Nortel Networks 7.05, 7.11 manual Protection of the TOE Security Functions, Power-Up Self-Tests

Page 48

Security Target, Version 3.9

March 18, 2008

 

 

functions. The VPN User has no access to administrative functions and may only authenticate to the Nortel VPN Router through the Nortel VPN Client in order to access the private network.

These roles determine a user’s level of access to security management functions provided by the TOE. These security management functions include management of all audit and event records, management of access control, and management of VPN and firewall functions. Each user assumes one role from the available roles.

Administrators manage TOE security functionality and change, query, modify, or delete security attributes via the management GUI. All requests for services from either the management GUI or the Nortel VPN Client are passed to the Nortel VPN Router, which mediates access control to those functions. The Nortel VPN Router makes the access control decision by comparing the user’s role and the privilege requirement for the type of request made.

As described in the Security Functional Policies, management and modification of secure values are restricted to ensure that only secure values are accepted for security attributes and that the default values used for initialization of the security attributes are not altered.

TOE Security Functional Requirements Satisfied: FMT_MOF.1(a), FMT_MOF.1(b), FMT_MSA.1(a), FMT_MSA.1(b), FMT_MSA.1(c), FMT_MSA.2, FMT_MSA.3(a), FMT_MSA.3(b), FMT_MSA.3(c), FMT_SMF.1, FMT_SMR.1.

6.1.6 Protection of the TOE Security Functions

The TOE’s FIPS 140-2 validated cryptographic module will offer its services only after all power-up self-tests (at power-up) and all conditional self-tests (when creation of an IPSec tunnel is requested) have passed; if these self- tests do not pass then the TOE enters an error state and logs the failure. All error states can be cleared by restarting the module. If the self-tests do pass, then an IPSec tunnel is established, thus activating all of the IPSec security features. The TOE runs continuous checks on the IPSec tunnel to detect replay attacks. If a replay attack is detected then the associated packets are immediately dropped.

The TOE performs the following Start-Up and Conditional Self-Tests in order to ensure the secure and proper operation of the TSF:

6.1.6.1Power-Up Self-Tests

FIPS 140-2 validated power-up self-tests are executed automatically when the module is started. The Start-Up Self- Tests performed by the TOE are described below:

Software Integrity Check: Verifies the integrity of the software binaries of the module using an HMAC- SHA-1 keyed hash.

AES Known Answer Test (KAT): Verifies the correct operation of the AES algorithm implementation.

3DES KAT: Verifies the correct operation of the Triple-DES algorithm implementation.

SHA-1 KAT: Verifies the correct operation of the SHA-1 algorithm implementation.

HMAC-SHA-1 KAT: Verifies the correct operation of the HMAC-SHA-1 algorithm implementation.

FIPS 186-2 Random Number Generator (RNG) KAT: Verifies the correct operation of the FIPS 186-2 RNG implementation.

Alternating Bypass Mode Test: Verifies the integrity of the module’s bypass capability (hard-coded in the filter driver).

6.1.6.2Conditional Self-Tests

FIPS 140-2 validated conditional self-tests are executed automatically when certain criteria or events occur. The TOE performs three conditional self-tests: a pair-wise consistency test each time the an RSA public/private key is generated, a continuous random number generator test each time the module produces random data, and a software load test for upgrades. The Conditional Self-Tests performed by the TOE are described below.

FIPS 186-2 Continuous RNG: Verifies that the Approved RNG is not failing to a constant value.

Nortel VPN Router v7.05 and Client Workstation v7.11

Page 48 of 67

© 2008 Nortel Networks

 

Page 47 Page 49
Image 48
Page 47 Page 49
Contents Nortel Networks Corsec Security, Inc Revision History Version Modification Date Modified By Description of ChangesTable of Contents Table of Figures Table of TablesProtection Profile Claims RationaleSecurity Target Introduction PurposeSecurity Target, TOE and CC Identification and Conformance ST, TOE, and CC Identification and ConformanceConventions, Acronyms, and Terminology ConventionsTerminology TerminologyPrimary Admin password TOE Description Product TypeProduct Description Branch Office Deployment Configuration of the TOE TOE Boundaries and Scope Physical BoundaryLogical Boundary TOE EnvironmentWorld EnterpriseSecurity Audit Cryptographic SupportUser Data Protection Identification and Authentication Security ManagementProtection of the TOE Security Functions Trusted Path/ChannelsExcluded TOE Functionality TOE Security Environment AssumptionsThreats to Security Threats Addressed by the TOE Threats Addressed by the TOE EnvironmentSecurity Objectives Security Objectives for the TOESecurity Objectives for the Environment IT Security ObjectivesNon-IT Security Objectives OE.TIMEIT Security Requirements TOE Security Functional RequirementsTOE Security Functional Requirements ST OperationDescription ST Operation Class FAU Security Audit FAUGEN.1 Audit Data GenerationFAUSAR.1 Audit review Auditable EventsDependencies FAUGEN.1 Audit data generation Class FCS Cryptographic Support FCSCKM.1a Cryptographic key generation Diffie-HellmanFCSCKM.1b Cryptographic key generation RSA FCSCKM.4 Cryptographic key destructionFCSCOP.1b Cryptographic operation authentication FCSCOP.1d Cryptographic operation random number generationFCSCOP.1e Cryptographic operation hashing Security Target, Version March 18 FDPACC.2 Complete access control FDPACF.1 Security attribute based access controlClass FDP User Data Protection FDPIFC.2a Complete information flow control VPNFDPIFC.2b Complete information flow control Firewall FDPIFF.1a Simple security attributes VPNFDPIFF.1b Simple security attributes Firewall FDPUCT.1 Basic data exchange confidentiality FDPUIT.1 Data exchange integrityFDPUCT.1.1 FDPUIT.1.1Class FIA Identification and Authentication FIAUAU.1 Timing of authenticationFIAUAU.5 Multiple authentication mechanisms FIAUID.2 User identification before any actionDependencies No dependencies Class FMT Security Management FMTMOF.1a Management of security functions behaviourFMTMOF.1b Management of security functions behaviour FMTMSA.1a Management of security attributesFMTMSA.1c Management of security attributes FMTMSA.2 Secure security attributesFMTMSA.3a Static attribute initialisation FMTMSA.2.1FMTSMF.1 Specification of Management Functions FMTMSA.3b Static attribute initialisationFMTMSA.3c Static attribute initialisation FMTSMR.1 Security rolesFMTSMR.1.2 FPTAMT.1 Abstract machine testing FPTTST.1 TSF testingClass FPT Protection of the TSF FPTRPL.1 Replay detectionClass FTP Trusted Path/Channels FTPTRP.1 Trusted pathFTPTRP.1.1 FTPTRP.1.2Security Functional Requirements on the IT Environment FPTRVM.1 Non-bypassability of the TSPFPTSEP.1 TSF domain separation FPTSTM.1 Reliable time stampsSecurity Target, Version 3.9March 18 Assurance Requirements Assurance ComponentsAssurance Requirements TOE Summary Specification TOE Security FunctionsTOE Security Description FunctionConfiguration Log Security AuditAccounting Logs Security LogSystem Log Event LogCryptographic Support Fips Validated ModulesFIPS-Validated Cryptographic Algorithms Validation Modules Fips 140-2 Certificate #User Data Protection Identification and Authentication Security ManagementPower-Up Self-Tests Protection of the TOE Security FunctionsConditional Self-Tests TOE Security Assurance Measures Trusted Path/ChannelsTOE Security Functional Requirements Satisfied FTPTRP.1 Assurance Assurance Measure ComponentAugmentation to EAL 4+ assurance level Protection Profile Claims Protection Profile ReferenceRationale Security Objectives RationaleRelationship of Security Threats to Objectives TOE Objectives Environmental Objectives Non-ITHack Certificate Security Functional Requirements Rationale OE.CERTIFICATERelationship of Security Requirements to Objectives Objectives RequirementsFunctions and data EnvAble to access such functionality FMTMSA.3a,b,cReject packets based on their attributes IntegritySecurity Assurance Requirements Rationale Rationale for Strength of FunctionDependency Rationale Functional Requirements DependenciesFCSCOP.1 TOE Summary Specification Rationale Configuration Management Secure Delivery and OperationDevelopment Guidance Documentation Life Cycle Support DocumentsTests Strength of Function Vulnerability and TOE Strength of Function AnalysesAcronyms AcronymsAcronym Definition DoDSHA
Top Page Image Contents