIA_UAU.1 since handling of authentication failures is not possible without an authentication mechanism. This dependency is met by the extended SFR FIA_UAU_EXT.1, which serves the same purpose as its CC Part 2 equivalent. |
FIA_PMG_EXT.1 - Password Management | FIA_PMG_EXT.1 has a dependency on FIA_UAU.1 since composition of authentication credentials is not possible without an authentication mechanism. This dependency is met by the extended SFR FIA_UAU_EXT.1, which serves the same purpose as its CC Part 2 equivalent. |
FIA_UAU.7 - Protected Authentication Feedback | FIA_UAU.7 has a dependency on FIA_UAU.1 since protected authentication feedback is not possible without an authentication mechanism. This dependency is met by the extended SFR FIA_UAU_EXT.1, which serves the same purpose as its CC Part 2 equivalent. |
FMT_SMF_EXT.3 - Current Administrator | FMT_SMF_EXT.3 has a dependency on FMT_SMR.1 through its reference to management roles in the requirement text. This dependency is met by FMT_SMF.1, which implicitly defines separate management roles for the TSF. |
Cipher Mode | Reference | IV Requirements |
Electronic Codebook (ECB) | SP 800-38A | No IV |
Counter (CTR) | SP 800-38A | "Initial Counter" shall be non-repeating. No counter value shall be repeated across multiple messages with the same secret key. |
Cipher Block Chaining (CBC) | SP 800-38A | IVs shall be unpredictable. Repeating IVs leak information about whether the first one or more blocks are shared between two messages, so IVs should be non-repeating in such situations. |
Output Feedback (OFB) | SP 800-38A | IVs shall be non-repeating and shall not be generated by invoking the cipher on another IV. |
Cipher Feedback (CFB) | SP 800-38A | IVs should be non-repeating as repeating IVs leak information about the first plaintext block and about common shared prefixes in messages. |
XEX (XOR Encrypt XOR) Tweakable Block Cipher with Ciphertext Stealing (XTS) | SP 800-38E | No IV. Tweak values shall be non-negative integers, assigned consecutively, and starting at an arbitrary non-negative integer. |
Cipher-based Message Authentication Code (CMAC) | SP 800-38B | No IV |
Key Wrap and Key Wrap with Padding | SP 800-38F | No IV |
Counter with CBC-Message Authentication Code (CCM) | SP 800-38C | No IV. Nonces shall be non-repeating. |
Galois Counter Mode (GCM) | SP 800-38D | IV shall be non-repeating. The number of invocations of GCM shall not exceed $2^{32}$ for a given secret key unless an implementation only uses 96-bit IVs (default length). |
DECISION A | ||||||
CHOICE A1
From FCS_CKM.1.1: * select RSA schemes * for the 1st
assignment,
Set to 3072
| ||||||
CHOICE A2
From FCS_CKM.1.1: * select ECC schemes
From FCS_TLSS_EXT.1.3: * select ECDHE parameters using elliptic curves
[selection: secp256r1, secp384r1, secp521r1 ] and no other curves
* select secp384r1
|
DECISION F |
CHOICE F1
From FCS_CKM.2.1/LOCKED: |
CHOICE F2
From FCS_CKM.2.1/LOCKED: * select RSA-based key establishment schemes |
DECISION G |
CHOICE G1
From FIA_X509_EXT.2.2: * select allow the administrator to choose |
CHOICE G2
From FIA_X509_EXT.2.2: * select not accept the certificate |
DECISION H |
CHOICE H1
From FMT_SMF.1.1: From 3: * select on a per-app basis |
CHOICE H2
From FMT_SMF.1.1: From 3: |
CHOICE H3
From FMT_SMF.1.1: From 3: * select on a per-app basis |
DECISION I |
CHOICE I1
From FMT_SMF.1.1: From 5: * select on a per-app basis |
CHOICE I2
From FMT_SMF.1.1: From 5: |
CHOICE I3
From FMT_SMF.1.1: From 5: * select on a per-app basis |
Acronym | Meaning |
---|---|
AEAD | Authenticated Encryption with Associated Data |
AES | Advanced Encryption Standard |
ANSI | American National Standards Institute |
AP | Application Processor |
API | Application Programming Interface |
ASLR | Address Space Layout Randomization |
BAF | Biometric Authentication Factor |
Base-PP | Base Protection Profile |
BP | Baseband Processor |
BR/EDR | (Bluetooth) Basic Rate/Enhanced Data Rate |
BYOD | Bring Your Own Device |
CA | Certificate Authority |
CBC | Cipher Block Chaining |
CC | Common Criteria |
CCM | Counter with CBC-Message Authentication Code |
CCMP | CCM Protocol |
CEM | Common Evaluation Methodology |
CMC | Certificate Management over Cryptographic Message Syntax (CMS) |
cPP | Collaborative Protection Profile |
CPU | Central Processing Unit |
CRL | Certificate Revocation List |
CSP | Critical Security Parameter |
DAR | Data At Rest |
DEK | Data Encryption Key |
DEK | Data Encryption Key |
DEP | Data Execution Prevention |
DH | Diffie-Hellman |
DNS | Domain Name System |
DSA | Digital Signature Algorithm |
DTLS | Datagram Transport Layer Security |
EAP | Extensible Authentication Protocol |
EAPOL | EAP Over LAN |
ECDH | Elliptic Curve Diffie Hellman |
ECDSA | Elliptic Curve Digital Signature Algorithm |
EEPROM | Electrically Erasable Programmable Read-Only Memory |
EP | Extended Package |
EST | Enrollment over Secure Transport |
FEK | File Encryption Key |
FFC | Finite Field Cryptography |
FIPS | Federal Information Processing Standards |
FM | Frequency Modulation |
FP | Functional Package |
FQDN | Fully Qualified Domain Name |
GCM | Galois Counter Mode |
GPS | Global Positioning System |
GPU | Graphics Processing Unit |
HDMI | High Definition Multimedia Interface |
HMAC | Keyed-Hash Message Authentication Code |
HTTPS | HyperText Transfer Protocol Secure |
IEEE | Institute of Electrical and Electronics Engineers |
IP | Internet Protocol |
IPC | Inter-Process Communication |
IPsec | Internet Protocol Security |
KAT | Known Answer Test |
KDF | Key Derivation Function |
KEK | Key Encryption Key |
LE | (Bluetooth) Low Energy |
LTE | Long Term Evolution |
MD | Mobile Device |
MDM | Mobile Device Management |
MMI | Man-Machine Interface |
MMS | Multimedia Messaging Service |
MMU | Memory Management Unit |
NFC | Near Field Communication |
NIST | National Institute of Standards and Technology |
NTP | Network Time Protocol |
NX | Never Execute |
OCSP | Online Certificate Status Protocol |
OE | Operational Environment |
OID | Object Identifier |
OS | Operating System |
OTA | Over the Air |
PAE | Port Access Entity |
PBKDF | Password-Based Key Derivation Function |
PD | Protected Data |
PIV | Personal Identity Verification |
PMK | Pairwise Master Key |
PP | Protection Profile |
PP-Configuration | Protection Profile Configuration |
PP-Module | Protection Profile Module |
PRF | Pseudorandom Function |
PSK | Pre-Shared Key |
PTK | Pairwise Temporal Key |
RA | Registration Authority |
RBG | Random Bit Generator |
REK | Root Encryption Key |
ROM | Read-only memory |
RSA | Rivest Shamir Adleman Algorithm |
SAFAR | System Authentication False Accept Rate |
SAR | Security Assurance Requirement |
SFR | Security Functional Requirement |
SHA | Secure Hash Algorithm |
SMS | Short Messaging Service |
SoC | System On a Chip |
SPI | Security Parameter Index |
SSH | Secure Shell |
SSID | Service Set Identifier |
ST | Security Target |
TLS | Transport Layer Security |
TOE | Target of Evaluation |
TSF | TOE Security Functionality |
TSFI | TSF Interface |
TSS | TOE Summary Specification |
URI | Uniform Resource Identifier |
USB | Universal Serial Bus |
USSD | Unstructured Supplementary Service Data |
VPN | Virtual Private Network |
XCCDF | eXtensible Configuration Checklist Description Format |
XTS | XEX (XOR Encrypt XOR) Tweakable Block Cipher with Ciphertext Stealing |
Identifier | Title |
---|---|
[CC] | Common Criteria for Information Technology Security Evaluation -
|
[CEM] | Common Evaluation Methodology for Information Technology Security - Evaluation Methodology, CCMB-2012-09-004, Version 3.1, Revision 5, April 2017. |