Manuals / Nortel Networks / Computer Equipment / Network Router

Nortel Networks 7.05, 7.11 manual Conventions, Acronyms, and Terminology

Models: 7.11 7.05

1 67

Download 67 pages 33.01 Kb

Page 6

1.3 Conventions, Acronyms, and Terminology

	Security Target, Version 3.9		March 18, 2008


	Keywords	VPN, Router, Firewall, IPSec

1.3 Conventions, Acronyms, and Terminology

1.3.1 Conventions

There are several font variations used within this ST. Selected presentation choices are discussed here to aid the Security Target reader.

The CC allows for several operations to be performed on security requirements: assignment, refinement, selection and iteration. All of these operations are used within this ST. These operations are presented in the same manner in which they appear in Parts 2 and 3 of the CC with the following exceptions:

Completed assignment statements are identified using [italicized text within brackets]. Completed selection statements are identified using [underlined italicized text within brackets]. Refinements are identified using bold text. Any text removed is stricken (Example: TSF Data) and should be considered as a refinement.

Iterations are identified by appending a letter in parenthesis following the component title. For example, FAU_GEN.1(a) Audit Data Generation would be the first iteration and FAU_GEN.1(b) Audit Data Generation would be the second iteration.

1.3.2 Terminology

The acronyms used within this ST are described in Section 9 – “Acronyms.” TOE-specific terminology used throughout the Security Target is explained in Table 2 below:

			Table 2 - Terminology

	Term		Explanation

	Technology
	Technology

Contivity			Refers to the marketing name of the Nortel VPN Router.

	User Types

Primary Admin			The Primary Admin account has the ability to conduct all administrative privileges and
			rights of the TOE. The Primary Admin also has the ability to create and assign various
			rights to additional administrators. There can only be one Primary Admin of the TOE.

Restricted Admin			A Restricted Admin of the TOE has various administrative privileges as assigned by
			the Primary Admin. The types of privileges available to Restricted Admins are:
			Manage Nortel VPN Router
			View Nortel VPN Router
			Subgroups
			Manage Users
			View Users

Administrators			Refers to all administrators of the TOE (both the Primary Admin and any assigned
			Restricted Admins)

Users			Refers to VPN users or any person authorized to use the TOE but lacking
			administrative privileges.

Operators			Refers to any human that interacts with the TOE, including Administrators and Users.

	Privilege Types

Nortel VPN Router v7.05 and Client Workstation v7.11	Page 6 of 67
© 2008 Nortel Networks

Image 6

Nortel Networks 7.05, 7.11 manual Conventions, Acronyms, and Terminology

Contents

Prepared by Evaluation Assurance Level EAL 4+ Document VersionPrepared for Nortel NetworksModification Date Revision HistoryVersion Modified ByTOE SUMMARY SPECIFICATION Table of ContentsTABLE OF CONTENTS REVISION HISTORYPROTECTION PROFILE CLAIMS Table of FiguresTable of Tables RATIONALE1.2 Security Target, TOE and CC Identification and Conformance 1 Security Target Introduction1.1 Purpose Table 1 - ST, TOE, and CC Identification and Conformance1.3.2 Terminology 1.3 Conventions, Acronyms, and Terminology1.3.1 Conventions Table 2 - TerminologyPrimary Admin password View Nortel VPN Router rightsPage 7 of 2.1 Product Type Figure 1 - VPN Client Deployment Configuration of the TOE2 TOE Description 2.2 Product DescriptionFigure 2 - Branch Office Deployment Configuration of the TOE 2.3.1 Physical Boundary Figure 4 - Physical TOE Boundary in Branch Office Tunnel Mode2.3 TOE Boundaries and Scope Figure 3 - Physical TOE Boundary2.3.2 Logical Boundary 2.3.1.1 TOE EnvironmentThe World Nortel VPN Switch Software VxWorks OS Contivity Hardware ApplianceFigure 6 - TOE Logical Boundary in Branch Office Tunnel Mode Software2.3.2.1 Security Audit 2.3.2.2 Cryptographic Support2.3.2.3 User Data Protection 2.3.2.6 Protection of the TOE Security Functions 2.3.2.4 Identification and Authentication2.3.2.5 Security Management 2.3.2.7 Trusted Path/Channels2.3.3 Excluded TOE Functionality 3 TOE Security Environment 3.1 Assumptions3.2 Threats to Security T.HACK 3.2.1 Threats Addressed by the TOE3.2.2 Threats Addressed by the TOE Environment TE.PHYSICAL4 Security Objectives 4.1 Security Objectives for the TOE4.2 Security Objectives for the Environment 4.2.1 IT Security Objectives4.2.2 Non-IT Security Objectives 5 IT Security Requirements 5.1 TOE Security Functional RequirementsTable 3 - TOE Security Functional Requirements Page 21 of FAUSAR.1 Audit review 5.1.1 Class FAU Security AuditFAUGEN.1 Audit Data Generation Table 4 - Auditable EventsDependencies FAUGEN.1 Audit data generation Page 23 ofCryptographic key generation Diffie-Hellman 5.1.2 Class FCS Cryptographic SupportFCSCKM.1a FCSCKM.1bFCSCOP.1d Cryptographic operation authenticationFCSCOP.1b Cryptographic operation random number generationFCSCKM.4 Cryptographic key destruction FDPITC.2 Import of user data with security attributes, orFCSCKM.1 Cryptographic key generation FMTMSA.2 Secure security attributes5.1.3 Class FDP User Data Protection FDPACC.2 Complete access controlFDPACF.1 Security attribute based access control FDPIFC.2a Complete information flow control VPNFDPIFC.2b Complete information flow control Firewall FDPIFF.1a Simple security attributes VPNFDPIFF.1b Simple security attributes Firewall FDPUCT.1 Basic data exchange confidentiality FDPUIT.1 Data exchange integrityPage 30 of FIAUAU.5 Multiple authentication mechanisms 5.1.4 Class FIA Identification and AuthenticationFIAUAU.1 Timing of authentication FIAUID.2 User identification before any actionPage 32 of FMTMOF.1b Management of security functions behaviour 5.1.5 Class FMT Security ManagementFMTMOF.1a Management of security functions behaviour FMTMSA.1a Management of security attributesFMTMSA.3a Static attribute initialisation FMTMSA.1c Management of security attributesFMTMSA.2 Secure security attributes Page 34 ofFMTMSA.3c Static attribute initialisation FMTSMF.1 Specification of Management FunctionsFMTMSA.3b Static attribute initialisation FMTSMR.1 Security rolesThe TSF shall be able to associate users with roles Page 36 of5.1.6 Class FPT Protection of the TSF FPTAMT.1 Abstract machine testingFPTTST.1 TSF testing FPTRPL.1 Replay detection5.1.7 Class FTP Trusted Path/Channels FTPTRP.1 Trusted pathFPTSEP.1 TSF domain separation 5.2 Security Functional Requirements on the IT EnvironmentFPTRVM.1 Non-bypassability of the TSP FPTSTM.1 Reliable time stampsPage 40 of 5.3 Assurance Requirements Table 6 - Assurance Components6 TOE Summary Specification 6.1 TOE Security FunctionsAccounting Logs 6.1.1 Security AuditConfiguration Log Security LogSystem Log Event LogTOE Security Functional Requirements Satisfied FAUGEN.1, FAUSAR.1 6.1.2 Cryptographic Support Table 8 - FIPS Validated ModulesTable 9 - FIPS-Validated Cryptographic Algorithms 6.1.3 User Data Protection Page 46 of6.1.4 Identification and Authentication 6.1.5 Security Management6.1.6.1 Power-Up Self-Tests 6.1.6 Protection of the TOE Security Functions6.1.6.2 Conditional Self-Tests 6.2 TOE Security Assurance Measures 6.1.7 Trusted Path/Channels8 Augmentation to EAL 4+ assurance level Page 50 of7 Protection Profile Claims 7.1 Protection Profile Reference8 Rationale 8.1 Security Objectives RationaleTable 11 - Relationship of Security Threats to Objectives T.HACK Nortel VPN Router v7.05 and Client Workstation 2008 Nortel NetworksPage 54 of 8.2 Security Functional Requirements Rationale Page 55 ofTable 12 - Relationship of Security Requirements to Objectives ObjectivesRequirements  The Primary Admin access to all the administrative functions that are used to enforce the SFP FMTMSA.3a,b,c O.REPLAY 8.5 Dependency Rationale 8.3 Security Assurance Requirements Rationale8.4 Rationale for Strength of Function Table 13 - Functional Requirements DependenciesMet by hierarchical SFR FIAUID.2 9 Met by hierarchical SFR FDPACC.2Met by hierarchical SFR FDPIFC.2 SFR ID8.6 TOE Summary Specification Rationale FCSCOP.1FDPUCT.1 8.6.2.1 Configuration Management 8.6.2.2 Secure Delivery and Operation8.6.2.3 Development 8.6.2.6 Tests 8.6.2.4 Guidance Documentation8.6.2.5 Life Cycle Support Documents Page 64 of8.7 Strength of Function 8.6.2.7 Vulnerability and TOE Strength of Function Analyses9 Acronyms Table 15 - AcronymsPage 67 of