Home

bizhub C550 / bizhub C451 / ineo+ 550 / ineo+ 451 Control Software

Contents

1. MASA a e SE sieias eeee es ea SESSA Si A Cae ae e si A TTT EL LL roo OA eee ee AAAA see e E _ AAA A 8 3 1 2 Sufficiency The TOE security functions for the TOE security functional requirements are described e FCS_CKM 1 FCS_CKM 1 regulates the various conditions of the encryption key generated along with the encryption of HDD use of S MIME function F CRYPT generates the encryption key of 128bit by using KonicaMinolta HDD encryption key generation algorithm SHA 1 F S MIME generates the encryption key of 128bit 192bit or 256bit for AES by using the Pseudorandom number Generation Algorithm Also similarly it generates the encryption key of 168bit for 3 Key Triple DES by using Pseudorandom number Generation Algorithm Accordingly this functional requirement is satisfied e FCS_COP 1 FCS_COP 1 regulates the various conditions of the encryption key that is generated along with the encryption of HDD F S MIME performs the data encryption by using 3 Key Triple DES with the encryption key of 168bit in the S MIME function Also it performs the encryption by using AES with the encryption key of 128bit 192bit or 256bit The encryption key that is used to encrypt the data is encrypted by using RSA with the encryption key of 1024bit 2048bit 3072bit or 4096bit Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 111 131 bizhub C550 bizhub C451 ineo 550 ineo 45
2. FIA_NEW 1 from TOE FIA_NEW 1 1 TSF shall demand to succeed in the user s identification before the action is taken to user HDD by TOE FIA_NEW 1 2 TSF shall stop the start of the action to user HDD by TOE if the user s identification is failed Hierarchical to No other components Dependencies No dependencies Audit FIA_NEW 1 The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP ST a Minimal unsuccessful use of user identification mechanism including offered user identification information b Basic Use all of user identification mechanism including offered user deification information Management FIA_NEW 1 The following actions could be considered for the management functions in FMT a management of user identification information 5 1 1 9 Extended requirement Remaining information protection after the explicit deletion operation FNEW_RIP 1 Protection of remaining information on the user data and TSF data after explicit deletion operation FNEW_RIP 1 1 TSF shall guarantee not to be able to use the content of any information before having been assigned Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 52 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target to the resource on the explicit deleting operation to the following ob
3. The TSF shall maintain the roles assignment the authorized identified roles lassignment the authorized identified roles The user who is permitted to use of the account FMT_SMR 1 2 6 The TSF shall be able to associate users with roles Hierarchical to No other components Dependencies FIA UID 1 FIA_UID 2 6 5 1 1 5 Protection of the TSF FPT_RVM 1 Non bypassability of the TSP FPT_RVM 1 1 The TSF shall ensure that TSP enforcement functions are invoked and succeed before each function within the TSC is allowed to proceed Hierarchical to No other components Dependencies No dependencies FPT_SEP 1 TSF domain separation FPT_SEP 1 1 The TSF shall maintain a security domain for its own execution that protects it from interference and tampering by untrusted subjects FPT_SEP 1 2 The TSF shall enforce separation between the security domains of subjects in the TSC Hierarchical to No other components Dependencies No dependencies 5 1 1 6 TOE Access FTA_SSL 3 TSF initiated termination FTA_SSL 3 1 The TSF shall terminate an interactive session after a assignment time interval of user inactivity lassignment time interval of user inactivity Time decided from the final operation depending on the panel auto logoff time 1 9 minute s while a administrator or a user is operating on the panel Hierarchical to
4. bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target FIA_SOS 1 1 4 The TSF shall provide a mechanism to verify that secrets HDD Lock Password Encryption passphrase meet lassignment a defined quality metric lassignment a defined quality metric Number of digits 20 digits Character type ASCII code 0x21 Ox7E except 0x22 0x28 0x29 0x2C 0x3A 0x3B 0x3C Ox3E Ox5B Ox5C and 0x5D Rule Do not composed by only the same kind of character strings Do not set the same password or passphrase as the current setting Hierarchical to No other components Dependencies No dependencies FIA_SOS 1 5 Verification of secrets FIA_SOS 1 1 5 The TSF shall provide a mechanism to verify that secrets Secure print password meet lassignment a defined quality metricl lassignment a defined quality metric Number of digits 8 digits Character type ASCII code 0x20 Ox7E except 0x22 and0x2B Rule Do not composed by only the same kind of character strings Hierarchical to No other components Dependencies No dependencies FIA_SOS 1 6 Verification of secrets FIA_SOS 1 1 6 The TSF shall provide a mechanism to verify that secrets Session Information meet lassignment a defined quality metricl lassignment a defined quality metric 107 and above Hierarchical to No other components Depende
5. bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target lt IT security functional requirement gt e Though several access control policies are set up by repeating the access control requirement FDP_ACC 1 etc and it regulates the access control related to the followings such as user box secure print MFP addresses These do not cover each other the same controlled object by several policies and so they do not compete each other e FNEW_RIP 1 is applied as an extended requirement that regulates the deletion of the protective assets but the threat concerning the possibility of an unauthorized deletion is not targeted in this case because of the concept of emphasis on confidentiality Therefore the requirement for the competing data deletion protection has not been selected at all O The structure that a competition possibility is suggested doesn t exist from the relations between requirements by dependency correlation by mutual support and the various analysis of validity of security functional requirement to TOE security objectives lt IT security assurance requirement gt EAL that is the assurance package is applied Therefore it is confirmed that the possibility of the competition between security assurance requirements doesn t exist regardless of this ST 8 3 Rational for TOE Summary Specifications 8 3 1 Rational for the TOE Security Functions 8 3 1 1 Necessity The conformity of the TO
6. 10 76 associates with the external server authentication setting data that is set in the case of the use of the external server only Active Directly method is applicable as the method of the user authentication function Because it deals when there are plural user information management servers there is the case which plural authentication server information are included in the external server information setting data Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 58 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target It is composed of the characters and by the number of digits shown in the Table 8 It shall not be composed of one kind of character While the external server authentication is effective the user ID and the user password cannot be changed same as the user registration gt User deletion User ID and user password is deleted When a personal user box that a concerned user owns exists that personal user box is automatically set to the public user box of user attributes public gt Change of the belonging account The belonging account that related to user is changed User Box Settings gt User Box Registration To register a personal user box or a public user box by selecting the user attribute to the non registration user box ID selected When it s registered it is possible to select User ID in the user attribute of the user box whic
7. 125 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target gt VV VV V v VV VV VV VV V Administrator authentication lock time Stop function of the Enhanced Security function Operational setting function of the Enhanced Security function HDD logical format function Registration Modification function of the user attribute of the user box Modification function of the administrator password Registration Modification function of the user box password Registration function of the User ID Registration Modification function of the User password when Machine authentication is selected as the method of the user authentication Modification function of the SNMP password Privacy password and Authentication password Operational setting function of the SNMP password authentication function Setting function of the Panel auto logoff time Registration Modification function of the account ID and the account password Registration Modification function of the S MIME certificate Registration Modification function of the transmission address data Registration Modification function of the setting data of the Trusted Channel function Registration Modification function of the belonging account related with a user Modification function of the administrator authentication lock time Lock release function This offers the following authentication functions Authentication function in the access to the MIB object
8. 57 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target When a user is identified and authenticated as an administrator by the administrator identification authentication function at the accessing request to the administrator mode the administrator authority is associated with the task substituting the user And the following operations and the use of the functions are permitted O Change of Administrator password When a user is re authenticated as an administrator by the panel and the new password satisfies the quality the password is changed gt gt Offers the administrator authentication mechanism that is authenticated by the administrator password which consists of the character shown in Table8 Resets the number of authentication failure when succeeding in the re authentication for each character as feedback for the entered administrator password in the Return re authentication by the access from the panel When the authentication failure that becomes 1 3 times at total in each authentication function by using the administrator password is detected it logoffs the administrator mode accessing from the panel and locks all the authentication functions to use the administrator password The access to the administrator mode is refused e The administrator specifies the failure frequency threshold by the unauthorized access detection threshold setting function F RES
9. Authentication function in the access to the Public user box Authentication function in the access to the secure print User authentication function Account authentication function F ADMIN SNMP offers security functions gt gt Modification function of the SNMP password Privacy password and Authentication password Operational setting function of the authentication of SNMP password F SERVICE offers the following security management functions gt gt gt gt gt gt Modification function of the CE password Lock release function of the administrator authentication Modification function of the CE authentication lock time Modification function of the administrator password Initialization function of the administrator password Initialization function Initialization function of the SNMP password Privacy password and Authentication password Initialization function Stop function of the Enhanced Security function HDD logical format function HDD physical format function HDD installation setting function Initialization function F USER offers the following security management functions Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 126 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target gt Modification function of user s own user password when Machine authentication is selected as the method of the
10. FDP_ITC 1 or FCS_CKM 1 FCS_CKM 1 FCS_CKM 4 FMT_MSA 2 lt The reason not to applyDFCS_CKM 4 Y FMT_MSA 2 gt The encryption key is regularly kept for the stored FCS_COP 1 E data Moreover an arbitrary access to the storage medium is difficult and there is no necessity of the encryption key cancellation TOE does not have the security attribute to be managed for the encryption key it is not necessary to be regulated a security attribute that is secure FIA_AFL 1 E FIA_UAU 1 FIA_UAU 2IE FIA_UID 1 N A lt The reason not to apply FIA_UID 1 gt This regulates the access to HDD installed in MFP There are no multiple access routes because the access FIA_UAU 2 E to HDD is done through a general IDE interface In other words when the some users access 1t 1s unnecessary for this processing the authentication information that each user accessing is needed and there is no necessity of the identification of the entity to access FIA_UAU 7 E FIA_UAU 1 FIA_UAU 2 2 FIA_UAU 2 3 FIA_UAU 215 8 2 1 6 Mutual Support Correlations of IT Security Functional Requirements Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 101 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target The IT security function requirements to operate effectively other security functional requirements which are not specified in the analysis of the dependencies relation of
11. In the case of the External server authentication has been selected as the user authentic method the identified and authenticated user is registered as an user ID with the user name and authentication server information that was used with identification and authentication 6 1 4 2 Auto logoff function in user identification and authentication domain While the user who is identified and authenticated is accessing from a panel if it does not accept any operations for more than the panel automatic logoff time it logs off from a user identification and authentication domain automatically Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 68 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target 6 1 4 3 Modification function of user password When the identification and authentication are succeeded and the access to the user identification and authentication domain is permitted the user is permitted to change its own password When the external server authentication is effective this function cannot be applied When the user password newly set satisfies the following qualities it is changed gt It is composed of the characters and by the number of digits shown in the Table 8 gt It shall not be composed of one kind of character 6 1 5 FBOX User Box Function F BOX is a series of security function related to the user box to the user who is identi
12. ineo 451 Control Software Security Target satisfies the SOF Basis and it is consistent with the minimum strength of function SOF Basic that is claimed for the TOE security functional requirement for the security strength of function stipulated in item 5 1 2 8 3 3 Mutually Supported TOE Security Functions The TOE security functional requirements that are satisfied by a combination of IT security functions that are identifies in the TOE summary specifications are as shown in the text regarding the rationale in the section of 8 3 1 8 3 4 Rationale for Assurance Measures The required document for the evaluation assurance level EAL3 is covered by the reference document shown in the assurance measures described in Section 2 The TOE security assurance requirements are satisfied through development test condition vulnerability analysis the development environment control configuration management life cycle management and delivery procedures in accordance with the document provided as the assurance measures as well as the preparation of a proper guidance document 8 4 PP claims rationale There is no PP that is referenced by this ST Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 131 131
13. 0x00 gt OxFF gt OxAA Mode 8 0x00 gt OxFF gt 0x00 gt OxFF gt 0x00 gt OxFF gt OxAA gt Verification Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 60 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target gt O gt gt gt gt gt gt gt gt Setting of auto logoff function The panel auto logoff time which is the setting data of the auto logoff function should be set within the following time range panel auto logoff time 1 9 minutes Network Settings A setup operation of the following setting data is performed A series of setup data that relates to SMTP server IP address Port Number etc A series of setup data that relates to DNS server IP address Port Number etc A series of setup data that relates to MFP address IP address NetBIOS Name AppleTalk Printer Name etc Execution of back up and restoration function All the setting data stored in NVRAM and HDD is backed up and re stored except the administrator password and the CE password As the object related to security due to the relation of confidentiality and completeness the one shown by the following classifications is targeted lt Type A Object to which back up and restoration should be limited gt SNMP password User password Account password Secure print password User Box password lt Type B Object to which restoration should be limited
14. A00JOYO 0100 GMO 00 Software KONICA MINOLTA BUSINESS TECHNOLOGIES INC 1 3 CC Conformance Claim The TOE which is the subject of this ST conforms to the following e Security function requirement Part2 Extended e Security assurance requirement Part3 Conformant e Evaluation assurance level EAL3 Conformant No additional assurance component e PP Reference This ST does not carry out a PP reference e Complement Apply Complement 0512 Interpratations 0512 Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 6 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target e Reference Common Criteria for Information Technology Security Evaluation Part 1 Introduction and general model 2005 Version 2 3 CCMB 2005 08 001 Common Criteria for Information Technology Security Evaluation Part 2 Security functional requirements 2005 Version 2 3 CCMB 2005 08 002 Common Criteria for Information Technology Security Evaluation Part 3 Security assurance requirements 2005 Version 2 8 CCMB 2005 08 003 CCIMB Interpretations 0407 Common Criteria for Information Technology Security Evaluation Part 1 Introduction and General Model Version 2 3 August 2005 CCMB 2005 08 001 December 2005 Translation Version 1 0 Information technology Promotion Agency Japan Security Center Information Security Certification Office Common Criteria for Information Technology Security Evaluatio
15. Encryption Key Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 98 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target Functional Requirements Component for this ST FDP_ACC 1 1 FDP_ACC 1 2 FDP_ACC 1 3 FDP_ACF 1 1 FDP_ACF 1 2 FDP_ACF 1 3 FIA_AFL 1 1 FIA_AFL 1 2 FIA_AFL 1 3 FIA_AFL 1 4 FIA_AFL 1 5 FIA_AFL 1 6 FIA_AFL 1 7 FIA_AFL 1 8 FIA_ATD 1 FIA_SOS 1 1 FIA_SOS 1 2 FIA_SOS 1 3 FIA_SOS 1 4 FIA_SOS 1 5 FIA_SOS 1 6 FIA_SOS 1 7 FIA_SOS 2 FIA_UAU 2 1 FIA_UAU 2 2 FIA_UAU 2 3 FIA_UAU 2 4 FIA_UAU 2 5 FIA_UAU 2 6 FIA_UAU 6 FIA_UAU 7 FIA_UID 2 1 FIA_UID 2 2 FIA_UID 2 3 FIA_UID 2 4 FIA_UID 215 Dependencies on CC Part 2 FDP_ACF1 FDP_ACC 1 FMT_MSA 3 FDP_ACC 1 FMT_MSA 3 FIA_UAU 1 FIA_UAU 1 FIA_UAU 1 FIA_UAU 1 FIA_UAU 1 FTA_UAU FIA_UAU 1 HM Z one Z one one one Z Z Z one Z one one Z Z one o Z O n FTA_UID 1 FTA_UID 1 FTA_UID 1 FTA_UID 1 FIA_UID 1 FIA_UID 1 FIA_UAU 1 Z Z Z Z Z Dependencies Relation in this ST lt The reason not apply FMT_MSA 2 gt The regulation of the secure security attribute is unnecessary because the key of 3 Key Triple DES which is generated at every transmission does not have a security attribute which should be managed to the encryption key encryption FDP_ACF1 1
16. FDP_ACC 1 1 FDP_ACC 1 2 FMT_MSA 3 2 FDP_ACC 1 3 lt The reason not to apply FMT_MSA 3 gt There is no necessity for applying this requirement because the object attribute doesn t exist FIA_UAU 2I FIA_UAU 2I FIA_UAU 2 1 FIA_UAU 2 2 FIA_UAU 2I3 214 F FIA_UAU 2 5 FIA_UAU 2 6 TA _UAU FIA_UID 2 5 TA_UID 2I 6 N A TA_UAU 2 1 FIA _UAU 2 2 FIA_UAU 2 3 TA_UAU 2 4 FIA _UAU 2 5 FIA_UAU 2 6 Y i Z IZ IZ Z gt i gt j gt gt gt Copyright O 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 99 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target Functional Requirements Component for this ST FIA_UID 26 FIA_UID 2 7 FIA_USB 1 TA_ATD 1 IA FIA_ATD FMT_SMF 1 FMT_SMF 1 PMO FAY FMT _SMR 1 FMT_SMR 1 1 FMT_SMR 1 2 FMT_MOF 1 2 FMT_SMF 1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_MOF 1 3 FMT_SMF 1 FMT_SMF 1 FMT _SMR 1 FMT_SMR 1 2 FMT_MSA 1 1 DP_ACC 1 or FDP_IFC 1 MT_SMF 1 MT_SMR 1 DP_ACC 1 or FDP_IFC 1 MT_SMF 1 F F F F F FMT_SMR 1 F F F F F Dependencies on CC Part 2 Dependencies Relation in this ST FMT_MSA 1 2 DP_ACC 1 or FDP_IFC 1 DP_ACC 1 1 MT_SMF 1 MT_SMF 1 MT _SMR 1 MT_SMR 1 2 FMT_SMR 1 6 MT_MSA 1 MT_MSA 1 1 FMT_MSA 1 2 FMT_MSA 3 1 MT_SMR 1 MT_SMR 1 3 Neither is applicable FMT_MSA 1 3 lt The reason not to apply FMT_MSA
17. HDD lock function is installed being possible to set the password and not being possible to read and write unless it agrees to the password Furthermore when the frequency of uniformity of it becomes unsuccessful in password collation the function is also ready to lock the password collation function e NVRAM Nonvolatile Memory The memory medium that stores various setting values needed for the operation of the MFP used for processing of TOE Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 9 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target e Encryption Board Option parts The hardware based cryptographic function which is the integrated circuit for encryption is installed in order to encipher all data to be written in HDD It is not pre installed in MFP as standard for convenience sake of a sale but is sold as an optional part O Panel The exclusive control device for the operation of the MFP equipped with the touch panel of a liquid crystal monitor ten key start key stop key screen switch key etc Main power supply The power switch for activating MFP O Network Unit The interface device to connect to the Ethernet It supports 10BASE T 100BASE TX and Gigabit Ethernet e USB The Port to print with local connection It has interface connected directly to MFP controller O Image Controller Option parts The controller for Fiery etc
18. TOE permits only the administrator the operation of the following functions The setting function related to the SMTP server The setting function related to the DNS server The setting function related to the address of MFP Backup function Restoration function Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 22 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target The setting function of Trusted Channel function setting data The setting function of certification transmission address data etc used for S MIME function TOE permits the operation of the following functions only to the administrator and the service engineer The function related to the setting of Enhanced Security function O OVERWRITE ALL Complete overwrite deletion TOE overwrites all data regions of HDD in MFP by using the deletion data and makes all the image data of restoration impossible In addition TOE offers a function to initialize a setting value such as the highly confidential password on NVRAM Administrator Password SNMP Password HDD Lock Password and Encryption Passphrase that is set by a user or an administrator O CRYPT KEY Encryption key generation TOE generates the encryption key to encrypt and store all data including the image file written in HDD in MFP O CHECK HDD Validity confirmation of HDD TOE verifies that correct HDD is installed O TRUSTED PASS
19. besides the permission of the use of functions such as F BOX and F PRINT 6 1 4 1 User Identification and Authentication Function lt Account Authentication User identification and authentication in the synchronized method gt When the access request for the user box and the request for the registration of the secure print file it is identified and authenticated to be a user Account Name account ID is associated with the concerned user ID that is set up beforehand besides the user ID for the identified and authenticated user and the use of FBOX and F PRINT is permitted to the identified and authenticated user O Offers the user authentication mechanism that authenticates the user that consists of the characters shown in Table 8 gt After the user is authenticated to the access from the network the user authentication mechanism using session information besides the user password is offered gt According to the protocol it uses the session information more than 10 or it generates and uses the session information more than 1010 O Return for each character as feedback for the entered user password O Resets the number of authentication failure when succeeding in the authentication O Not accept the access from the panel for five seconds when the authentication failed O When the authentication failure that becomes 1 3 times at total for the concerned user is detected it locks all the authentication functions to the user gt Th
20. concerning the CE password and that the service engineer makes the administrator to execute the operation rule concerning the administrator password so that this condition is realized e ASETTING Enhanced Security Function Operational Settings Condition This condition assumes the enhanced security function operational settings condition is satisfied OE N SETTING SECURITY regulates that this is used after the administrator activates the enhanced security function so that this condition is realized e ASERVER Management condition of user information management server connected with the intra official LAN This condition assumes that the requiring user information management server is managed securely when external server authentication is used as the method of the user authentication Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 79 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target OE N SERVER regulates that the person in charge of the organization executes the server management which is necessary to maintain security such as the patch application the account management and the access control for the user information management serve so that this condition is realized 8 1 3 Sufficiency of Threats The security objectives against threats are described as follows e T DISCARD MFP Lease return and disposal of MFP This threat assumes the possibility
21. gt VV VV V WV VV VV VV VV VV WV A series of data that relates to SMTP server setting A series of data that relates to DNS server setting A series of data that relates to MFP address setting Setting data of Enhanced Security function Setting data of operation method of user authentication function Authentication failure frequency threshold of authentication operation prohibition function Panel auto logoff time User ID User attribute of user box User box ID S MIME certificate Transmission address data Encryption strength setting data in S MIME function Trusted Channel function setting data Belonging Account of user CE authentication lock time Administrator authentication lock time lt Type C Object to which back up should be limited gt gt Secure print file Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 61 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target gt User box file Operation setting function of HDD lock function lt Operation Setting ON gt When turning it ON from OFF it verifies that the newly set HDD lock password satisfies the following qualities gt It is composed of the characters and by the number of digits shown in Table 8 gt It shall not be composed of one kind of character lt Modification of HDD lock password gt Change the HDD lock password By using the HDD lock password currently set whe
22. list of subjects objects and operations among subjects and objects covered by the SFP lassignment list of subjects objects and operations among subjects and objects covered by the SFP Listed in Tabel4 Secure print file access control operational list lassignment access control SFP Secure print file access control Hierarchical to No other components Dependencies FDPACF1 FDP_ACF 1 2 Table 4 Secure Print File Access Control Operational List Operational list A task to act for a user Secure Print File Access Control A List of Secure Print Files e Print Back Up FDP_ACC 1 3 Subset access control FDP_ACC 1 1 3 The TSF shall enforce the assignment access control SFP on lassignment list of subjects objects and operations among subjects and objects covered by the SFP lassignment list of subjects objects and operations among subjects and objects covered by the SFP Listedin Table 5 Setting management access control operational list lassignment access control SFP Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 28 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target Setting management access control Hierarchical to No other components Dependencies FDP_ACF1 FDP_ACF1 3 Table 5 Setting Management Access Control Operational List Operational list A
23. 1 gt This is the internal control ID that is identified uniquely and this does not require the management FMI MISA ale such as change or deletion after this is assigned once lt FMT_SMR 1 gt The assignment of FMT_MSA 3 2 is not applicable FMT_SMR 1 is the dependency that is set relating to the following and so there is no necessity of pplication a a MT_SMR 1 FMT_SMR 1 2 MT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 3 MT_SMR 1 FMT_SMR 1 2 MT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 4 MT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 3 MT_SMR 1 FMT_SMR 1 1 FMT_SMR 1 2 MT_SMR 1 FMT_SMR 1 2 MT_SMR 1 FMT_SMR 1 3 MT_SMR 1 FMT_SMR 1 1 MT_SMF1 FMT_SMF 1 MT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 5 S E FMT_MTD 1 1 yy FMT_MTD 1 2 yy FMT_MTD 1 3 33 z rj pm FMT_MTD 1 4 ye FMT_MTD 1 5 ye FMT_MTD 1 6 yy z rj m FMT_MTD 1 7 yy FMT_MTD 1 8 z rj m FMT_MTD 1 9 yy FMT_MTD 1 10 yy Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 100 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target Functional Requirements Component for this ST FMT_MTD 1 11 Dependencies on CC Part 2 Dependencies Relation in this ST FMT_MTD 1 12 FMT_MTD 1 13 FMT_SMF 1 FMT_SMR 1 1 FMT_SMR 1 2 FMT_SMR 1 3 FMT_SMR 1 4 FMT_SMR 1 5 FIA_UID 217 FMT_SMR 1 6 FPT_RVM 1 FPT_SEP 1 FTA _SSL 3 FIA_NEW 1 None N A
24. 11 Management of TSF data FMT_MTD 1 1 11 The TSF shall restrict the ability to selection change_default query modify delete clear lassignment other operations the lassignment list of TSF data to assignment the authorized identified roles lassignment ist of TSF datal Administrator password SNMP password selection change_default query modify delete clear lassignment other operations assignment other operations Initialization lassignment the authorized identified roles Administrator Service Engineer Hierarchical to No other components Dependencies FMT_SMF 1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 1 FMT_SMR 1 2 FMT_MTD 1 12 Management of TSF data FMT_MTD 1 1 12 The TSF shall restrict the ability to selection change default query modify delete clear lassignment Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 47 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target other operationsll the lassignment list of TSF data to assignment the authorized identified roles lassignment list of TSF datal Account ID Account password S MIME certificate Transmission address data Trusted channel function setting data selection change_default query modify delete clear lassignment other operations assignment other operations Registration lassignm
25. E Cryptographic operation FCS_COP 1 1 E The TSF Encryption board shall perform lassignment list oferyptographic operations in accordance with a specified cryptographic algorithm lassignment cryptographic algorithm and cryptographic key sizes assignment cryptographic key sizes that meet the following lassignment list of standardsl lassignment list of standards FIPS PUB 197 lassignment cryptographic algorithm AES lassignment cryptographic key sizes 128bit lassignment list of cryptographic operations Encryption of all data written in HDD e Decryption of all data read from HDD Hierarchical to No other components Dependencies i FDP_ITC 1 or FCS_CKM 1 FCS_CKM 1 FCS_CKM 4 N A FMT_MSA 2 N A 5 2 2 Identification and Authentication FIA_AFL 1 E Authentication failure handling Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 54 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target FIA_AFL 1 1 E The TSF HDD shall detect when selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values unsuccessful authentication attempts occur related to lassignment list of authentication events lassignment list of authentication events Authentication by HDD Lock function at the time of accessing HDD
26. KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 112 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target is set gt It permits the user who is permitted the use of a user box the operation of user box file in the selected public user box such as the print the transmission the download the movement and the copy gt It permits the user the list display of the user box group user box that has a corresponding object attribute to account ID gt It permits the user the operation of the user box file in the selected group user box such as the print the transmission the download the movement and the copy Accordingly this functional requirement is satisfied e FDP_ACF 1 2 FDP_ACF 1 2 regulates the regulation of the relationship between the subject controlled to the secure print file which is the object and the operation F ADMIN performs the secure print file access control to which the following rules are applied gt It permits the administrator the backup operation of the secure print file F PRINT performs the secure print file access control to which the following rules are applied gt It permits the user the list display operation of the secure print file gt It permits the printing operation of the selected secure print file to the user who is allowed to use the secure print file Accordingly this functional requirement is satisfied e FDP_ACF 1 3 FDP_ACF 1 3
27. No other components Dependencies No dependencies 5 1 1 7 Trusted pass channel Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 51 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target FTP_ITC 1 Inter TSF trusted channel FTP_ITC 1 1 The TSF shall provide a communication channel between itself and a remote trusted IT product that is logically distinct from other communication channels and provides assured identification of its end points and protection of the channel data from modification or disclosure FTP_ITC 1 2 The TSF shall permit selection the TSE the remote trusted IT product to initiate communication via the trusted channel selection the TSE the remote trusted IT product The remote trusted IT product FTP_ITC 1 3 The TSF shall initiate communication via the trusted channel for assignment list of functions for which a trusted channel is required assignment list of functions for which a trusted channel is required Download of the user box file Upload of the image file that will be stored as a user box file Upload of the image file that will be the secure print file Hierarchical to No other components Dependencies No dependencies 5 1 1 8 Extended requirement Identification and approval of access destination Identification and approval of a user becoming an access object
28. Target 2 3 Operation Environment of the TOE MFP MFP Controller RS 232C lt H gt Network CPU RAM X Encryption Unit lt oard Ethernet ia HDD NVRAM Flash Memory TOE OS i Message Data etc USB lt gt XImage Controller gt X FAX Unit Main Sub Panel Scan Unit Printer Power uto Document Feeder Unit Public line Panel Rane Paper Paper Operator Operator Figure 2 Hardware composition that relates to TOE Figure2 shows the structure of the hardware environment on the MFP that TOE needs for the operation TOE exists on the flash memory on the MFP controller which builds in the body of the MFP and is loaded and run on the RAM The following explains about the unique hardware on the MFP controller the hardware having the interface to the MFP controller and the connection by using RS 232C shown in Figure 2 e Flash memory Storage medium that stores the object code of the MFP Control Software that is the TOE Additionally it stores the message data of each country s language to display the response accessed through the panel and network OS VxWorks and so on e HDD Hard disk drive of 60GB in capacity It is utilized besides the image data is stored as a file temporarily image data with such as extension conversion and as an area where the transmission address data kept As a feature function the security function
29. The use of Trusted Channel TOE offers the function that communicates via Trusted Channel the following image file which is transmitted and received between MFP and PC lt Image file transmitted from MFP to PC gt e User box file lt Image file transmitted from PC to MFP gt Image file that will be stored as user box file Image file that will be stored as secure print file O CRYPTO MAIL The use of encrypted mail TOE offers the function that encrypts and transmits the user box file transmitted from MFP to the correct destination with e mail 4 2 Security objectives for the environment In this section the security objectives for the environment in the environment of the usage of the TOE is identified and described being divided into the IT environment security objectives and the non IT environment security objectives 4 2 1 IT environment security objectives OE CRYPT Encryption of HDD An encryption board installed in MFP encrypts all data including an image file to be written in HDD inside MFP and then stores it to an HDD Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 23 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target OE LOCK HDD Access control of HDD HDD installed in MFP accepts reading out of data only from the MFP where this HDD is installed OE FEED BACK Feedback of password The application of a browser etc used by client PC
30. and the service engineer FMT_MOF 1 2 restricts the method of the SNMP password authentication function only to the administrator lt Operational Limit of Trusted Channel function setting data gt The registration of the Trusted Channel function setting data is permitted only to the administrator by FMT_MOF 1 12 The modification of the Trusted Channel function setting Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 92 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target data is permitted only to the administrator by FMT_MTD 1 3 The behavior of Trusted Channel function is permitted only to the administrator by FMT_MOF 1 2 lt Operational Limit for S MIME function gt The registration of the S MIME certificate and the transmission address data is permitted only to the administrator by FMT_MTD 1 12 The modification of the S MIME certificate and the transmission address data is permitted only to the administrator by FMT_MTD 1 3 The behavior of the S MIME function is permitted only to the administrator by the FMT_MOF 1 2 lt Necessary requirements to keep the administrator secure gt gt refer to set admin lt Necessary requirements to keep the service engineer secure gt gt refer to set service lt Role and controlling function for each management gt As the role of doing these managements FMT_SMR 1 1 maintains a service engineer and F
31. attribute in addition to the user attribute This task is permitted to the user box file with the user attribute and the user box attribute corresponding to the user attribute and the user box attribute of itself the printing the E mail transmission include the S MIME transmission the FTP transmission the FAX transmission the SMB transmission download the removing to other user boxes and the copy operations to other user boxes User attribute change of a group user box The user attributes can be changed gt If another account ID is specified the user of another Account Name becomes an accessible group user box gt If public is specified it becomes a public user box It is necessary to register the user box password In this case it is verified that the user box password satisfies the following requirements It is composed of the characters and by the number of digits shown in Table 8 It shall not be composed of one kind of character gt Specify a registered user and change to a personal user box for the registered user Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 71 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target 6 1 6 FPRINT Secure Print Function F PRINT is a series of security function related to the secure print such as the access control function that allows the printing and displaying the list of the secure print file after auth
32. box name change of the password and deletion of user box etc O Attribute setting of user box classification change of a personal user box a public user box and a group box 2 5 3 User Authentication Function TOE can limit the user who uses MFP When accessing it through the panel or the network TOE performs the identification and authentication that the user is permitted to use the MFP by applying the user password and user ID When the identification and authentication succeeds TOE permits the user the use of the basic function and the user box function etc Several types of the following are supported in the method of the user authentication Machine authentication A method to authenticate on MFP by registering a user ID and a user password into HDD on MFP controller 2 External server authentication A method to authenticate with processing the authentication on MFP by using the user ID Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 12 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target and the user password that are registered on the user information management server which is connected by the intra office LAN without managing the user ID and user password on the MFP side Though two or more methods named Active Directory NTLM and NDS are supported the method of the external server authentication assumed in this ST is applied only the case
33. domain name Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 81 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target For FTP transmission by being likely to use the mechanism of the search of the domain name is concerned about the similar possibility of the incident might be occurred by E mailing Furthermore when the network setting which is related to the address of MFP is modified illegally it assumes the possibility to use the print function to the unauthorized entity from PC by the user who believes as TOE Especially it becomes a problem if a secure print file which is required to be concealed from other users in the office is transmitted to the unauthorized entity On the other hand O CONFIG regulates that the role to operate the network setting relating to the transmission of TOE is limited to the administrator and so the possibility of this threat is removed OE FEED BACK regulates that the feedback protected is returned for the entered password by the administrator s authentication and OE N SESSION requires to logoff after the operation ends so that O CONFIG is supported sufficiently Accordingly this threat is countered sufficiently e T ACCESS SETTING Unauthorized change of function setting condition related to security This threat assumes the possibility of developing consequentially into the leakage of the user box file and the secure print file
34. file is transmitted the E mail transmission or the FTP transmission to the entity which a user does not intend to so that a user box file is exposed lt The network setting which is related to user box file transmission gt gt Setting related to the SMTP server gt Setting related to the DNS server e Malicious person or user changes the network setting which set in MFP to identify MFP itself where TOE installed by setting to the value of the entity such as another illegal MFP from the value of MFP NetBIOS name AppleTalk printer name IP address etc that TOE is originally installed so that secure print file is exposed 3Abbreviation of Server Message Block Protocol to realize the file sharing or printer sharing on Windows Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 20 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target T ACCESS SETTING An unauthorized change of a function setting condition related to security The possibility of leaking user box file and secure print file rises because malicious person or user changes the settings related to the enhanced security function T BACKUP RESTORE Unauthorized use of Backup function and restoration function The user box file and the secure print file can leak by malicious person or user using the backup function and the restoration function illegally Also highly confidential data such as password can b
35. for each character as feedback for the entered encryption gt Return in verification passphrase gt Verify the encryption passphrase newly set if the following qualities are satisfied It is composed of the characters and by the number of digits shown in Table 8 It shall not be composed of one kind of character It shall not be matched with the current value Function related to Enhanced Security function The function that influences the setting of the Enhanced Security function that the administrator operates is as follows It has explained the influence of the backup and Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 62 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target restoration function in 4 gt Operation setting of Enhanced Security function Function to set valid or invalid of Enhanced Security function gt HDD logical format function Function to re write system file of OS in HDD Along with the execution of this logical format the setting of the Enhanced Security function is invalidated gt Overwrite deletion function for all area The settings of enhanced security function are invalidated by executing the overwrite deletion of all area Change of SNMP password The SNMP password Privacy password and Authentication password is changed Verify that the SNMP password newly set satisfies the following qualities gt It is compo
36. function level 5 1 3 TOE Security Assurance Requirements The TOE is a commercial office product that is used in a general office environment and therefore a TOE security assurance requirement that is required for EAL3 conformance which is a sufficient level as an assurance for commercial office products is applied The following table summarizes the applied TOE security assurance requirements TSF data remaining in the HDD data area that cannot be deleted only by the deletion of the file management area Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 53 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target Table 6 TOE Security Assurance Requirements TOE Security Assurance Requirements Class ACM CM capabilities ACM_CAP 3 Configuration management ACM_SCP 1 Class ADO ADO DEL 1 Delivery and Operation Installation generation and start up ADO_IGS 1 ADV_FSP 1 Class ADV 3 High level design ADV_HLD 2 Development ADV_RCR 1 Class AGD Administrator guidance AGD_ADM 1 Guidance Documents AGD_USR 1 Class ALC Development security ALC_DVS 1 Life Cycle Support ATE_COV 2 Class ATE ATE_DPT 1 Tests ATE_FUN 1 ATE_IND 2 AVA_MSU 1 Class AVA at Strength of TOE security functions AVA_SOF 1 Vulnerability Assessment Vulnerability analysis AVA_VLA 1 5 2 Security Requirements for the IT environment 5 2 1 Cryptographic support FCS_COP 1
37. function with external server when user authentication method is external server authentication e Registration function of secure print password according to secure print file registration by user e Modification function of user attribute of user box by user who is permitted the use of public user box Modification function of user box password of the user box by user who is permitted the use of public user box Modification function of the concerned user box s user attribute by user who is permitted the use of the group box Hierarchical to No other components Dependencies No dependencies FMT_SMR 1 1 Security roles Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 49 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target FMT_SMR 1 1 1 The TSF shall maintain the roles lassignment the authorized identified roles lassignment the authorized identified roles Service Engineer FMT_SMR 1 2 1 The TSF shall be able to associate users with roles Hierarchical to No other components Dependencies FIA _UID 1 FIA_UID 2 1 FMT_SMR 1 2 Security roles FMT_SMR 1 1 2 The TSF shall maintain the roles assignment the authorized identified roles lassignment the authorized identified roles Administrator FMT_SMR 1 212 The TSF shall be able to associate users with roles Hierarchical
38. gt It shall not be composed of one kind of character gt It shall not be matched with the current value Function that relates to Enhanced Security function The functions that influence the setting of the Enhanced Security function that the service engineer operates are as follows gt HDD logical format function Function to re write system file of OS in HDD The setting of the Enhanced Security function is invalidated along with the execution of this logical format gt HDD physical format function A function to rewrite the entire disk in HDD with a regulated pattern including the signal rows such as the track and sector information The setting of the Enhanced Security function is invalidated along with the execution of this physical format gt HDD installation setting function Function to make the installed HDD effective The setting of the Enhanced Security function is invalidated by nullifying this HDD installation setting gt Initialization function Function to reset every setting value written in NVRAM to the factory default The setting of the Enhanced Security function is invalidated by executing this initialization function Function that relates to password initialization function The function that relates to the initialization of the password that the service engineer operates is as follows gt Initialization function Function to reset various setting values written in NVRAM to the factory default The administrator
39. leaser returned or the discarded MFP were collected secure print file a user box file on memory image file the stored image file the remaining image file the image related file the transmission address data file and the set various passwords can leak by the person with malicious intent taking out and analyzing an HDD in MFP T BRING OUT STORAGE An unauthorized carrying out of HDD A secure print file a user box file aon memory image file a stored image file a remaining image file an image related file a transmission address data file and the set up various Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 19 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target passwords can leak by a person or a user with malicious intent illegally taking out and analyzing an HDD in MFP A person or a user with malicious intent illegally replaces an HDD in MFP In the replaced HDD new files of the secure print file a user box file on memory image file a stored image file a remaining image file an image related file a transmission address data file and set various passwords are accumulated A person or a user with malicious intent takes out and analyzes the replaced HDD and image files leak T ACCESS PRIVATE BOX Unauthorized access to the personal user box which used a user function Exposure of the user box file when a person or a user with malicious intent ac
40. lock password and the encryption passphrase is composed of ASCII code 0x21 0x7E except 0x22 0x28 0x29 0x2C 0x3A 0x3B 0x3C 0x3E 0x5B 0x5C 0x5D in total of 83 characters by 20 digits is not composed of one kind of characters and does not correspond to the value currently set Accordingly this functional requirement is satisfied e FIA _SOS 1 5 FIA_SOS 1 5 regulates the quality of the secure print password F ADMIN verifies that the quality of the secure print password and the user box password is composed of ASCII code 0x21 0x7E except 0x22 and 0x2B in total of 93 characters by eight digits and is not composed of one kind of characters Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 116 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target F BOX verifies that the quality of the secure print password and the user box password is composed of ASCII code 0x21 0x7E except 0x22 and 0x2B in total of 93 characters by eight digits and is not composed of one kind of characters F PRINT verifies that the quality of the secure print password and the user box password is composed of ASCII code 0x21 0x7E except 0x22 and 0x2B in total 93 characters by eight digits and is not composed of one kind of characters Accordingly this functional requirement is satisfied e FIA_SOS 116 FIA_SOS 1 6 regulates the quality of the session information F ADMIN verifies th
41. password and the SNMP password are set to an initial value of the factory Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 66 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target shipment by executing this initialization function Both of the operation settings of the HDD lock function and the encryption function are turned OFF The HDD lock password and the encryption passphrase have been set cannot be used again by turning OFF the setting operation gt HDD physical format function A function to rewrite the entire disk to a regulated pattern in HDD including the signal rows such as the track and sector information The HDD lock function is turned OFF along with the execution of this physical format The HDD lock password that is set cannot be used again by turning OFF the operation setting Release of the lock of administrator authentication function Reset 0 clear the number of authentication failure for the administrator authentication gt If access is locked the lock is released Setting of CE Authentication Lock Time Set the CE Authentication Lock Time between 1 60 minutes 6 1 4 FUSER User Function F USER identifies and authenticates the user for the use of MFP various function To the identified and authenticated user it offers the management function of the user password that is managed in the MFP at the time of machine authentication
42. regulates the regulation of the relationship between the subject controlled to the HDD lock password object the encryption passphrase object the SMTP server group object the DNS server group object and the MFP address group object that are the object and the operation F ADMIN performs the setting management access control to which the following rules are applied gt It permits the administrator the setting the back up and the restoration of the HDD lock password object and the encryption passphrase object gt It permits the administrator the setting and the restoration operations of the SMTP server group object the DNS server group object and the MFP address group object F ADMIN SNMP performs the secure print file access control to which the following rules are applied gt It permits the administrator the setting operation of the SMTP server group object the DNS server group object and the MFP address group object F SERVICE performs the setting management access control to which the following rules are applied gt It permits the service engineer the setting operation of the HDD lock password object and the encryption passphrase object initialization operation Accordingly this functional requirement is satisfied e FIA AFL 1 1 FIA_AFL 1 1 regulates the action for the authentication failure to the service engineer authentication In the service engineer authentication for accessing the service mode or changing the
43. security function requirements required for the TOE and IT environment are described Those regulated in CC Part 2 will be directly used for the functional requirements components and the same labels will be used as well The new additional requirement which is not described in CC part 2 is newly established and identified with the label that doesn t compete with CC part 2 In addition E is added at the end of a label of a requirement needed in IT environment in order to state it clearly whether an object of each requirement is TOE or IT environment lt Method of specifying security function requirement Operation gt In the following description when items are indicated in italic and bold it means that they are assigned or selected When items are indicated in italic and bold with parenthesis right after the underlined original sentences it means that the underlined sentences are refined A number in the parentheses after a label means that the functional requirement is used repeatedly The number to indicate the repetition is added with separating respectively by TOE requirement and IT environmental requirement lt Method of clear indication of dependency gt The label in the parentheses in the dependent section indicates a label for the security functional requirements used in this ST When it is a dependency that is not required to be used in this ST it is described as N A in th
44. selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values assignment positive integer number 5 FIA_AFL 1 2 E When the defined number of unsuccessful authentication attempts has been met or surpassed the TSF shall assignment list of actions lassignment list of actions lt Action when it is detected gt Deny the reading and writing of data to HDD lt Operation for recovering the normal condition gt Turn off electricity to HDD Power OFF Hierarchical to No other components Dependencies FIA_UAU 1 FIA_UAU 2 El FIA_UAU 2 E User authentication before any action FIA_UAU 2 1 E The TSF HDD shall require each user The main body of MFP where HDD installed to be successfully authenticated before allowing any other TSF mediated actions on behalf of that user The main body of MFP where HDD installed Hierarchical to FIA_UAU 1 Dependencies FIA_UID 1 N A FIA_UAU 7 E Protected authentication feedback FIA_UAU 7 1 E The TSF PC application shall provide only assignment list of feedback to the user while the authentication is in progress lassignment list of feedback display in every character data input Hierarchical to Dependencies No other components FIA_UAU 1 FIA_UAU 2 2 FIA_UAU 2 3 FIA UAU 21 5 Copyright 2007 KONICA MINOLTA B
45. service code when the authentication failure of failure frequency threshold 1 3 Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 113 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target times that the administrator set is detected FSERVICE logs off from the service mode authentication status and locks the authentication function F RESET clears the failure frequency and releases the lock status after the secret lock release function is executed and CE authentication lock time passes by the reboot of TOE with the power supply turned OFF and ON Accordingly this functional requirement is satisfied e FIA_AFL 1 2 FIA_AFL 1 2 regulates the action of the authentication failure to the administrator authentication In the administrator authentication for accessing the administrator mode or changing the administrator password when the authentication failure of failure frequency threshold 1 3 times that the administrator set is detected FADMIN logs off from the authentication status to the administrator mode and locks the authentication function F RESET clears the failure frequency and releases the lock status after the administrator authentication lock time passes by the reboot of TOE with the power supply turned OFF and ON Moreover F SERVICE clears the authentication failure frequency and releases the lock status by the lock release function that is available in
46. set and restore SMTP server group object DNS server group object and MFP address group object F ADMIN SNMP performs the setting management access control for the task of substituting the user to set SMTP server group object DNS server group object and MFP address group object F SERVICE performs the setting management access control for the task of substituting the user to set HDD lock password object and encryption passphrase object Accordingly this functional requirement is satisfied e FDP_ACF 1 1 FDP_ACF 1 1 regulates the regulation of relationship between the subject controlled to the user box and the user box file which are an object and the operation F ADMIN performs the user box access control to which the following rules are applied gt It permits the administrator the list display operation of the user box on the occasion of the user box setting gt It permits the administrator the back up operation of the user box file F BOX performs the user box access control to which the following rules are applied gt It permits the user the list display of the user box personal user box that has a corresponding object attribute to user ID gt It permits the user the operation of the user box file in the selected personal user box such as the print the transmission the download the movement and the copy gt It permits the user the list display operation of the user box public user box that sharing Copyright O 2007
47. setting function of Trusted Channel function setting data by administrator Registration function of Belonging Account of user by administrator Modification function of Belonging Account of user by administrator Modification function of Administrator authentication lock time by administrator Modification function of service engineer password by service engineer Modification function of administrator password by service engineer Stop function of Enhanced Security function by service engineer Initialization function of administrator password by service engineer Initialization function of SNMP password by service engineer Deletion function of detected value of unauthorized access to administrator by service engineer Modification function of CE authentication lock time by service engineer Overwrite function for the default value of the user attribute of the user box by the user e Modification function of user password when method of user authentication is machine authentication by user Registration function of user box password by user e Modification function of user attribute of user box by user Registration function of Belonging Account of user oneself by user who is permitted the use of the account User box registration function by user Automatic Personal user box registration function by user box stored job that specifies unregistered box by user Machine non registered users user ID automatic registration
48. that be connected to MFP controller with Video bus e FAX Unit Option parts A device that is used for the communication for sending and receiving FAX and for the remote diagnosis function described later via public line According to the circumstances in sales it is sold as the option part and is not attached on the MFP O Scan Unit An automatic manuscript feeder The device that scans images and photos from a paper and converts them into the digital data O Printer Unit The device that actually prints the converted image data for printing when demanded to print by the MFP controller e RS 232C The serial can be connected through the D sub9 pin When breaking down the maintenance function can be used through this In addition it can utilize a remote diagnostic function later description to connect with the modem connected with the public circuit 2 4 Role of the TOE User The roles of the personnel that relate to the use of the MFP with the TOE are defined as follows eo User Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 10 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target MFP s user who is registered into MFP In general the employee in the office is assumed Administrator MFP s user who carries out the management of the operation of MFP An administrator performs the operation management of MFP and the management of user In ge
49. the change of the user attribute of the user box where the user ID of the user concerned is set Accordingly this functional requirement is satisfied e FMT_MSA 1 2 FMT_MSA 1 2 regulates the management of the user attribute of user box When public is set F ADMIN permits the administrator the back up and restoration operation so that it is possible to change the back up data which is acquired by the back up operation and to change the user attribute of the user box as a result of restoration F BOX permits the change of the user attribute of the user box where the public is set to the authenticated user who is permitted the use of the public user box Accordingly this functional requirement is satisfied e FMT _MSA 1 3 FMT_MSA 1 3 regulates the management of the user attribute of the user box When the account ID is set F ADMIN permits the change operation of the user attribute that is set to the user box in the administrator mode Also FADMIN permits the administrator the back up and restoration operation so that it is possible to change the back up data which is acquired by the back up operation and to change the user attribute of the user box as a result of restoration In addition when a user concerned owns a group user box by the deletion operation of registered user the user box is changed to the public user box F BOX performs the authenticated user to change the user attribute of the group user box that is set the account ID o
50. the user box password meets the following requirements It is composed of the characters and by the number of digits shown in Table 8 It shall not be composed of one kind of character gt If account ID is specified it becomes a group user box that can be accessed by a user who is permitted the use of the concerned account 6 1 5 2 Public User Box Function When the user is identified and authenticated as a registered user the task to act for the user who is identified and authenticated has User ID of the identified and authenticated user as the user attribute This task is permitted the display of the list of the public user box which is set the public as the user attribute The operation specification of each public user box is as follows O Authentication function in access to a public user box For the access request for each public user box after the above mentioned verification function is operated the user who accesses is authenticated that it is a user permitted the use of a user box concerned respectively gt Offers the user box authentication mechanism that is authenticated by the user box password that consists of the character shown in Table 8 After the user box is authenticated to the access from the network it offers the user box authentication mechanism using the session information besides the user box password gt According to protocol it utilizes the 101 session information or more or generated and uses the 101 se
51. to No other components Dependencies FIA UID 1 FIA_UID 2 2 FMT_SMR 1 3 Security roles FMT_SMR 1 1 3 The TSF shall maintain the roles lassignment the authorized identified roles lassignment the authorized identified roles User FMT_SMR 1 2 3 The TSF shall be able to associate users with roles Hierarchical to No other components Dependencies FIA UID 1 FIA_UID 2 3 FMT_SMR 1 4 Security roles FMT_SMR 1 1 4 The TSF shall maintain the roles assignment the authorized identified roles lassignment the authorized identified roles User who is authorized to use that public user box FMT_SMR 1 2 4 The TSF shall be able to associate users with roles Hierarchical to No other components Dependencies FIA_UID 1 FIA_UID 2 5 FMT_SMR 1 5 Security roles FMT_SMR 1 1 5 The TSF shall maintain the roles lassignment the authorized identified roles lassignment the authorized identified roles External server FMT_SMR 1 2 5 The TSF shall be able to associate users with roles Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 50 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target Hierarchical to No other components Dependencies FIA_UID 1 FIA_UID 2 71 FMT_SMR 1 6 Security roles FMT_SMR 1 1 6
52. to SMTP server IP address port number etc gt Setting data that relates to DNS server IP address port number etc gt Aseries of setting data that relates to MFP address IP address NetBIOS name AppleTalk printer name etc Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 64 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target Change of SNMP password The SNMP password Privacy password and Authentication password is changed Verify that the SNMP password newly set satisfies the following qualities gt It is composed of the characters and by the number of digits shown in Table 8 Setting of SNMP password authentication function The authentication method in the SNMP password authentication function is set to the Authentication password only or the Privacy password and the Authentication password 6 1 3 FSERVICE Service mode function F SERVICE is a series of security function that the service engineer operates such as the service engineer identification authentication function in service mode accessing from a panel and a security management function that includes a change in the CE password and the administrator password 6 1 3 1 Service engineer identification authentication function It is identified and authenticated the accessing user as the service engineer in response to the access request to the service mode from the panel
53. which is generated and used lt Management of a public user box gt FMT_MSA 1 2 permits the user who is permitted the use of the user box to operate the change of the user attribute of use box which Public is set FMT_MTD 1 4 permits the change in the user box password only to the administrator and the user who is permitted to the use of the user box FIA_SOS 1 7 verifies the quality of the user box password As for the user box registration FMT_MSA 3 specifies the public to the user attribute of the user box and permits only the user to be given the initial value to change it Moreover when the job that stores an unregistered user box in the box where is specified by this requirement is executed the user ID of the user who executed a job concerned is automatically specified FMT_MTD 1 5 permits the registration of the user box password only to the user or the administrator lt Necessary requirement to keep the administrator secure gt gt refer to set admin lt Necessary requirement to keep the service engineer secure gt gt refer to set service lt Role and controlling function for each management gt As the role of doing these managements FMT_SMR 1 2 maintains an administrator and FMT_SMR 1 4 maintains a user permitted the use of the user box FMT_SMF 1 specifies these management functions Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 88 131 bizhub C550 bizhub C45
54. 1 ineo 550 ineo 451 Control Software Security Target This security objective is satisfied by the completion of these multiple functional requirements e O GROUP BOX Group user box access control This security objective permits the browser of the group box only to the user who is permitted the use of the account and limits the operation of the user function of the box file in the group user box set of the group box only to the user who is permitted the use of the group user box and requires various requirements that relate to the access control lt User box access control a group user box gt FDP_ACC 1 1 and FDP_ACF 1 1 permits a task to act for the user to operate the list to the user box group user box where the user attribute corresponded with the Account Name account ID in the security attribute of the subject is set It is required to be a user who is permitted the use of the group user box to operate the user box file in the group user box When the Account authentication method is the method not synchronized FIA_UID 2 6 and FIA_UAU 2 6 identifies and authenticates that it is a user who is permitted the use of the group user box When the account authentication method is synchronized method and the Account that user belongs to is not registered FIA_UID 2 6 and FIA_UAU 2I 6 identifies and authenticates that it is a user who is permitted the use of the account FIA_UAU 7 returns for e
55. 1 Necessity The correspondence between the assumptions threats and security objectives are shown in the following table It shows that the security objectives correspond to at least one assumption or threat Table 11 Conformity of Security Objectives to assumptions and Threats Assumption Treat NINGV V ASIAYAS V ONILLAS V ADVYOLS LNO ONIYE L XOd SLVAlYd SSAD9V L XOd ONENd SSADOV L XOd dNOYD SSA0OV L ONILLAS LAN SSA99OV L ONILLAS SSADOV L AYOLSSY dNMOVE L 1349IS V Security objectives OE N SETTING SECURITY PT jel tt dAW GHVOSIC L SY INN 5 ET zA Zal aA BA a al Bs a E E a etl O pa E C El ed pa ALIT tel AINSI del 11 1ef leje Jej wvanouvonnnooa 11 e T SIN Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 78 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target 8 1 2 Sufficiency of Assumptions The security objectives for the assumptions are described as follows A ADMIN Personnel Conditions to be an Administrator This condition assumes that administrators are not malicious With OE N ADMIN the organization that uses the MFP assigns personnel who are reliable in the organization that uses the MFP so the reliability of the administrator is realized e A SERVICE Personnel Conditions to be a Service Engineer This condition assumes the service engineer are not malicious Wi
56. 1 Control Software Security Target Accordingly this functional requirement is satisfied e FDP ACC 1 1 FDP_ACC 1 1 regulates the relationship between the subject controlled to the user box and the user box file which are the object and the operation F ADMIN performs the user box access control for the task of acting for the user to display the list of user box and back up the user box file F BOX performs the user box access control for the task of acting for the user to display the user box s list and to print transmit download move or copy the user box file Accordingly this functional requirement is satisfied e FDP_ACC 1 2 FDP_ACC 1 2 regulates the relationship between the subject controlled to the secure print file that is the object and the operation F ADMIN performs the secure print file access control for the task of substituting the user to back up the secure print file F PRINT performs the secure print file control for the task of substituting the user to display and print the list of secure print file Accordingly this functional requirement is satisfied e FDP_ACC 1 3 FDP_ACC 1 3 regulates the relationship between the subjects controlled to the HDD lock password object Encryption passphrase object SMTP server group object DNS server group object and MFP address group object which are the object and the operation F ADMIN performs the setting management access control for the task of substituting the user to
57. 50 bizhub C451 ineo 550 ineo 451 Control Software Security Target Dependencies FMT_SMF 1 FMT_SMF1 FMT_SMR 1 FMT_SMR 1 3 FMT_MTD 1 9 Management of TSF data FMT_MTD 1 1 9 The TSF shall restrict the ability to selection change_default query modify delete clear lassignment other operations the lassignment list of TSF data to lassignment the authorized identified roles lassignment ist of TSF datal CE password CE authentication lock time selection change_default query modify delete clear lassignment other operations modity lassignment the authorized identified roles Service Engineer Hierarchical to No other components Dependencies FMT _SMF1 FMT_SMF1 FMT_SMR 1 FMT_SMR 1 1 FMT_MTD 1 10 Management of TSF data FMT_MTD 1 1 10 The TSF shall restrict the ability to selection change_default query modify delete clear lassignment other operations the lassignment list of TSF data to lassignment the authorized identified roles lassignment list of TSF datal User ID selection change default query modify delete clear lassignment other operations assignment other operations Registration lassignment the authorized identified roles Administrator External server Hierarchical to No other components Dependencies FMT_SMF1 FMT_SMF1 FMT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 5 FMT_MTD 1
58. 50 ineo 451 Control Software Security Target 8 2 1 3 Necessity of specified IT security function requirement In this ST FNEW_RIP 1 and FIA_NEW 1 is stated as an extended requirement The necessity that presents these requirements and the validity of the assurance requirement applied in guaranteeing requirements is described as follows e Extended requirement Necessity of FNEW_RIP 1 Regarding FNEW_RIP 1 FDP_RIP 1 is the closest requirement in the viewpoint of remaining information protection but the requirement needs to regulate the protection of not only user data but also the TSF data And so it is improper in the function requirement concerned that exists in the class of the user data protection and it requires the extended requirement lt Validity of requirement identification structure gt Because this requirement doesn t have the corresponding class in the data protection class of integration of no division of the TSF data and the user data a new class named FNEW was set up the same family name as the RIP family of the FDP class that indicates the remaining information protection and clarifies the identification Though the predicted management activity is assumed not to be existed as for the timing of information assuming not to be able to recycle in the requirement is stipulated concretely especially the parameter treated as changeability are not guessed in this requirement In addition it is shown that the exe
59. 550 C451 User s Guide Security Operations ineot 550 451 ADV_FSP 1 Class ADV High level design ADV_HLD 2 Security high level design specifications Development Representation ADV_RCR 1 Representation correspondence analysis report correspondence Service ManuallSecurity Function bizhub C550 C451 Service ManuallSecurity Function Administrator guidance AGD_ADM 1 bizhub C550 C451 Class AGD ineot 550 451 User s Gide Security operations Guidance Document bizhub C550 C451 User s Guide Security operations User Guidance AGD_USR 1 bizhub C550 C451 User s Guide Security operations ineot 550 451 Class ALC Das Development security ALC_DVS 1 Development security instructions Life Cycle Support Class ATE Test X no specific document e Misuse AVA_MSU 1 Class AVA Reflected in the guidance documents Vulnerability Strength of TOE security i AVA_SOF 1 ay f Assessment functions Vulnerability analysis report Vulnerability analysis AVA_VLA 1 Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 76 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target 7 PP Claims There is no conformance to a PP in this ST Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 77 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target 8 Rational 8 1 Security Objectives Rationale 8 1
60. 8 8 1 Security Objectives RatioNale oooononcccnnnncccncnnonocccnnnnonccnnnnnnncnnnnnnnnnnnnnn cnn nn carne narran nn nr nan rennannnn 78 A A eet Pala oi a te eee ev ae bie ee ede A ae 78 8 1 2 Sufficiency OF ASSUMPLIONS iii o ii did Neeley 79 8 1 3 Sufliciency Of Threats t 8 eis set a ale ee ei eee ead 80 8 1 4 Sufficiency of Organizational Security POLICIOS ooonmoccinninnnninnnnnnnncnoncnnnccncccrnr crac 82 8 2 IT Security Requirements Rationale ooononcccnnnnccccnnnocccncnoncnncnnonnnncnnnnnnnnnnnnnnncnncn nana cnn rare ncnnnnnnnn 83 8 2 1 Rationale for IT Security Functional Requirements ooococicccnnccinncccnnccnonacnncncnann canon 83 8 2 2 Rational for Minimum Strength Of Function ooonoccinicinnnnninccnnnccnncccn cnn narran 108 8 2 3 Rationale for IT Security Assurance Requirements ocoococccconicnncccnonicnnnncnonccnancn nono nnannn nana na rca ran nnrannnnn rca 108 8 2 4 Consistency rationale for the set of IT security functional requirement ocoocnccoconicinacononcnnnancnoncncnrcnnannncnncnono 108 8 3 Rational for TOE Summary Specificati0NS oooooococnnnnocccnnnconcccnncancnconannnncnnnrnn con nnnnr nn nn nnannncnnnnnne 109 8 3 1 Rational for the TOE Security Functions oooooonicccnnninnnncnnnccnnccnconcncnccnc narco mcn 109 8 3 2 Rational for TOE Security Strength Of FUNCHON ooooconnicininnnnnncnnnccncccancccnccncnnn cnc 130 8 3 3 Mutually Supported TOE Security Functions ooonicccconicinnccnnncononcnn
61. AU 2 2 lt Management of SNMP password gt The modification operation of the SNMP password is permitted to the administrator by FMT_MTD 1 3 The inquiry operation is permitted to the administrator by FMT_MTD 117 and the initialization operation is permitted only to the administrator and the service engineer by FMT_MTD 1 11 This supports the prevention of unauthorized interference and destruction of FIA_UAU 2 2 lt Management of user password gt The registration of the user password is permitted to the administrator by FMT_MTD 1 1 The modification operation is permitted to the administrator and the user by FMT_MTD 1 2 and the inquiry operation is permitted only to the administrator by FMT_MTD 1 7 This supports the prevention of unauthorized interference and destruction of FIA_UAU 2 3 lt Management of account password gt The registration of the account password is permitted to the administrator by FMT_MTD 1 12 The modification operation is permitted to the administrator by FMT_MTD 1 3 and the inquiry operation is permitted only to the administrator by FMT_MTD 1 7 This supports the prevention of unauthorized interference and destruction of FIA_UAU 2I 6 lt Management of secure print password gt The registration of the secure print password is permitted only to the user by FMT_MTD 1 8 and the inquiry operation is permitted only to the administrator by FMT_MTD 1 7 The modification is permitted only to the adm
62. DD This security objective regulates that it refuses the unauthorized access from MFP other than the one that is set by the HDD which is the entity of a necessary IT environment for the TOE security maintenance and needs various requirements that verify that it is right MFP where TOE is installed By FIA_UAU 2 El HDD authenticates that the entity accessing to HDD is MFP which HDD is installed When the failure authentication reaches five times FIA_AFL 1 E refuses all the accesses to HDD concerning reading and writing data Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 94 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target This security objective is satisfied by the combination of these multiple functional requirements e OE FEED BACK Feedback of password This security objective regulates that the application used by client PC for accessing to MFP that is the entity of a necessary IT environment for the TOE security maintenance offers the appropriate protected feedback for the entered user password the entered user box password the entered administrator password and the entered account password By FIA_UAU 7 El the application displays for each character as feedback for entered character data This security objective is satisfied by the completion of this function requirement The following is the compilation of set such as the set of necessa
63. E Assurance Requirements and assurance measures 75 Table 11 Conformity of Security Objectives to assumptions and Threats cccccccceeeereeeeeeeeees 78 Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 4 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target Table 12 Conformity of IT Security Functional Requirements to Security Objectives 83 Table 13 Dependencies of IT Security Functional Requirements Component scceeeeeee 98 Table 14 Mutual Support Correlations of IT Security Functional Requirements o oooccccnnnccccnncn 102 Table 15 Conformity of TOE Security Functions to TOE Security Functional Requirements 109 Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 5 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target 1 ST Introduction 1 1 ST Identification ST Title ST Version e CC Version e Created on Created by 1 2 TOE Identification TOE Name TOE Version TOE Type Created by bizhub C550 bizhub C451 ineo 550 ineot 451 Control Software Security Target 1 05 2 3 August 24 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC Eiichi Yoshida Japanese bizhub C550 bizhub C451 ineot 550 ineot 451 Zentai Seigyo Software English bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software
64. E security functions and the TOE security functional requirements are shown in the following table It shows that the TOE security functions correspond to at least one TOE security functional requirement Table 15 Conformity of TOE Security Functions to TOE Security Functional Requirements TOE Security Function NINGV A ASIAYAS A d3sN 3 xod4 1NIdd 3 dIANS NINOV SSvd 031SNY1 3 TIW ALIYMYSAO A TOE Security Functional Requirement Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 109 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target TOE Security Function TOE Security Functional Requirement FIA_SOS 1 7 FIA_UAU 2 6 FIA_UAU 6 FIA_UAU 7 Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 110 131 FMT_MSA 3 2 ee o A AAA AE ete e leed elle ef sa AN trates SEE ee SEE os SEE asas SEED sasn A ass bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target TOE Security Function TOE Security Functional Requirement FMT_MTD 1 9 FMT_MTD 1 10 FMT_MTD 1 11 FMT_MTD 1 12 FMT_MTD 1 13 FMT_SMF 1 FMT_SMR 1 1 FMT_SMR 1 2 FMT_SMR 1 3 FMT_SMR 1 4 FMT_SMR 1 5 FMT_SMR 1 6 FPT_RVM 1 FPT_SEP 1 FTA_SSL 3 FTP_ITC 1 FNEW_RIP 1 FIA_NEW 1 o Z Zz o EA EA A
65. ET works or the lock release function of the administrator authentication function in F SERVICE is carried out so that the lock of the authentication function is released Verify the new administrator password if the following qualities are satisfied e Itis composed of the characters and by the number of digits shown in the Table 8 e It shall not be composed of one kind of character e It doesn t match with the current value User Settings gt User Registration Only the user who uses with the machine authentication as User authentication method User is registered by setting the user ID Though user ID is composed of the user name and the authentication server information only user name is registered in case of the machine authentication and registering the user password It verifies whether the user password newly set have been satisfied the following qualities It is composed of the characters and by the number of digits shown in the Table 6 It shall not be composed of one kind of character While the external server authentication is effective the user password cannot be registered Also register the belonging account account ID and relate The account setting is necessary beforehand Change of user password Only the user who uses with the machine authentication as User authentication method User password is changed It verifies whether the user password newly set have been satisfied the following qualities
66. FCS_CKM 4 The satisfied events The encryption key for FMT_MSA 2 enciphering the attached file by the S MIME communication is generated lt The reason not to satisfy a part of the FCS_CKM 1 or FDP_ITC 1 gt It seems proper to use FDP_ITC 1 because the public key to encrypt the encryption key for the data encryption of S MIME is imported outside of TSC but S MIME certificate is registered by the administrator s operation In that case it is unnecessary to consider whether it passes thorough the untrusted channel or not There is not inevitability to apply the security requirement The use under the condition that ANETWORK is realized Also the attribute information of imported encryption key doesn t apply to the security attribute used for the access control etc is not related to the initialization etc and the application is difficult In FMT_MTD 1 12 it is expressed as registration of TSF data and the object of import operation is assigned to an appropriate role As a result the event corresponding to the key management is explained by using not the security FCS_COP 1 requirement that is showed in the dependencies but other security requirement so that it s no problem even if this dependencies is not satisfied lt The reason not apply FCS_CKM 4 gt The Encryption Key is stored constantly for the stored data The arbitrary access to the storring media is difficult so it is not necessary to cancel the
67. IA_SOS 1 1 verifies the quality of the CE password FMT_MTD 1 9 restricts the change in the CE password to the service engineer Moreover FIA_UAU 6 re authenticates it In this re authentication when the failure authentication reaches 1 3 times FIA_AFL 1 1 releases the authentication status of the service engineer and locks all the authentication functions to use the CE password The secret lock release function is executed and the CE authentication lock time goes by so that this lock status is released lt Role and management function for each management gt FMT_SMR 1 1 maintains the role to do these management as a service engineer FMT_SMF 1 specifies these management functions FPT_RVM 1 and FPT_SEP 1 are the security function requirements immediately not related to the security measures policy though it not included in the explanation of the above mentioned sufficiency But they are shown to support the security function requirement which is included in the explanation of the above mentioned sufficiency in the mutual support described later Because these two security function requirements will relate to the security objective that corresponds to the security function requirement supported respectively by two security function requirements the relation with the security objective is consequentially clear Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 96 131 bizhub C550 bizhub C451 ineo 5
68. MT_MSA 1 FMT_MSA 1 1 FMT_MSA 1 2 FMT_SMR 1 FMT_SMR 1 3 FMT_MSA 3 2 Static attribute initialization FMT_MSA 3 1 2 The TSF shall enforce the lassignment access control SFP information flow control SFP to provide selection choose one of restrictive permissive lassignment other property default values for security attributes Secure print internal control ID that are used to enforce the SFP selection choose one of restrictive permissive lassignment other property assignment other property Identified uniquely lassignment access control SFP information flow control SFP Secure print file access control FMT_MSA 3 2 2 The TSF shall allow the lassignment the authorized identified roles to specify alternative initial values to override the default values when an object or information is created lassignment the authorized identified roles None Hierarchical to No other components Dependencies FMT_MSA 1 N A FMT_SMR 1 N A FMT_MTD 1 1 Management of TSF data FMT_MTD 1 1 1 When the machine authentication is selected as the User authentication method The TSF shall restrict the ability to selection change default query modify delete clear assignment other operations the lassignment list of TSF data to lassignment the authorized identified roles lassignment list of TSF datal User password selection change_default query modif
69. MT_MTD 1 3 restricts the modification of the account ID and account password only to the administrator FMT_MTD 1 13 restricts the registration of the belonging account assigned to the user to the administrator and to the user who is permitted the use of the account FIA_SOS 1 7 verifies the quality of the account password lt Management of the account authentication method gt Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 89 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target FMT_MOF 1 3 restricts the behavior management of the account authentication function and the stop operation management to the administrator lt Necessary requirement to keep the administrator secure gt gt refer to set admin lt Necessary requirement to keep the service engineer secure gt gt refer to set service lt Role and controlling function for each management gt As the role of doing these managements FMT_SMR 1 2 maintains an administrator and FMT_SMR 1 6 maintains a user permitted the use of the group user box FMT_SMF1 specifies these management functions This security objective is satisfied by the completion of these multiple functional requirements O SECURE PRINT Secure print file access control This security objective limits the print of the secure print file only for the user who is permitted the use of the secure print file and requir
70. MT_SMR 1 2 maintains an administrator Moreover FMT_SMF 1 specifies these management functions This security objective is satisfied by the completion of these multiple functional requirements e O OVERWRITE ALL Complete over write deletion This security objective regulates that it deletes all data areas of HDD and initializes the concealed information of NVRAM that is set by the user and requires various requirements that relate to the deletion FNEW_RIP 1 guarantees that these objective information not to be able to use the content of any previous information by the deletion operation This security objective is satisfied by the completion of these multiple functional requirements e O CRYPT KEY Encryption key generation This security objective regulates that when the encryption board is installed the encryption key necessary to encrypt all the data written in HDD is generated and needs various requirements that relate to the encryption key generation Using KonicaMinolta HDD encryption key generation mechanism SHA 1 according to KonicaMinolta encryption specification standard FCS_CKM 1 generates the 128bit encryption key KonicaMinolta HDD encryption key generation algorithm is not the general standard algorithm that is recognized but it is the algorithm using SHA 1 specified with FIPS 180 1 and so this is the algorithm with sufficient strength which does not undermine the entropy of 128 bit and does not undermine the st
71. O Offers the CE authentication mechanism that is authenticated by the CE password that consists of the character shown in Table 8 gt The CE authentication mechanism by the separate session information is not required because the service mode can only be accessed from the panel O Return for each character as feedback for the entered CE password O Resets the number of the authentication failure when succeeding in the authentication e Not accept the input from the panel for five seconds when the authentication failed When the authentication failure that becomes 1 3 times at total in each authentication function by using the CE password is detected it locks all the authentication functions to use the CE password The access to the service mode is refused gt The administrator specifies the failure frequency threshold by the unauthorized access detection threshold setting function e Lock of authentication function is released with F RESET function operated 6 1 3 2 Function offered in service mode When a user is identified and authenticated as a service engineer by the service engineer identification authentication function at the access request to the service mode the use of the following functions is permitted O Change of CE password When a user is re authenticated as a service engineer and the new password satisfies the quality 1t is changed Copyright O 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights
72. Reserved 65 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target gt Offers the CE authentication mechanism that is re authenticated by the CE password that consists of the characters shown in Table 8 gt Resets the number of authentication failure when succeeding in the re authentication gt Return for each character as feedback for the entered service codes in the re authentication gt When the authentication failure that becomes 1 3 times at total in each authentication function by using the CE password is detected it logoffs the service mode accessing from the panel and locks all the authentication functions to use the CE password The access to the service mode is refused The administrator specifies the failure frequency threshold by the unauthorized access detection threshold setting function v The F RESET function operates to release the lock of the authentication function gt It verifies that the CE password newly set satisfies the following qualities It is composed of the characters and by the number of digits shown in the Table 8 It shall not be composed of one kind of character It shall not be matched with the current value Change of administrator password Change the administrator password Verify that the administrator password newly set satisfies the following qualities gt Itis composed of the characters and by the number of digits shown in the Table 8
73. S SECURE PRINT Unauthorized access to a secure print file This threat assumes the possibility that an unauthorized operation is done to the secure print O REGISTERED USER assumes that only the user to whom TOE was registered is permitted to use MFP installing TOE furthermore the operation of the secure print is limited only to the authorized user by O SECURE PRINT so that the possibility of the threat is removed OE FEED BACK regulates to return the protected feedback for the entered password in the user s authentication and access authentication to the secure print and OE N SESSION requires the log off operation after the operation ends so that O REGISTERED USER and O SECURE PRINT are supported sufficiently Accordingly this threat is countered sufficiently e T ACCESS NET SETTING Unauthorized change in network setting This threat assumes the possibility of sending the user box file to the address that isn t intended when the network setting that relates to the transmission is illegally changed This is concerned about a possibility that the user box file is transmitted to the specified server illegally without the change of the network environment constitution by the malicious person by for instance illegally being changed the address of the SMTP server that relays E mail for the E mail or illegally being changed the address of the DNS server where the domain name is inquired when the address of the SMTP server is used for a search of the
74. Service Engineer to be successfully authenticated before allowing any other TSF mediated actions on behalf of that user Service Engineer Hierarchical to E FIA_UAU 1 Dependencies FIA _UID 1 FIA_UID 2 1 FIA_UAU 2 2 User authentication before any action FIA_UAU 2 1 2 The TSF shall require each user Administrator to be successfully authenticated before allowing any other TSF mediated actions on behalf of that user Administrator Hierarchicalto FIA_UAU 1 Dependencies FIA_UID 1 FIA_UID 2 2 FIA_UAU 2 3 User authentication before any action FIA_UAU 2 1 3 The TSF shall require each user User to be successfully authenticated before allowing any other TSF mediated actions on behalf of that user User Hierarchical to FIA_UAU 1 Dependencies FIA_UID 1 FIA_UID 2I 3 FIA_UAU 2 4 User authentication before any action FIA_UAU 2 1 4 The TSF shall require each user User who is permitted to use secure print file to be successfully authenticated before allowing any other TSF mediated actions on behalf of that user User who is permitted to use secure print file Hierarchical to FIA_UAU 1 Dependencies A FIA_UID 1 FIA_UID 2 4 FIA_UAU 2 5 User authentication before any action FIA_UAU 2 1 5 Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 38 131 bizhub C550 bizhub C451 ineo 550 ine
75. Software Security Target FIA_USB 1 User subject binding FIA_USB 1 1 The TSF shall associate the following user security attributes with subjects acting on the behalf of that user lassignment list of user security attributes lassignment list of user security attributesl User box attiributes User Box ID File attributes Secure print internal control ID Account Name account ID FIA_USB 1 2 The TSF shall enforce the following rules on the initial association of user security attributes with subjects acting on the behalf of users assignment rules for the initial assocication of attributes lassignment rules for the initial assocication of attributes lt User box attribute gt the user box ID of the concerned user box associates to the task acting on the behalf of users when authenticated with the access to the user box lt Account Name gt In the method not synchronized with User authentication the account ID of the concerned account associates to the task acting on the behalf of users when authenticated with the access to the account In the method synchronized with User authentication the account ID that is set to the concerned user associates to the task acting on the behalf of users when authenticated with the access to the user lt File attribute gt The secure print internal control ID of the concerned secure print file associates to the task acting on the behalf of users when authenticated with the access to th
76. TSF data e UserID Account ID e Account password e SNMP password Secure print password e Panel auto log otf time Threshold Number of authentication failure External server authentication setting data S MIME certificate Transmission address data Trusted Channel function setting data Belonging Account of User e Administrator authentication lock time selection change_default query modify delete clear lassignment other operations modity lassignment the authorized identified roles Administrator Hierarchical to No other components Dependencies FMT_SMF 1 FMT_SMF1 FMT_SMR 1 FMT_SMR 1 2 FMT_MTD 1 4 Management of TSF data FMT_MTD 1 1 4 The TSF shall restrict the ability to selection change_default query modify delete clear assignment other operations the lassignment list of TSF data to assignment the authorized identified roles lassignment list of TSF data User box password of the relevant user box selection change_default query modify delete clear lassignment other operations modity lassignment the authorized identified roles e User who is permitted to use that public user box e Administrator Hierarchical to No other components Dependencies FMT_SMF1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 4 FMT_MTD 1 5 Management of TSF data FMT_MTD 1 1 5 The TSF shall restrict the abili
77. USINESS TECHNOLOGIES INC All Rights Reserved 55 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target 6 TOE Summary Specification 6 1 TOE Security Functions The list of the TOE security function led from the TOE security function requirement is shown in the following Tables7 The detailed specification is explained in the paragraphs described below Table 7 The list of the name and identifier of TOE Security function 6 RPRINT Secure print function SSS O 8 RCRYPT Encryption key generation function 9 RHDD 6 1 1 FADMIN Administrator Function F ADMIN is a series of security function that administrator operates such as an administrator identification authentication function in an administrator mode accessing from a panel or through a network and a security management function that includes a change of an administrator password and a lock cancellation of a locked user box Nevertheless all functions are not feasible functions through both a panel and a network 6 1 1 1 Administrator identification authentication function It identifies and authenticates the accessing user as the administrator in response to the access request to the administrator mode O Offers the administrator authentication mechanism authenticating by the administrator password that consists of the character shown in Table 8 gt Offers the administrator authentication mechanism using t
78. _MSA 3I 2 gives the value uniquely identified when the secure print file is registered lt Secure print password gt FMT_MTD 1 8 permits only to the user the registration of the secure print password used Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 90 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target for the authentication FIA_SOS 1 5 verifies the quality of the secure print password lt Necessary requirement to keep the administrator secure gt gt refer to set admin lt Necessary requirement to keep the service engineer secure gt gt refer to set service lt Role and controlling function for each management gt As the role of doing these managements FMT_SMR 1 2 maintains an administrator and FMT_SMR 1 3 maintains a user Moreover FMT_SMF1 specifies these management functions This security objective is satisfied by the completion of these multiple functional requirements O CONFIG Access limitation to an management function This security objective limits the setting related to the SMTP server the setting related to the DNS server the setting related to the Enhanced Security function the backup function and the restorations function to the administrator and needs various requirements to limit the access to a series of setting function and the management function lt Management of network setting gt When the a
79. ach entered character as feedback protected by the panel and supports the authentication In the case of the failure authentication from the panel FIA_AFL 1 8 refuses all input acceptances from the panel for 5 seconds in every failure When the authentication failure reaches 1 3 times FIA_AFL 1 7 locks the authentication function for that account from then on This lock status is released by the administrator s release operation FMT_MTD 1 3 permits only the administrator the setting of the threshold of the unauthorized access detection value that is the trial frequency of the failure authentication in the authentication of the user who is permitted the use of the group user box When FIA_ATD 1 and FIA_USB 1 relates to the user box ID under the task to act for user FDP_ACC 1 1 and FDP_ACF 1 1 permits the user box file that has a corresponding object attribute to the account ID and the user box ID of the subject attribute the operation such as print download transmissions movement and copy lt Necessary requirement to manage the group box gt FMT_MAS 1 3 permits the modification operation of the user attribute of the user box that is set account ID to the user who is permitted the access to the group user box lt Necessary requirement to manage the subject attribute related with the group user box gt FMT_MTD 1 12 restricts the registration of the account ID and account password only to the administrator Also F
80. administrator to change it promptly OE N SERVER Secure user information management server The person in charge in the organization who uses MFP manages the user information management server secure to the user information management server such as account management application of the patch done and execution of the access control appropriately made OE N SESSION Termination of session after operation The administrator has the user implement the following operation After the operation of the secure print file and the operation of user box and user box file end the logoff operation is performed The administrator executes the following operation After the operation of the various function in administrator mode ends the logoff operation is performed The service engineer executes the following operation After the operation of the various function in service mode ends the logoff operation is performed OE N SETTING SECURITY Operation setting of Enhanced Security function The administrator makes the setting of the enhanced security function effective for the operation of TOE Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 25 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target 5 IT Security Requirements In this chapter the TOE security requirements and IT environment security requirements are described lt Definition of Label gt The
81. as follows Administrator password authentication mechanism offered by FADMIN CE authentication mechanism offered by FSERVICE Secure print password authentication mechanism offered by F PRINT User box password authentication mechanism offered by F BOX SNMP authentication mechanism offered by FADMIN SNMP User authentication mechanism offered by HDD Lock password collation mechanism offered by FADMIN Encryption Passphrase collation mechanism offered by FADMIN Account Authentication mechanism offered by FUSER OROSO OS It used the password composed from O amp an 8 digits and 92 kinds of character an 8 digits and 93 kinds of character amp an 8 digits and 95 kinds of character O amp an 8 digits and 95 kinds of character and amp an 20 digits and 83 kinds of character Among these locks the authentication function by the continuous three times of authentication failure by operating the authentication operation prohibition function The O O and use the session information secretly in access via network The secrets use the value of 1010 or more that is generated by TOE Moreover it uses the session information with the value of 101 or more that is given externally Accordingly as claimed in Section 6 2 the strength of function of mechanisms adequately Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 130 131 bizhub C550 bizhub C451 ineo 550
82. at a space quality is more than 101 as the quality of session information F BOX verifies that a space quality is more than 101 as the quality of session information F USER verifies that a space quality is more than 101 as the quality of session information Accordingly this functional requirement is satisfied e FIA_SOS 1 7 FIA_SOS 1 7 regulates the quality of the account password and the user box password F ADMIN verifies that the quality of the user box password or the account password is composed of ASCII code 0x20 0x7E in total of 95 characters by eight digits And it verifies that the first 8 characters are not composed of one kind of characters F BOX verifies that the quality of the user box password is composed of ASCII code 0x20 0x7E in total of 95 characters by eight digits And it verifies that the first 8 characters are not composed of one kind of characters Accordingly this functional requirement is satisfied e FIA _SOS 2 FIA_SOS 2 regulates the generation of session information and its quality F ADMIN generates the secrets that are the space quality of 101 or more to session information in the administrator authentication F BOX generates the secrets that are the space quality of 101 or more to session information in the user box authentication F USER generates the secrets that are the space quality of 101 or more to session information in the user authentication Accordingly this functional requirement is satisfie
83. at these functional requirements show by the set of the assurance requirement of EAL3 and a special assurance requirement and the assurance requirement required at EAL4 or higher are not required 8 2 1 5 Dependencies of the IT Security Functional Requirements The dependencies of the IT security functional requirements components are shown in the Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 97 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target following table When a dependency regulated in CC Part 2 is not satisfied the reason is provided in the section for the dependencies Relation in this ST Table 13 Dependencies of IT Security Functional Requirements Components N A Not Applicable Functional Requirements Component for this ST Dependencies on CC Part 2 Dependencies Relation in this ST FCS_CKM 2 or FCS_COP 1 FCS_COP 1 FCS_COP 1 E FCS_CKM 4 FMT_MSA 2 lt The reason not to applyDFCS_CKM 4 Y FMT_MSA 2 gt The encryption key is regularly kept for the stored data Moreover an arbitrary access to the storage medium is difficult and there is no necessity of the encryption key cancellation 2 TOE does not have the security attribute to be managed for the encryption key and so it is not FCS_CKM 1 necessary to regulate a security attribute that is secure FCS_CKM 1 or FDP_ITC 1 FCS_CKM 1 only a part of the phenomenon
84. ates the authentication of the authorized user to use the public user box F BOX authenticates that the user is the authorized user to use the public user box by using the user box password that is set to each user box Accordingly this functional requirement is satisfied e FIA UAU 2 6 FIA_UAU 2 5 regulates the authentication of the account When the method of the account authentication is the method not synchronized F USER certifies the user who is permitted the use of the account with an account password that is set for each account Accordingly this functional requirement is satisfied e FIA_UAU 6 FIA_UAU 6 regulates the re authentication for the important operation such as changing a password F ADMIN re authenticates the administrator at the operation for the change of the administrator password Along with the change operation of the HDD lock password and encryption passphrase by collating the registered HDD lock password and registered encryption passphrase it re authenticates the administrator who has known each of confidential information F SERVICE re authenticates the service engineer at the operation of the change of the CE password Accordingly this functional requirement is satisfied e FIA UAU 7 FIA_UAU 7 regulates the return of as the feedback under the authentication F ADMIN returns for each character for entered administrator password from the panel in the authentication and re authentication of admini
85. ator password to the administrator and the service engineer lt Role and management function for each management gt FMT_SMR 1 1 have service engineer maintain the role to do these management and FMT_SMR 1 2 have the administrator do the same Additionally FMT_SMF 1 specifies these management functions gt set service Set of necessary requirement to keep service engineer secure lt Identification and Authentication of a service engineer gt FIA_UID 2 1 and FIA_UAU 2 1 identifies and authenticates that the accessing user is a service engineer FIA_UAU 7 returns every one character entered as the feedback protected in the panel and supports the authentication FIA_AFL 1 8 refuses all the input receipts from the panel for five seconds at each failure and when the failure authentication reaches 1 3 times FIA_AFL 1 1 logoffs it if it s under authentication and locks all the authentication functions to use the CE password The secret lock release function is executed and the CE authentication lock time goes by so that this lock status is released FMT_MTD 1 3 permits only to the administrator the setting of the threshold of the authentication failure frequency that is the trial frequency of the failure authentication in the service engineer authentication FMT_MTD 1 9 permits only to the service engineer the setting of the CE authentication lock time lt Management of service engineer s authentication information gt F
86. b C451 ineo 550 ineo 451 Control Software Security Target Functional requirement component IT Security that operates other security functional requirements validly Functional lInterference ee Demencia Bypass E Deactivation Disabling Prevention y Prevention Detection Prevention N A FPT_SEP 1 N A FTA_SSL 3 FMT_MTD 1 3 FTP_ITC 1 FMT_MTD 1 3 FMT_MTD 1 12 FIA_NEW 1 FPT_RVM 1 N A FNEW_RIP 1 N A N A N A N A O Bypass Prevention lt By pass prevention of functional requirement that relates to administrator gt As for FDP_ACF 1 1 that regulates the user box access control FDP_ACF 1 2 that regulates the secure print file access control and FDP_ACF 1 3 that regulates the setting management access control the by pass prevention is supported by FIA_UAU 2 2 that regulates the administrator s identification and authentication Furthermore because FIA_UAU 2 2 is called by FPT_RVM 1 without fail the by pass prevention is supported lt By pass prevention of functional requirement that relates to service engineer gt As for FDP_ACF 1 3 that regulates the setting management access control the by pass prevention is supported by FIA_UAU 2 1 that regulates the service engineer s identification and authentication In addition FIA_UAU 2 1 is called by FPT_RVM 1 without fail the by pass prevention is supported lt By pass prevention of functional requirement that relates t
87. bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target KONICA MINOLTA bizhub C550 bizhub C451 ineot 550 ineo 451 Control Software Security Target This document is a translation of the evaluated and certified security target written in Japanese Version 1 05 Issued on August 24 2007 Created by KONICA MINOLTA BUSINESS TECHNOLOGIES INC Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 1 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target lt Revision Le SSS Date Ver Division Approves checked creea Revision Division Approved Checked Created Revision 2007 01 22 1 a Development Hirota Nakajima Yoshida Initial Version About a difference with bizhubC450 version 20 30 changed Add a security policy of organization concept explanation Add a Trusted channel function Add a S MIME function Add a concept of account control Modify the concept of user mind Consider external server Authentication Reflect the specification of rock processing of improved Authentication function Add a Enhanced Security Condition reflect modify Deal with CCv2 3 Deal with modification of Hard environment composition Div 12 Div 12 Div 12 2007 08 02 1 04 Development Hirota Nakajima Yoshida Reflect Administrator User Mode Deal with typos Semone word secure print gt secur
88. blic line External Network User Information Management Server Client PC Figure 1 An example of the expected environment for usage of the MFP e The intra office LAN exists as a network in the office e The MFP connects to the client PCs via the intra office LAN and has mutual data communication When the SMTP server or FTP server are connected to the intra office LAN the MFP can carry out data communication with these Need the DNS Service when setting the Domain name of SMTP Server or FTP Server O The case which is unifying management of the user ID and the user password in the server also assumes In this case TOE can control the access to the MFP by using the user registration information in the user information management server e When the intra office LAN connects to an external network measures such as connecting via a firewall are taken and an appropriate setup to block access requests to the MFP from the external network is carried out e The intra office LAN provides a network environment that cannot be intercepted by the office operation including using the switching hub and installing the wiretapping detector The public line connected with MFP is used to communicate with the FAX and the remote support function Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 8 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security
89. by having been changed the specific function setting which relates to security O CONFIG regulates that only the administrator is permitted to perform the setting of the enhanced security function that controls all setting function related to a series of security and so the possibility of the threat is removed OE FEED BACK regulates that the feedback protected is returned for the entered password by the administrator s authentication and OE N SESSION is also requested to logoff respectively after the operations of the administrator mode ends so that O CONFIG is supported sufficiently Accordingly this threat is countered sufficiently e T BACKUP RESTORE Unauthorized use of back up function and restoration function This threat assumes a possibility that the user box file or the secure print file may leak since the back up function or the restoration function being illegally used Moreover this assumes that because of a leak of confidential data such as the password the various setting values are falsified and there is a similar possibility that the user box file or the secure print file may leak O CONFIG regulates that the use of the back up function and the restoration function is permitted only to the administrator so that the possibility of the threat is removed OE FEED BACK regulates that the protected feedback is returned for the entered password by the administrator authentication and OE N SESSION is also requested the log off operat
90. by the encryption passphrase that was entered 2Abbreviation of Customer Service engineer Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 15 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target on the panel HDD Lock Function HDD has the HDD lock function as measure against the illegal taking out when the password is set The administrator function does the operation setting of this function As for the starting operation of MFP the access to HDD is permitted by the matching of the HDD lock password set to the HDD and the one set on the MFP Even if HDD is taken out it is impossible to use it excluding the MFP that the concerned HDD installed Remote diagnostic function Making use of several connected systems such as E mail and a modem connection through a FAX public line mouth or a RS 232C in communication with support center of MFP produced by Konica Minolta business technologies Inc it manages the state condition of MFP and the machinery information such as frequency of printing In addition if necessary appropriate service shipment of an additional toner the account claim dispatch of the service engineer due to the failure diagnosis etc is provided Y Updating function of TOE TOE facilitated with the function to update itself As for the update means there are a method that exists as one of items of remote diagnostic function a method t
91. cesses the user box where other user owns and downloads prints and transmits the user box file E mail transmission FTP transmission fax transmission and SMB transmission T ACCESS PUBLIC BOX Unauthorized access to public box which used a user function Exposure of the user box file when a person or the user with malicious intent accesses the public user box which is not permitted to use and downloads prints transmits E mail transmission FTP transmission FAX transmission and SMB transmission and removes and copies to the other user box the user box file T ACCESS GROUP BOX Unauthorized access to the group user box which used a user function Exposure of the user box file when a person or the user with malicious intent accesses the group user box which the account where a user does not belong to owns and downloads prints transmits E mail transmission FTP transmission FAX transmission and SMB transmission and removes and copies to the other user box the user box file T ACCESS SECURE PRINT Unauthorized access to the secure print file which used a user function Exposure of the secure print file when a person or the user with malicious intent prints the secure print file which is not permitted to use T ACCESS NET SETTING An unauthorized change of network setting e Malicious person or user changes the network settings that is related to the transmission of a user box file Even an addressee is set precisely a user box
92. communication encryption method that can be used Setting of S MIME transmission function Set the setting data which are used when the user box file is S MIME transmitted gt Transmission address data e mail address gt Registration and modification of S MIME certificate Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 63 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target gt Setting of Encryption Strength 6 1 2 FADMIN SNMP SNMP administrator function F ADMIN SNMP is a security function which identifies and authenticates the administrator in the access through the network by using SNMP from PC and then permits the operation of a setting function of the network only to the administrator whose identification and authentication was succeeded 6 1 2 1 Identification and authentication function by SNMP password It identifies and authenticates by the SNMP password that the user who accesses the MIB object through the network with the use of SNMP is an administrator O Offers the SNMP authentication mechanism which authenticates by the SNMP password that consists of the character shown in chart 8 gt Only Authentication password or both the Privacy password and the Authentication password is used gt In the case of SNMP the SNMP password is used for every session without requiring the administrator authentication mechanism by the separate session info
93. ction Access control function to personal user box The task to act for the identified and authenticated user has User ID of the user who is identified and authenticated for the user attribute This task is permitted the display of the list of the personal user box which has a corresponding user attribute with this user attribute Access control function to a user box file in a personal user box When the user box to operate is selected User Box ID of the user box is related to the task as a user box attribute in addition to the user attribute This task is permitted to the user box file with the user attribute and the user box attribute corresponding to the user attribute and the user box attribute of itself the printing the E mail transmission include the S MIME Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 69 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target transmission the FTP transmission the FAX transmission the SMB transmission download the removing to other user boxes and the copy operations to other user boxes User attribute change of a personal user box The user attributes can be changed gt If another registered user is specified it becomes a personal user box that another user manages gt If public is specified it becomes a public user box It is necessary to register the user box password In this case it is verified that
94. ction 6 1 8 FOVERWRITE ALL executes the overwrite deletion in the data area of HDD and initializes the setting value of the password that is set to NVRAM as well The object for the deletion or the initialization is as follows lt Object for the deletion HDD gt Secure print file User box file On memory image file Stored image file Remaining image file Image related file Transmission address data file User ID User password User box password Secure print password Account ID Account password S MIME certificate Remaining TSF data lt Object for the initialization NVRAM gt O Administrator Password SNMP password O Operation setting of HDD lock function OFF HDD lock password is deleted e Operation setting of Encryption function OFF Encryption Passphrase is deleted O Trusted Channel setting data Trusted Channel setting data is deleted because initialization has no default value The deletion methods such as the data written in HDD and the written frequency is executed according to the deletion method of all area overwrite deletion function set in FADMIN Table 9 The HDD lock password and the encryption passphrase cannot be used for being turned off the operation setting of the HDD lock function and the encryption function The setting of the Enhanced Security function becomes invalid in the execution of this function Refer to the description for the operation setting of the Enhanced Se
95. curity function in F ADMIN F CRYPT Encryption key generation function F CRYPT is generated the encryption key to encrypt all data written in HDD by using the HDD encryption key generation algorithm SHA 1 that is regulated by the KonicaMinolta encryption specification standard KonicaMinolta HDD encryption key generation algorithm SHA 1 is the algorithm to generate the encryption key by using the SHA 1 regulated by FIPS Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 73 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target 180 1 When the encryption passphrase is decided in the encryption functional operation setting to which the access is restricted in F ADMIN the encryption key of 128bit length is generated from the encryption passphrase by applying the SHA 1 algorithm 6 1 9 FHDD HDD verification function F HDD is a check function to permit reading from and writing in the HDD only when it is verified that the illegal HDD is not installed and is confirmed validity when the HDD lock password is set to HDD When the HDD lock password is set to HDD the status of HDD is confirmed in the HDD operation verifying at the time of TOE starting When the HDD lock password certainly being set is returned as the result of status confirmation the access to HDD is permitted If the HDD lock password not being set is returned the access to HDD is refused because of an ill
96. cution record has been left at the predicted audit activity with the user identification Extended requirement Necessity of FIA NEW 1 Regarding FIA_NEW 1 FIA_UID 1 or FIA_UID 2 is the closest requirement in the viewpoint of identification But the verification act of HDD doesn t approve the act accessed from an external entity by TOE but approval the act that TOE itself assigns to an external entity It is improper in the function requirement concerned and the extended requirement is necessary lt Validity of requirement identification structure gt Because this requirement is one of the identification requirements the family named NEW is set as a family added to the FIA class and clarifies the identification As an activity that is predicted on management FIA_UID requirement and similar management items are assumed Also an activity that is predicted on audit FIA_UID requirement and similar audit item are assumed 8 2 1 4 Assurance validity of specified IT security function requirement Two specified function requirements FNEW_RIP 1 FIA_NEW 1 are not the greatly extended concept of the function requirement provided by CC part 2 and high contents of novelty This is not the one to assume the necessity of presenting the TSP model specially or the possibility of a potential hiding channel in order to evaluate this function requirement accurately Therefore it is possible to assure sufficiently the validity of the function th
97. d e FIA UAU 2 1 FIA_UAU 2 1 regulates the authentication of the service engineer F SERVICE authenticates that the user who accesses the service mode by using the CE password is the service engineer Accordingly this functional requirement is satisfied e FIA_UAU 2 2 FIA_UAU 2 2 regulates the authentication of the administrator F ADMIN authenticates that the user who accesses the administrator mode by using the administrator password is the administrator F ADMIN SNMP authenticates that the user who accesses the MIB object by using the SNMP password Privacy password Authentication password is the administrator Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 117 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target Accordingly this functional requirement is satisfied e FIA_UAU 2 3 FIA_UAU 2 3 regulates the authentication of the User F USER authenticates that the user is the user who is registered by using the user password that is set to each user Accordingly this functional requirement is satisfied e FIA_UAU 2 4 FIA_UAU 2 4 regulates the authentication of the authorized user to use the secure print file F PRINT authenticates that the user is the authorized user to use the secure print file by using the secure print password that is set to each file Accordingly this functional requirement is satisfied e FIA_UAU 2 5 FIA_UAU 2 5 regul
98. dministrator attribute is associated with the task of substituting the use FDP_ACC 1 3 and FDP_ACF 1 3 permits the task of substituting the user to operate the SMTP server group object the DNS server group object and the settings for the MFP address group object lt Operation limitation of Backup and restoration function gt When the administrator attribute is related to the task of acting the use the task of acting the user is permitted the back up operation of the user box files by FDP_ACC 1 1 and FDP_ACF 1 1 the secure print files by FDP_ACC 1 2 and FDP_ACF 1 2 In addition the restoration operation is permitted for the encryption passphrase object the HDD lock password object SMTP server group object DNS server group object and MFP address group object by FDP_ACC 1 3 and FDP_ACF 1 3 Moreover the restoration operation is permitted for the encryption passphrase object the HDD lock password object the SMTP server group object the DNS server group object and the MFP address group object by FDP_ACC 1 3 and FDP_ACF 1 8 Moreover the restoration operation modifying operation of the followings is permitted only to the administrator the enhanced security setting data by FMT_MOF 1 1 the user attribute of the user box by FMT_MSA 1 1 and FMT_MSA 1 2 the user password by FMT_MTD 1I 2 the user ID the SNMP password the panel auto logoff time the authentication failure frequency th
99. during the series of permitted operations given to them A SERVICE Personnel conditions to be a service engineer Service engineers in the role given to them will not carry out a malicious act during series of permitted operations given to them A NETWORK Network connection conditions for MFP The intra office LAN where the MFP with the TOE will be installed is not intercepted When the intra office LAN where the MFP with the TOE will be installed is connected to an external network access from the external network to the MFP is not allowed A SECRET Operational condition about secret information Each password and encryption passphrase does not leak from each user in the use of TOE A SETTING Operational setting condition of Enhanced Security function MFP with the TOE is used after enabling the enhanced security function A SERVER Management condition of the user information management server connected to the intra office LAN When the external server authentication is used for the user authentication method the user information management server that is connected with the intra official LAN installing MFP with TOE are performed appropriately the management of the account access control and patch application etc 3 3 Threats In this section threats that are expected during the use of the TOE and the environment for using the TOE are identified and described T DISCARD MFP Lease return and disposal of MFP When the
100. e Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 31 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target FDP_ACF 1 4 3 The TSF shall explicitly deny access of subjects to objects based on the assignment rules based on security attributes that explicitly deny access of subjects to objects assignment rules based on security attributes that explicitly deny access of subjects to objects None Hierarchical to E No other components Dependencies E FDP_ACC 1 FDP_ACC 1 31 FMT_MSA 3 N A 5 1 1 3 Identification and authentication FIA_AFL 1 1 Authentication failure handling FIA_AFL 1 1 1 The TSF shall detect when selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values unsuccessful authentication attempts occur related to assignment list of authentication events lassignment list of authentication events e Authentication for accessing the service mode Re authentication for changing the CE password selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values assignment range of acceptable values an administrator configurable positive integer within 1 8 FIA_AFL 1 2 1 When the defined number of unsuccessful authe
101. e LAN setting of DNS server gt SMTP setting setting of SMTP server utilized by E mail transmission gt IP address NetBIOS name and AppleTalk printer name etc e Backup or restore function of NVRAM and HDD gt It is performed through the network by using an application exclusive use for the management installed in the client PC e Complete overwrite deletion function of HDD gt There is the data deletion method conformed to various military standards A method of directory service that Windows Server 2000 after it offers to consolidate user information in network environment of Windows platform Abbreviation of NT LAN Administrator Authentic method used in directory service that Windows NT offers to consolidate user information in network environment of Windows platform Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 13 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target gt When it s started in conformity with a set method the overwrite deletion is executed for all area of HDD Format function of HDD gt A logical format is executable The followings are the operation setting function related especially to the behavior of the security function Method setting of a user authentication function gt Select the machine authentication the external server authentication or the user authentication stop gt Combination with Account Auth
102. e administrator specifies the failure frequency threshold by the unauthorized access detection threshold setting function e To release the lock of the authentication function is to perform the lock release function to the user authentication of FADMIN Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 67 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target lt Account Authentication Account registration function when the belonging account of user is not registered in the synchronized method gt Require the Account authentication after User identification and authentication O Register the successful account ID as account name when succeeding in the account authentication The detail of the account authentication is the same as processing of the items explained in the following lt Account authentication User identification and authentication in the authentication method not synchronized gt lt Account Authentication User identification and authentication in the authentication method not synchronized gt When the access request for the user box and the request for the registration of the secure print file it is identified and authenticated to be a user The detail of user authentication is the same as account authentication user identification and authentication in the synchronized method In the case of the access from the panel the account authentication is re
103. e exposed and each setting values are falsified 3 4 Organizational Security Policies Recently there are a lot of organizations that demand security of network in office Although a threat of wiretapping activities etc in intra office LAN is not assumed in this ST TOE security environment that corresponds to the organization that demanded security measures in intra office LAN is assumed Particularly correspond to the secure communication of Protected Assets considering the confidentiality showed in the preceding The security policies applied in the organization that uses TOE are identified and described as follows P COMMUNICATION DATA secure communication of image file Highly confidential image file secure print file user box file which transmitted or received between IT equipment is communicated via trusted pass to the correct destination or has to be encrypted Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 21 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target 4 Security Objectives In this chapter in relation to the assumptions the threats and the organizational security policy identified in Chapter 3 the required security objectives policy for the TOE and the environment for the usage of the TOE are described by being divided into the categories of the security objectives for the TOE and the security objectives for the environment as fo
104. e of Encryption mail This security objective regulates the encryption of a user box file when transmitting the user box file by e mail and various requirements related to the encryption are necessary FCS_CKM 1 generates the encryption key 128bit 168bit 192bit or 256bit by using Pseudorandom number Generation Algorithm according to FIPS 186 FCS_COP 1 encrypts the user box file by using AES encryption key 128bit 192bit or 256bit of FIPS PUB 197 it becomes a transmission data of S MIME Also the same requirement encrypts the user box file by using 3 Key Triple DES encryption key 168bit of SP800 67 By the same token it becomes a transmission data of S MIME FCS COP 1 encrypts these encryption keys are encrypted by RSA of FIPS 186 1 that is a public key of S MIME certificate of each destination This security objective is satisfied by the completion of these plural function requirements e OE CRYPT Encryption of HDD This security objective regulates that the data stored in HDD is encrypted by the encryption board that is the entity of a necessary IT environment for the security maintenance of TOE and needs various requirements that relate to the encryption Applying FCS_COP 1 El the encryption board encodes and decodes all the written data to HDD by the 128bit encryption key using AES that conforms to FIPS PUB 197 This security objective is satisfied by the completion of this function requirement e OE LOCK HDD Access control of H
105. e print Div 12 Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 2 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target Contents MS SST o A A 6 A cae a e ood a Setar cess iol te aiid ale 6 1 2 TOE Identification im AA A edi aaa alee 6 1 3 CG Contormance Clint A iain ede aan 6 WiASST OVGIVIGW iia ita dia edad eter abe tati is 7 2 TOE Descrip siii aia 8 Qed TOR TP ai 8 2 2 Environment for the usage Of MFP eeeecesessseeceeeeececeeneeeeeeseeeaneeneceaneeeeseseaeeeeeseaeenesseneeeeseneaaees 8 2 3 Operation Environment of the TOE ise ieren Teaia aa aa iieiaeie etea Tid 9 2 4Role of the TOE U ST wierd na ee oe a a ea GN A aa bana Slade 10 2 5 Functions provided by the TOE prisiau akaenda aiii 11 2 9 1 BasiCiFUNCUO aia a A ii ed Pepe ton a Dee eed 11 2 9 2 USOr BOX FUNCHON coa A A AA A AA 12 2 5 3 User Authentication FUNCION siii ti aaa 12 2 9 4 Account Authentication FUNGON a TEE aa aadi adidas 13 25 5 Administrator Function naea a E eee 13 2 5 6 Service Engineer FUNCION iced A A wie ae mee 15 25 7 Other FUNGCHONS tidad se eda eda PEE EEE A aE E E ES e daa o EEA Ee AE ia E 15 2 5 8 Enhanced Secur EUA ii 16 3 TOE Security Environment iria da 18 3 1 Protected ASSIS ui il ii aida 18 32 ASSUMPIONS iii TE de Ri incas 19 AC es pa a pe a a T tr mrerer errr errpee mere ree 19 3 4 Organizational Security Policies isitin een
106. e print file of FADMIN executed 6 1 6 2 Access control function to a secure print file The secure print file access control operates when it is authenticated O The task to act for the user who is identified and authenticated has the authenticated secure print internal control ID as the file attribute e This task is permitted the printing to the secure print file with a corresponding file attribute to the file attribute of this task 6 1 6 3 Registration function of a secure print file When it is authenticated as a registered user in the registration request of the secure print file the user is permitted to register the secure print password with the concerned secure print file O Registration of the secure print password The registered secure print password is verified to meet the following requirements gt Itis composed of the characters and by the number of digits shown in Table 8 gt It shall not be composed of one kind of character 2 Giving of the secure print internal control ID When the verification of the secure print password is completed in a registration request of the secure print file the secure print internal control ID uniquely identified is set to the concerned secure print file Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 72 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target 6 1 7 FOVERWRITE ALL All area overwrite deletion fun
107. e same parentheses 5 1 TOE Security Requirements 5 1 1 TOE Security Function Requirements 5 1 1 1 Cryptographic Support FCS_CKM 1 Cryptographic key generation FCS_CKM 1 1 The TSF shall generate cryptographic keys in accordance with a specified cryptographic key generation algorithm assignment cryptographic key generation algorithm and specified cryptographic key sizes lassignment cryptographic key sizes that meet the following lassignment list of standards lassignment list of standards Listed in Tablel Cryptographic key generation Relation of Standards Algorithm Key sizes lassignment cryptographic key generation algorithml Listed in Tablel Cryptographic key generation Relation of Standards Algorithm Key sizes lassignment cryptographic key sizes Listed in Table1 Cryptographic key generation Relation of Standards Algorithm Key sizes Hierarchical to No other components Dependencies FCS_CKM 2 or FCS_COP 1 FCS_COP 1 FCS_COP 1 E FCS_CKM 4 N A FMT_MSA 2 N A Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 26 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target Table 1 Cryptographic Key Generation Relation of Standards Algorithm Key sizes List of Standards Cryptographic Key Generation Algorithm Cryptographic Key sizes FIPS 186 Pseudorandom number Generation Algorithm 128 bit 192 b
108. e secure print file FIA_USB 1 3 The TSF shall enforce the following rules governing changes to the user security attributes associated with subjects acting on the behalf of users assignment rules for the changing of attributes lassignment rules for the changing of attributes None Hierarchical to No other components Dependencies FIA_ATD 1 5 1 1 4 Security management FMT_MOF 1 1 Management of security functions behavior FMT_MOF 1 1 1 The TSF shall restrict the ability to selection determine the behavior of disable enable modify the behavior of the functions lassignment list of functions to assignment the authorized identified roles lassignment list of functions Enhanced Security Setting selection determine the behavior of disable enable modify the behavior of disable lassignment the authorized identified roles Administrator Service Engineer Hierarchical to No other components Dependencies FMT_SMF1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 1 FMT_SMR 1 2 Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 41 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target FMT_MOF 1 2 Management of security functions behavior FMT_MOF 1 1 2 The TSF shall restrict the ability to selection determine the behavior of disable enable modify the behavior of the function
109. e secure print password the external authentication setting data the account Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 91 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target ID the account password the S MIME certificate the transmission address data the trusted channel function setting data the belonging account of user CE authentication lock time administrator authentication lock time by FMT_MTD 1 3 the user box password by FMT_MTD 11 4 FMT_MTD 1 7 permits only to the administrator the backup operation inquiry operation of the SNMP password the user password the user box password and the secure print password the account password lt Operational limitation of Enhanced Security function gt FMT_MOF 1 1 permits only the administrator and service engineer to disable the setting for the enhanced security function lt Management of HDD lock password and encryption passphrase gt When the administrator attribute is related to the task of acting the user FDP_ACC 1 3 and FDP_ACF 1 3 permit the setting operation to the HDD lock password object and the encryption passphrase object to the task of acting the user FIA_SOS 1 4 verifies the quality of the HDD lock password and the encryption passphrase In order to change the HDD lock password and encryption passphrase FIA_UAU 6 re authenticates that a user is an administrator by collating
110. e user box file by the pseudorandom number Generation Algorithm which FIPS 186 provides Encryption key length is 128bit 168bit 192bit or 256bit Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 74 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target lt Encryption of User box file gt It is encrypted by AES which FIPS PUB 197 provides by using encryption key 128bit 168bit and 256bit to encrypt the user box file e It is encrypted by the 3 Key Triple DES which SP800 67 provides by using the encryption key 168bit to encrypt the user box file lt Encryption of User box file Encryption key gt The encryption key to encrypt the user box file is encrypted by RSA which FIPS 186 1 provides eo The key length of the encryption key used in this case is 1024 bit 2048bit 3072bit or 4096bit 6 2 TOE Security Strength of Function The TOE security functions having probabilistic permutational mechanisms are as follows The strength of each of the functions satisfies the SOF Basic Administrator authentication mechanism HDD lock password verification mechanism and encryption passphrase verification mechanism which F ADMIN offers CE authentication mechanism which F SERVICE offers Secure print authentication mechanism which F PRINT offers User box authentication mechanism which F BOX offers SNMP authentication mechanism which F ADMIN SNMP of
111. e user box file in the public user box is restricted only to the user who is permitted by O PUBLIC BOX so that the possibility of the threat is removed OE FEED BACK regulates to return the protected feedback for the entered password in the user s authentication and user box s authentication and OE N SESSION requires the log off operation after the operation ends so that O REGISTERED USER and O PUBLIC BOX are supported sufficiently Accordingly this threat is countered sufficiently e T ACCESS GROUP BOX Unauthorized access to a group user box using user function This threat assumes the possibility that an unauthorized operation is performed by using the user function for the group box that is a storage area of image file used by user who is permitted the use of the account or the user box file in it O REGISTERED USER assumes that only the user to whom TOE was registered is permitted to use MFP installed TOE furthermore the operation of the group user box and user box file in the group user box is restricted only to the permitted userby O GROUP BOX so that the possibility of the threat is removed OE FEED BACK regulates to return the protected feedback for the entered password in the user s authentication and account s authentication and OE N SESSION also requires the log off operation after the operation ends so that O REGISTERED USER and O GROUP BOX are supported sufficiently Accordingly this threat is countered sufficiently e T ACCES
112. each users gt Ifthere is a user to whom access is locked the lock is released Reset 0 clear the number of authentication failure for all secure prints gt Ifthere is a secure print to which access is locked the lock is released Reset 0 clear the number of authentication failure of each user boxes gt Ifthere is a user box to which access is locked the lock is released Reset 0 clear the number of authentication failure of each account Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 59 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target gt Ifthere is a user box to which access is locked the lock is released Reset 0 clear the number of authentication failure of SNMP password gt Ifthere is a MIB object to which access is locked the lock is released Setting of user authentication function Set the following authentication method in a user authentication function gt Machine authentication Authentication method which utilizes a user password managed on MFP sides gt External server authentication Authentication method which utilizes a user password managed with a user information management server connected through a network Only Active Directory method is object When external server authentication is used the external server authentication setting data Contain the multiple authentication server information such as domain name to
113. egitimate possibility 6 1 10 FRESET Authentication Failure Frequency Reset Function F RESET is a function that releases the lock by resetting the authentication failure frequency when the account locks in the administrator authentication and CE authentication CE Authentication function lock release processing function The function is executed by the specific operation and the lock is released by clearing the failure frequency of the CE authentication to 0 after CE authentication lock time Administrator authentication function lock release processing function The function is executed by OFF ON of the main power supply and the lock is released by clearing the failure frequency of the administrator authentication to 0 after the administrator authentication lock time 6 1 11 FTRUSTED PASS Trust Channel Function F TRUSTED PASS is a function that generates and achieves the Trusted Channel by using SSL or TSL protocol when transmitting and receiving the following image file between PC and MFP User box file download from MFP to PC Image file that will be stored as a user box file upload from PC to MFP Image file that will be stored as Secure Print file upload from PC to MFP 6 1 12 F S MIME S MIME Encryption Processing Function F S MIME is a function to encrypt the User box file when transmitting the User box file as S MIME lt User box file Encryption Key generation gt e The Encryption key is generated to encrypt th
114. ent range of acceptable values an administrator configurable positive integer within 1 3 FIA_AFL 1 2 4 When the defined number of unsuccessful authentication attempts has been met or surpassed the TSF shall lassignment list of actions lassignment list of actions lt Action when it is detected gt Log off from the authentication status of the user fit is and lock the authentication function for the user lt Operation for recovering the normal condition gt Perform the delete function of authentication failure frequency offered within the administrator mode Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 33 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target Hierarchical to No other components Dependencies FIA UAU 1 FIA_UAU 2I 3 FIA_AFL 1 5 Authentication failure handling FIA_AFL 1 1 5 The TSF shall detect when selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values unsuccessful authentication attempts occur related to lassignment list of authentication events lassignment list of authentication events Authentication for accessing the secure print file selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable
115. ent the authorized identified roles Administrator Hierarchical to f No other components Dependencies FMT_SMF1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_MTD 1 13 Management of TSF data FMT_MTD 1 1 11 The TSF shall restrict the ability to selection change default query modify delete clear lassignment other operationsll the assignment list of TSF data to assignment the authorized identified roles lassignment ist of TSF datal Belonging Account of a user oneself selection change_default query modify delete clear lassignment other operations assignment other operations Registration lassignment the authorized identified rolesl Administrator the user who is permitted to use of the account Hierarchical to No other components Dependencies FMT_SMF1 FMT_SMF1 FMT_SMR 1 FMT_SMR 1 2 FMT_SMR 1I 6 FMT_SMF 1 Specification of Management Functions EMI_SMF 1 1 The TSF shall be capable of performing the following security management functions lassignment list of security management functions to be provided by the TSH lassignment list of security management functions to be provided by the TSF Stop Function of Enhanced security function by administrator Operation Method Setting Function of User Authentication Function by administrator Operation Method Setting Function of Account Authentication Function by administrator Operation S
116. enticating if a user is the authorized user to use the secure print file for the access to the secure print file from the panel to the identified and authenticated user as a registered user 6 1 6 1 Authentication function by the secure print password When the user is identified and authenticated as the registered user it authenticates that the accessing user is a user to whom the use of the secure print file concerned is permitted in response to the access request to each secure print file O Offers the secure print password authentication mechanism that is authenticated by the secure print password that consists of the character shown in Table 8 gt The secure print authentication mechanism by the separate session information is not needed because it becomes only an access from the panel in the case of the secure print O Return for each character as feedback for the entered secure print password O Resets the number of authentication failure when succeeding in the authentication The access from the panel is not accepted for 5 seconds when the authentication is failed When the authentication failure that becomes the 1 3 times in total for the secure print file concerned is detected the authentication function to the secure print file is locked gt The administrator specifies the failure frequency threshold by the unauthorized access detection threshold setting function e The lock is released by the lock release function to the secur
117. entication is set up Method synchronized with User Authentication Method not synchronized with User Authentication User Setting of access by PUBLIC gt Select the permission and prohibition of MFP utilization of the user who is not identified by user ID Setting of a password policy function gt Select ON or OFF for the function to check the several conditions of the password such as the valid number of digits for the various passwords etc Setting of the authentication method of secure print and the prohibit function of authenticating operations gt There are the mode that the authentication operation prohibition function operates for the authentication of the secure print and the mode not done gt The operation mode of the function that the failure authentication in each authentication function detects the failure synchronizes too gt Selecting the above mentioned operational mode Setting of the network setting modification function by SNMPv1 and v2 gt Select the permission or the prohibition of the modification operation function of MIB by SNMPv1 and v2 Setting of HDD lock function gt Selecting ON or OFF gt Register or change the HDD lock password when ON is selected Setting of encryption function only when the encryption board installed gt Selecting ON or OFF gt Register or change the Encryption passphrase when ON is selected Setting of user box collective management function gt Select the p
118. er who is permitted to use secure print file to identify itself before allowing any other TSF mediated actions on behalf of that user User who is permitted to use secure print file Hierarchical to FIA_UID 1 Dependencies No dependencies FIA_UID 2 5 User identification before any action FIA_UID 2 1 5 The TSF shall require each user User who is permitted to use the public user box to identify itself before allowing any other TSF mediated actions on behalf of that user User who is permitted to use the public user box Hierarchical to FIA_UID 1 Dependencies No dependencies FIA_UID 2 6 User identification before any action FIA_UID 2 1 6 The TSF shall require each user User who is permitted to use the account to identify itself before allowing any other TSF mediated actions on behalf of that user User who is permitted to use the account Hierarchical to FIA_UID 1 Dependencies No dependencies FIA_UID 2 7 User identification before any action FIA_UID 2 1 7 The TSF shall require each user External Server to identify itself before allowing any other TSF mediated actions on behalf of that user External Server Hierarchical to FIA_UID 1 Dependencies No dependencies Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 40 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control
119. eries of requirement set associated by set admin and gt set service shown in column 8 2 1 2 Sufficiency The IT security functional requirements for the security objectives are described as follows e O REGISTERED USER Usage of a registered user This security objective limits the utilization of MFP installing TOE to only the registered user and needs various requirements that related to the user identification and authentication lt Necessary requirement for identification and authentication of the user gt It identifies and authenticates that the user who accesses is a registered user by FIA_UID 2 3 and FIA_UAU 2 3 FIA_UAU 7 returns for each entered character as feedback protected by the panel and Copyright O 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 85 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target supports the authentication In the case of the failure authentication from the panel FIA_AFL 1 8 refuses all input acceptances from the panel for 5 seconds in every failure When the authentication failure reaches 1 3 times FIA_AFL 1 4 locks the authentication function for that user from then on This lock status is released by the administrator s release operation FMT_MOF 1 2 permits only the administrator the selection of the user authentication methods which are Machine authentication and External server authentication FMT_MTD 1 3
120. ermission or the prohibition for the user box collective management function Setting of the print capture function gt A function to verify the print data received by MFP when print function breaks down gt Selecting ON or OFF for the above mentioned function Setting of network setting management reset function gt Anetwork setting management reset function resets a series of items in a factory default gt Selecting permission or prohibition for the above mentioned function Setting of Trusted Channel SSL TLS encryption communication Function gt Create or import SSL TLS server certificate gt Setting of encryption method that is used for communication Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 14 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target O Setting of Transmission address data gt Setting of address or method that is used for box file transmission etc gt Import S MIME certificate gt Setting of encryption method that is used for data encryption 2 5 6 Service Engineer Function TOE provides a management function of administrator and a maintenance function such as adjusting the device for Scan Print etc within the service mode that only a service engineer can operate The following shows the functions related to the security e Modification function of administrator password The followings are the operation setting function
121. es Public user box from the panel selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values assignment positive integer number 1 FIA_AFL 1 2 8 When the defined number of unsuccessful authentication attempts has been met or surpassed the TSF shall assignment list of actions lassignment list of actions lt Action when it is detected gt Deny all access from the panel lt Operation for recovering the normal condition gt Automatically release the lock after 5 seconds Hierarchical to E No other components Dependencies FIA UAU 1 FIA_UAU 2 1 FIA_UAU 2 2 FIA_UAU 2 3 FIA_UAU 2 4 FIA_UAU 2 5 FIA_UAU 216 Copyright O 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 35 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target FIA_ATD 1 User attribute definition FIA_ATD 1 1 The TSF shall maintain the following list of security attributes belonging to individual users lassignment list of security attributes assignment list of security attributes User box attributes User box ID File attributes Secure print internal control ID Account name Account ID Hierarchical to No other components Dependencies No dependencies FIA_SOS 1 1 Verification of secrets FIA_SOS 1 1 1 The TSF shall pr
122. es various requirements that relate to the access control lt Secure print file access control gt FDP_ACC 1 2 and FDP_ACF 1 2 permits the list display operation of every secure print user box to the task of acting the user who has user ID As it must be a user who is permitted the use of the secure print file to print it FIA_UID 214 and FIA_UAU 2 4 identifies and authenticates that it is a user who is permitted the use of the secure print file FIA_UAU 7 returns for each entered character as feedback protected by the panel and supports the authentication FIA_AFL 1 8 refuses all input acceptances from the panel for 5 seconds in every failure When the authentication failure reaches 1 3 times FIA_AFL 1 5 locks the authentication function for to the concerned secure print file This lock status is released by the administrator s release operation FMT_MTD 1 3 permits only to the administrator the setting of the threshold of the authentication failure frequency that is the trial frequency of the failure authentication in the authentication of the user who is permitted the use of the secure print file When FIA_ATD 1 and FIA_USB 1 relate the secure print internal control ID to the task of acting use FDP_ACC 1 2 and FDP_ACF 1 2 permit the print operation to the secure print file that has a corresponding object attribute to the secure print internal control ID of the subject attribute As for secure print internal control ID FMT
123. et Modification function of SNMP password by administrator Modification function of user password by administrator Registration function of user box password by administrator Modification function of user box password by administrator User box registration function by administrator However only when the public is registered for user attribute Modification function of user attribute of the user box by the administrator However only when the user attribute of previous setting is user ID Registration function of user ID by administrator Registration function of user password when method of user authentication by administrator is machine authentication Modification function of user password when method of user authentication by administrator is machine authentication Initialization function of administrator password by administrator Initialization function of SNMP password by administrator Registration function of S MIME certificate by administrator Registration modification function of S MIME certificate by administrator Operation setting function of S MIME function by administrator Registration function of transmission address data by administrator Modification function of transmission address data by administrator Registration function of Trusted Channel function setting data by administrator Modification function of Trusted Channel function setting data by administrator Operation
124. etting Function of SNMP password authentication function by administrator Setting function of authentication failure frequency threshold by administrator in the authentication operation prohibition function Backup Function by administrator 7 Restoration Function by administrator 8 Registration function of account ID by administrator Modification function of account ID by administrator Panel Auto Log off Time Setting Function by administrator Deletion Function of detected value of unauthorized access to SNMP by administrator Deletion Function of detected value of unauthorized access of user by administrator Deletion function of detected value of unauthorized access to secure print by administrator Deletion function of detected value of unauthorized access to user box by administrator Deletion function of detected value of unauthorized access to account by administrator Modification function of administrator password by administrator E A user who isn t related with an account name and who was informed of the account password for the account ID from the administrator off line A part of a backup function corresponds to the inquiry function of TSF data A part of the restoration function corresponds to the modification function of the TSF data Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 48 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Targ
125. f the concerned user to the user attribute of the user box and corresponds with the belonging account of user whom the account ID was authenticated Accordingly this functional requirement is satisfied e FMT_MSA 3 1 FMT_MSA 3 1 regulates the default value of the user attribute that is the security attribute Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 121 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target given when the user box is generated F ADMIN sets public to the user attribute of the user box as a default value in the user box registration operation that is executed in the administrator mode User is permitted the change this to any value user ID or account ID of the registered user F BOX sets public to the user attribute of the user box as a default value in the user box registration operation that is executed by the authenticated user User is permitted the change this to any value user ID or account ID of the registered user In addition when the job which is stored to the user box which specifies the unregistered user box is performed the User ID of the user who executes the job concerned is set as a default value and is stored to the unregistered user box The case of the specifying the unregistered user box cannot change the user attribute because there is no timing to set an initial value where the default value is changed Accordin
126. f which performance is indispensable before writing HDD is permitted when HDD lock function is activated Accordingly this functional requirement is satisfied e FPT_SEP 1 FPT_SEP 1 regulates maintaining of security domains for protecting against interference and tampering by subjects who cannot be trusted and regulates separating of security domains of subjects FADMIN maintains the administrator authentication domain that is provided various functions permitted to operate only by administrator and it does not permit the interference by the unauthorized subject FADMIN SNMP maintains the administrator authentication domain that is provided various functions permitted to operate only by the administrator who is authenticated with the SNMP password and it doesn t permit the interference by the unauthorized subjects FUSER maintains the user authentication domain that is provided various functions permitted to operate only by the authenticated user and it doesn t permit the interference by the unauthorized subject F BOX maintains the user box authentication domain that is provided various functions permitted to operate only by the authorized user who can use the public user box by the authentication of the user box password and it doesn t allow the interference by the unauthorized subject F PRINT maintains the secure print file authentication domain that is provided various functions permitted to operate only by a user who is permitted to use the
127. fers User authentication mechanism which F USER offers 006060 6 3 Correspondence between TOE Security Functions and Function Requirements The correspondence between TOE security function and TOE security function requirements shows in Table 15 Table 15 shows that the TOE security function corresponds to at least one TOE security function requirement 6 4 Assurance Measures The following table shows the assurance measures to meet the component of the TOE security assurance requirements for EAL3 that are stipulated in Table 10 Table 10 Correspondence between TOE Assurance Requirements and assurance measures TOE Security Assurance Requirement TOE Security Assurance Requirement Class ACM CM capabilities ACM_CAP 3 Configuration management plan Configuration Configuration List CM scope ACM_SCP 1 management CM record ADO_DEL 1 Delivery operation instructions Class ADO Service Manual Security Function bizhub C550 C451 ADO_IGS 1 Service Manual Security Function bizhub C550 C451 ineo 550 451 Delivery and Installation generation Operation and start up Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 75 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target TOE Security Assurance Requirement TOE Security Assurance Requirement User s Guide Security Function bizhub C550 C451 User s Guide Security Operations Bizhub C
128. fied and authenticated that you are the registered user such as the permission of the operation and management of the personal user box of the user the authentication to the user who is permitted the utilization of the user box in the access to the public box and the access control function to permit various operations of the concerned user box and the user box file after the authentication lt Registration of user box by user operation gt To register a personal user box or a public user box by selecting the user attribute to the non registration user box ID selected When it s registered it is possible to select User ID in the user attribute of the user box which have been specified Public as a default value In the case of the personal user box the arbitrary user ID registered is specified O In the case of the public user box verify that a user box password registered satisfies the following conditions gt Itis composed of the characters and by the number of digits shown in the Table 8 gt It shall not be composed of one kind of character In the case of group user box the arbitrary account ID registered is specified lt Automatic registration of user box gt In the user box operation to store of the copy job and the print job when the specified user box is unregistered the personal user box which is set the user ID of the user who operates the job concerned is automatically registered 6 1 5 1 Personal User Box Fun
129. file access control the authenticated administrator and the authenticated user who is permitted the use of secure print file FDP_ACF 1 2 is supported in the interference and destruction prevention from other illegal subject lt Maintenance of setting management access control gt Only the subject that acts the authenticates administrator who is assumed by the set management access control and the authenticated service engineer can operate the object regulated for by the setting management access control by FPT_SEP 1 and the prevention of an illegal interference and destruction from other illegal subject are supported for FDP_ACF 1 3 lt Management of CE password gt The modification operation of the CE password has been permitted only to the service engineer by FMT_MTD 1 9 This supports the prevention of unauthorized interference and destruction of FLA_UAU 2 1 lt Management of administrator password gt The modification operation of the administrator password is permitted only to the administrator and the service engineer by FMT_MTD 1 6 The initialization of the administrator password is permitted only to the administrator and the service engineer by Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 105 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target FMT_MTD 1 11 This supports the prevention of unauthorized interference and destruction of FIA_U
130. gly this functional requirement is satisfied FMT_MSA 3 2 FMT_MSA 3 2 regulates the secure print internal control ID that is set at the time of registration of secure print file F_PRINT grants the secure print internal control ID that is identified uniquely to the concerned secure print file at the time of registration of secure print file Accordingly this functional requirement is satisfied e FMT_MTD 1 1 FMT_MTD 1 1 regulates the management of the user password When Machine authentication is selected as the method of the user authentication F ADMIN offers the registration operation of the user password regarding the user registration in the administrator mode In addition FADMIN permits the administrator the back up and restoration operation so that it is possible to change the back up data which is acquired by back up operation and to register the user password as a result of performing the restoration operation Accordingly this functional requirement is satisfied e FMT_MTD 1 2 FMT_MTD 1 2 regulates the management of the user password When Machine authentication is selected as the method of the user authentication F ADMIN offers the change of the user password registered in the administrator mode In addition F ADMIN permits the administrator back up and restoration operation so that it is possible to change the back up data which is acquired by back up operation and to change the user password as a result of perform
131. gnment the authorized identified roles lassignment list of security attributes User attributes of the user box that is set user s own user ID selection change default query modify delete lassignment other operations Modify modify to other user s User ID account ID or public lassignment the authorized identified roles User e Administrator lassignment access control SFP information flow control SFP User box access control Hierarchical to No other components Dependencies FDP_ACC 1 or FDP_IFC 1 FDP_ACC 1 1 FMT_SMF 1 FMT_SMF1 FMT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 3 FMT_MSA 1 2 Management of security attributes FMT_MSA 1 1 2 The TSF shall enforce the lassignment access control SFP information flow control SFP to restrict the ability to selection change_default query modify delete lassignment other operations the security Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 42 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target attributes lassignment list of security attributes to lassignment the authorized identified roles lassignment list of security attributes User attributes of user box that is set the public selection change default query modify delete lassignment other operations modify modify to User ID or account IDJ lassignment
132. h have been specified Public as a default value In the case of the personal user box the arbitrary user ID registered is specified In the case of the public user box verify that a user box password registered satisfies the following conditions lt gt Itis composed of the characters and by the number of digits shown in the Table 8 lt gt It shall not be composed of one kind of character Specify the arbitrary account ID registered when Group user box gt Change of User Box Password The user box password set to the public user box is changed It verifies whether the user box password newly set have been satisfied the following qualities lt gt Itis composed of the characters and by the number of digits shown in the Table 6 lt gt It shall not be composed of one kind of character gt Change of user attribute of user box Specify the user attribute of a personal user box to the other user or the account that registered Specify the user attribute of group user box to the user or the other account that registered Specify the user attribute of public user box to the user or account that registered Specify the user attribute of a personal user box or group user box to public lt The registration of a user box password is necessary at the same time and then the processing which is similar to a change of the above mentioned user box password should be done Release of Lock Reset 0 clear the number of authentication failure for
133. hat downloads from FTP server through Ethernet TOE update function via Internet and a method that performs the connection of the Compact Flash memory medium Encryption Communication function TOE can encrypt the data transmitted from PC to MFP and the data received by download from MFP by using SSL TLS The operation setting of this function is performed by the administrator function S MIME certificate automatic registration function It is the function to register the certificate for S MIME conforms to ITU T X 509 with each transmission address automatically When a certificate is attached in received e mail MFP recognizes user ID according to the information of e mail header and registers the certificate as certificate of the same user ID 2 5 8 Enhanced Security Function Various setting functions related to the behavior of the security function for the Administrator function and the Service engineer function can be set collectively to the secure values by the operation settings of the Enhanced Security Function Each value set is prohibited changing itself into the vulnerable one individually As the function that does not have a setting function of the operation individually there is the reset function of the network setting and the update function of TOE through the network but the use of these functions is prohibited The following explains the series of the setting condition of being the enhanced security function ac
134. he following operation Keep the user password and secure print password confidential Keep the user box password and account password confidential between the user who commonly utilizes it Should not set the value that can be guessed for the user password secure print password and the user box password The user password and the user box password should be properly changed When the administrator changes the user password or the user box password make the user to change them promptly The administrator executes the following operation Should not set the value that can be guessed for the administrator password the account password SNMP password the HDD lock password and encryption passphrase Keep the administrator password account password the SNMP password the HDD lock password and the encryption passphrase confidential The administrator password the account password the SNMP password the HDD lock password and the encryption Passphrase should be properly changed Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 24 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target The service engineer executes the following operation Should not set the value that can be guessed for the CE password Keep the CE password confidential The CE password should be properly changed When the service engineer changes the administrator password make the
135. he session information besides the administrator password after the administrator is authenticated to the access from the network gt According to protocol use the session information of more than 101 or generate and use the session information more than 1010 O Return for each character as feedback for the entered administrator password O Resets the number of authentication failure when succeeding in the authentication Copyright O 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 56 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target O In the case of access from a panel it doesn t accept the input from a panel for five seconds when failing in the authentication e Locks all the authentication functions to use the administrator password when detecting the authentication failure that becomes 1 8 times at total in each authentication function by using the administrator password Refuse the access to the administrator mode gt The administrator specifies the failure frequency threshold by the unauthorized access detected threshold setting function e F RESET works and the lock release function of the administrator authentication function in F SERVICE is carried out and the lock of authentication function is released Table 8 character and number of digits used for password Objectives Number Characters of digits CE Password 8 digits 92 characters in total can be
136. horized access to personal user box using user function This threat assumes the possibility that an unauthorized operation is done by using the user function for the personal user box which each user uses to store the image file O REGISTERED USER is assumed that only the user to whom TOE was registered is permitted to use MFP installed TOE furthermore the operation of a personal user box and the user box file in a personal user box is restricted only to the user who is the owner by O PRIVATE BOX so that the possibility of the threat is removed OE FEED BACK regulates to return the protected feedback for the entered password in the user s authentication and OE N SESSION also requires the log off operation after the operation ends so that O REGISTERED USER and O PRIVATE BOX are supported sufficiently Accordingly this threat is countered sufficiently Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 80 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target e T ACCESS PUBLIC BOX Unauthorized access to public user box using user function This threat assumes the possibility that an unauthorized operation is done by using the user function for the public user box which each user shares to store the image file O REGISTERED USER assumes that only the user to whom TOE was registered is permitted to use MFP installing TOE furthermore the operation of the public user box and th
137. ibutes lt Object gt HDD Lock Password Object Encryption passphrase object SMTP server group object DNS server group object MFP address group object lassignment access control SFP Setting management access control FDP_ACF 1 2 3 The TSF shall enforce the following rules to determine if an operation among controlled subjects and controlled objects is allowed lassignment rules governing access among controlled subjects and controlled objects using controlled operations on controlled objects lassignment rules governing access among controlled subjects and controlled objects using controlled operations on controlled objects A task act for a user who has a administrator attribute is permitted to set the HDD lock password object and the encryption passphrase object A task act for a user who has a administrator attribute is permitted to set the SMTP server group object the DNS server group object and the MFP address group object and to operate the restoration A task act for a user who has a CE attribute is permitted to set the HDD lock password object and the encryption passphrase object FDP_ACF 1 3 3 The TSF shall explicitly authorize access of subjects to objects based on the following additional rules assignment rules based on security attributes that explicitly authorize access of subjects to objects assignment rules based on security attributes that explicitly authorize access of subjects to objects Non
138. ieder iaae eae a a a nn nn E aait ie Fidana iaa nE ia 21 4 Sec rity ODJECUIV OS our ies 22 4 1 Security Objectives for the TOE oooooonocccconococcnononannnononannnnonnnno cnn nnnnnnnn nana nnnn nen near nn cnn rare nn rra rre 22 4 2 Security objectives for the envirOnMeNt cooooccccnnocaccncnnnncnncnonnnnnonononnnncnnannn nc non ncn nn naar nn cn nn nnnncnnnnns 23 4 2 1 IT environment security objectives oonocomnicninniocionnccinrcc nc 23 4 2 2 Non IT environment Security objective ooooiccicinicniinoniniccnnnncccnncrccnrc rr 24 5 IT Security Requifements ti tio 26 5 1 TOE Security Requirement sisirain tinelad iar eeina ener nan nn nr nene Nne rre naar nn naaa 26 5 1 1 TOE Security Function Requirements sistori a a aiaa aaria naaa ae aroan EE EE Sai 26 5 1 2 Minimum Security Strength of Function cccccccccceceeeseeteneeeeeeteneeceeeceaeeceaeeseaeeseaeeseaeeseaeessaeesaeeeseteneessieeteneees 53 5 1 3 TOE Security Assurance Requirements ccseccceeeeseeeeteeeeseeeseceeeseeessaeeeaeeeseneeesaeessaeesaaeeseaessaaeesaeesiseseeeeeeees 53 5 2 Security Requirements for the IT environment eee eeeeeeeeeeeneeeeeeeeeaeeeeeeeaeeeeeeaeeeeeeenaeeeeeenaes 54 5 2 12 Cry PtographiC SUDPOME copita ett et t a a a ena Ab 54 5 2 2 Identification and Authenticati0N ooonnnicicnnonicconnnicnnrcccc rr 54 6 TOE Summary Specification suicida 56 61 TOE Security FUNCIONS vaticina 56 6 1 1 ADMIN Administrator Function oooooninnin
139. in the administrator mode that is the registration operation of the user box password that is set to the public user box In addition FADMIN permits the administrator the back up and restoration operation and so it is possible to change the back up data which is acquired by back up operation and to register the user box password as a result of performing the restoration operation F BOX permits the authenticated user the registration operation of the user box that is the registration operation of the user box password that is set to the public user box Accordingly this functional requirement is satisfied e FMT_MTD 1 6 FMT_MTD 1 6 regulates the management of the administrator password F ADMIN permits the change operation of the administrator password in the administrator mode It is possible to change the CE authentication lock time as a result of performing the back up and the restoration operation F SERVICE permits the change operation of the administrator password in the service mode Accordingly this functional requirement is satisfied Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 123 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target FMT_MTD 1 7 FMT_MTD 1 7 regulates the management of the SNMP password the User password the User box password the Secure Print password and the account password F ADMIN permits the administrator the back up and rest
140. ing the restoration operation When Machine authentication is selected as the method of the user authentication F USER permits the authenticated user the change of user s own password Accordingly this functional requirement is satisfied e FMT_MTD 1 3 FMT_MTD 1 3 regulates the management of a user ID a SNMP password the panel auto logoff time the failure number of times threshold the setting data of the external server authentication a secure print password a account ID a account password the S MIME certificate the transmission address data the setting data of the trusted channel function Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 122 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target the belonging account of user and the administrator authentication lock time F ADMIN permits the operation to change the SNMP password the panel auto logoff time the setting data of authentication failure frequency threshold the setting data of the external server authentication the account ID the account password the S MIME certificate the transmission address data the setting data of the trusted channel function the belonging account of user and the administrator authentication lock time in the administrator mode In addition FADMIN permits the administrator the back up and restoration operation and so it is possible to change the back up data which is ac
141. inistrator by FMT_MTD 1 3 This supports the prevention of unauthorized interference and destruction of FLA_UAU 2I4 lt Management of user box password gt The registration of the user box password is permitted to the administrator and the user by FMT_MTD 1 5 and the modification operation is permitted to the administrator and the user who is permitted the use of the public user box by FMT_MTD 1 4 The inquiry operation is permitted only to the administrator by FMT_MTD 1 7 This supports the prevention of unauthorized interference and destruction of FIA_UAU 2 5 lt Management of user ID gt The registration of user ID is limited only to the administrator by FMT_MTD 1 10 and when the external server authentication is used the user who is not registered in MFP is automatically registered with successful user authentication Moreover FMT_MTD 1 3 permits the modification operation only to the administrator This supports the prevention of unauthorized interference and destruction of FIA_UID 2 3 lt Management of account ID account name gt The registration of the account ID is permitted only to the administrator by FMT_MTD 1 12 And the modification operation is permitted only to the administrator by FMT_MTD 113 Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 106 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target Moreover the modification operation
142. inistrator password Overwrite deletion function of all area gt Initialization of the SNMP password Privacy password and Authentication password Overwrite deletion function of all area Accordingly this functional requirement is satisfied e FMT_SMR 1 1 FMT_SMR 1 1 regulates the role as the service engineer F SERVICE recognizes the user who is authenticated by the CE password as a service engineer Accordingly this functional requirement is satisfied e FMT_SMR 1 2 FMT_SMR 1 2 regulates the role as an administrator F ADMIN recognizes the user who is authenticated by the administrator password as an administrator FADMIN SNMP recognizes the user who is authenticated by the SNMP password Privacy password and Authentication password as an administrator Accordingly this functional requirement is satisfied e FMT_SMR 1 3 FMT_SMR 1 3 regulates the role as a user F USER recognizes the user who is authenticated by the user password as a user Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 127 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target The user who is authenticated as a user by F USER is recognized as a user similarly by succeeding to F BOX and F PRINT Accordingly this functional requirement is satisfied e FMT_SMR 1 4 FMT_SMR 1 4 regulates the role as a user who is permitted the use of the user box F BOX recognizes the user
143. ion after the operation ends and so O CONFIG is sufficiently supported Accordingly this threat is countered sufficiently 8 1 4 Sufficiency of Organizational Security Policies Security objective corresponding to organizational security policies is explained as follows e PCOMMUNICATION DATA secure communication of image file Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 82 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target This organizational security policies prescribes carrying out processing via trusted pass to a correct destination or encrypting to ensure the confidentiality about the image file which flows on a network O TRUSTED PASS offers the Trusted Channel to a correct destination in the transmition and reception of an image such as from MFP to PC or from PC to MFP for the user box file and the secure print file that is a confidential image so that the organizational security policies is achieved Also the security objective offers the transmission function to a correct destination by encrypting the user box file transmitted by e mail from MFP to PC by O CRYPTO MAIL so that the organizational security policies is achieved Furthermore O CONFIG restricts the Trusted Channel function setting data the management of the user box files encryption by e mail and the transmission address data to the administrator And then OE FEED BACK regulates
144. ion connection by ending the session after the panel automatic logoff time elapses by FTA_SSL 3 if it logs in from the panel The change in the panel auto logoff time is limited to the administrator by FMT_MTD 1 3 lt Management of administrator s authentication information gt FIA_SOS 1 1 verifies the quality of the administrator password Moreover FIA_SOS 6 verifies the quality of session information used to authenticate the administrator via the network and FIA_SOS 2 secures the quality of session information that is generated and used FMT_MTD 1 6 restricts the change in the administrator password to the administrator and the service engineer When the administrator changes the administrator password FIA_UAU 6 re authenticates it In this re authentication when the failure authentication reaches 1 3 times FIA_AFL 1 2 logoffs it if it s under authentication and releases the Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 95 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target authentication status of the administrator from then on And it locks all the authentication functions to use the administrator password The release function is executed by starting TOE with turning OFF and ON the power supply so that the lock is released after the administrator authentication lock time passed Moreover FMT_MTD 1 11 restricts the initialization of the administr
145. it 168 bit 256 bit KonicaMinolta KonicaMinolta HDD Encryption Key Generation 128 bit Encryption Algorithm SHA 1 specification standard FCS_COP 1 Cryptographic operations FCS_COP 1 1 The TSF shall perform lassignment list of Cryptographic operationsl in accordance with a specified cryptographic algorithm lassignment cryptographic algorithm and cryptographic key sizes lassignment cryptographic key sizes that meet the following lassignment list of standards lassignment list of standards Listed in Table Cryptographic operation Relation of Algorithm Key sizes Cryptographic operation lassignment cryptographic algorithm Listed in Table Cryptographic operation Relation of Algorithm Key sizes Cryptographic operation lassignment cryptographic key sizes Listed in Table Cryptographic operation Relation of Algorithm Key sizes Cryptographic operation lassignment list of cryptographic operation Listed in Table Cryptographic operation Relation of Algorithm Key sizes Cryptographic operation Hierarchical to No other components Dependencies FDP_ITC 1 or FCS_CKM 1 FCS_CKM 1 only a part of events FCS_CKM 4 N A FMT_MSA 2 N A Table 2 Cryptographic Operation Relation of Algorithm Keysizes Cryptographic Operation List of standards Cryptographic Cryptographic Contents of Cryptographic operation algorithm key sizes FIPS PUB 197 128 bit Encryption of S MIME t
146. ity Target raene lellel 11 1 lee 111 E et sotadmin ae eee E ara e Tae aa oereeo ARANA S SSAA SAANS SSS SSS SASSA SASA ANS SSS SSN orooro ANNAN ANA NANA NANA occ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN pa UA ERE AE N E lee tse omustenesss ITT TTT TT TTT ET EEE EE EE orusweox fe ele fefefe tol fol fo ell le foj oleo orawresox gt I TL ot TT ot et e onecstenenusen fel lef lel fol of fol llo Jel Je fol oleo Security Objective Security Functional Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 84 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target Security Objective 19W3a 0333 30 ulupees X a9InasJas X Security 43sn 0d3431SI0348 0 Functional Requirements FIA_NEW 1 FIALUAU 7 E _ 14 UE O cammorao P NAAAAAAAANAAAAANAANA 1 11 eei 1 leelo le 1 INN too LETT TT lle leje be A eee ol elel ol lo ee ee leo fol lero ee eel e e I xrono A ooo lel ooo romano AN lolol lo e le snwesunoaso eee eel lejeje Jojo Jo eno CORRE oarmsnoo ERE eee SEO ee PRONE sR ee A lej Note set admin and set service indicates the set of the requirements And the security objectives assumed to have the correspondence and presented by e also correspond to a s
147. ize access of subjects to objects based on the following additional rules assignment rules based on security attributes that explicitly authorize access of subjects to objects assignment rules based on security attributes that explicitly authorize access of subjects to objects A task to act for a user who has a administrator attribute is permitted to back up secure print file FDP_ACF 1 4 2 The TSF shall explicitly deny access of subjects to objects based on the assignment rules based on security attributes that explicitly deny access of subjects to objects assignment rules based on security attributes that explicitly deny access of subjects to objects None Hierarchical to No other components Dependencies FDP_ACC 1 FDP_ACC 1 2 FMT_MSA 3 FMT_MSA 3I 2 FDP_ACF 1 3 Security attribute based access control FDP_ACF 1 1 3 The TSF shall enforce the assignment access control SFP to objects based on the following lassignment list of subjects and objects controlled under the indicated SFP and for each the SFP relevant security attributes or named groups of SFP relevant security attributes lassignment list of subjects and objects controlled under the indicated SFP and for each the SFP relevant security attributes or named groups of SFP relevant security attributes lt Subject gt lt Subject attributes gt Task substituted for a user gt Administrator attributes CE attr
148. jects and the TSF data assignment list of object and list of TSF datal assignment List of object and list of TSF data lt Objects gt User Box file Secure print file On memory image file Stored image file Remaining image file Image related file Transmission addressee data file HDD lock password object Encryption passphrase object lt TSF data gt Administrator password SNMP password User ID e User password User Box password Secure print password Account ID Account password S MIME certificate Trusted Channel setting data Remaining TSF data Hierarchical to No other components Dependencies No dependencies Audit FNEW_RIP 1 Use including the information of user identification performing the explicit deletion operation Management FNEW_RIP 1 There is no foreseen management activity 5 1 2 Minimum Security Strength of Function The minimum strength of function level of the TOE is SOF Basic The required TOE security functions that use a probabilistic permutational mechanism are FIA_UAU 2I 1 FIA_UAU 2I2 FIA_UAU 2 3 FIA_UAU 2 4 FIA_UAU 2 5 FIA_UAU 2 6 FIA_UAU 6 FIA_SOS 1 1 FIA_SOS 1 2 FIA_SOS 1 3 FIA_SOS 1 4 FIA_SOS 1 5 FIA_SOS 1 6 FIA_SOS 1 7 and FIA_SOS 2 Cryptographic key generation algorithm of FMT_CKM 1 and cryptographic algorithm of FCS_COP 1 are not included in the object of the minimum strength of
149. llows 4 1 Security Objectives for the TOE In this section the security objectives for the TOE is identified and described O REGISTERED USER Utilization of registered user TOE permits only the registered user to user the MFP installing TOE O PRIVATE BOX Personal user box access control TOE permits only a user to use the user function of the personal user box which this user owns TOE permits only a user to use the user function of the use box file in the personal user box which this user owns O PUBLIC BOX Public user box access control TOE permits the registered user the reading operation of the public user box TOE permits the user function of the public user box only to the user who is permitted the use of this public user box TOE permits the user function of the user box file in the public user box only to the user who is permitted the use of this public user box O GROUP BOX Group user box access control TOE permits the user function of the group user box which this account owns only to the user who is permitted the use of this account TOE permits the user function of the user box file in the group user box which this account owns only to the user who is permitted the use of this account O SECURE PRINT Secure print file access control TOE permits the print of the secure print file only to the user who is permitted the use of this secure print file O CONFIG Access limitation to management function
150. lowing additional rules assignment rules based on security attributes that explicitly authorize access of subjects to objects assignment rules based on security attributes that explicitly authorize access of subjects to objects A task to act for the user that has a administrator attribute is permitted to operate displaying of user box list A task to act for the user that has a administrator attribute is permitted to operate the back up the user box file FDP_ACF 1 4 1 The TSF shall explicitly deny access of subjects to objects based on the assignment rules based on security attributes that explicitly deny access of subjects to objects assignment rules based on security attributes that explicitly deny access of subjects to objects None Hierarchical to No other components Dependencies FDP_ACC 1 FDP_ACC 1 1 FMT_MSA 3 FMT_MSA 3 1 FDP_ACF 1 2 Security attribute based access control FDP_ACF 1 1 2 The TSF shall enforce the assignment access control SFP to objects based on the following assignment list of subjects and objects controlled under the indicated SFP and for each the SFP relevant security attributes or named groups of SFP relevant security attributes lassignment list of subjects and objects controlled under the indicated SFP and for each the SFP relevant security attributes or named groups of SFP relevant security attributes lt Subject gt lt Subject at
151. ly Therefore the setting of MFP IP address etc is considered as subsidiary protected assets On the other hand when the stored data have physically been separated from the jurisdiction of a user such as the use of MFP ended by the lease return or being disposed or the case of an HDD theft a user has concerns about leak possibility of every remaining data Therefore in this case the following data files become protected assets e Secure Print File e User Box File e On Memory Image File gt Image file of job in the wait state e Stored Image File gt Stored image files other than secure print file and user box file e Remaining Image File gt The file which remains in the HDD data area that is not deleted only by general deletion operation deletion of a file maintenance area e File related to the Image gt Temporary data file generated in print image file processing e Transmission Address Data File gt File including E mail address and telephone numbers that become the destination to transmit an image Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 18 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target 3 2 Assumptions The present section identifies and describes the assumptions for the environment for using the TOE A ADMIN Personnel conditions to be an administrator Administrators in the role given to them will not carry out a malicious act
152. mes the user box file in secure Accordingly this functional requirement is satisfied o FNEW_RIP 1 FNEW_RIP 1 regulates that the object and the TSF data that are targeted in the explicit deletion operation can not be restored F OVERWRITE ALL deletes the user box file the secure print file the on memory image file the stored image file the remaining image file the image related file the transmission address data file the user ID the user password the user box password the secure print password the remaining TSF data the account ID the account password and the S MIME certificate by performing the overwrite deletion to all area of HDD by means of the specified method of overwrite deletion In addition it initializes the NVRAM administrator password and the SNMP password and sets OFF the operations of the HDD lock function and the Encryption function Moreover it deletes the setting data of the Trusted Channel function Accordingly this functional requirement is satisfied e FIA_NEW 1 FIA_NEW 1 regulates the user identification before TSF takes any action to the user F HDD provides the function to check the HDD status if HDD lock password is set and if the HDD lock password is not set it doesn t perform the process of writing and reading to HDD Accordingly this functional requirement is satisfied 8 3 2 Rational for TOE Security Strength of Function The TOE security functions having a probabilistic permutational mechanism are
153. mpts has been met or surpassed the TSF shall lassignment list of actions lassignment list of actions lt Action when it is detected gt Log off from the authentication status of the user box fit is and lock the authentication function for the concerned user box lt Operation for recovering the normal condition gt Perform the delete function of authentication failure frequency offered within the administrator mode Hierarchical to No other components Dependencies FIA UAU 1 FIA_UAU 2 5 FIA_AFL 1 7 Authentication failure handling Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 34 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target FIA_AFL 1 1 7 The TSF shall detect when selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values unsuccessful authentication attempts occur related to lassignment list of authentication events lassignment list of authentication events Account authentication Account authentication when the belonging account of the user who accesses in the synchronized method is not registered Account authentication Account authentication of the user who accesses in the method not synchronized selection assignment positive integer number an administrator configurable positive i
154. n Part 2 Security Functional Requirements Version 2 3 August 2005 CCMB 2005 08 002 December 2005Translation Version 1 0 Information technology Promotion Agency Japan Security Center Information Security Certification Office Common Criteria for Information Technology Security Evaluation Part 3 Security Assurance Requirements Version 2 3 August 2005 CCMB 2005 08 003 December 2005 Translation Version 1 0 Information technology Promotion Agency Japan Security Center Information Security Certification Office CCMB Interpretations 0512 December 2005 Information technology Promotion Agency Japan Security Center Information Security Certification Office 1 4 ST Overview bizhub C550 bizhub C451 ineo 550 ineo 451 is Konica Minolta Business Technologies Inc digital MFP comprised by selecting and combining copy print scan and FAX functions Hereafter MFP as all these generic names The target of evaluation TOE of this Security Target ST is the bizhub C550 bizhub C451 ineo 550 ineo 451 that controls the entire operation of MFP including the operation control processing and the image data management that are accepting from the panel of the main body of MFP or through the network This ST explains the security functions that are realized by the TOE TOE offers the protection from exposure of the highly confidential document stored in the MFP Moreover TOE can encrypt the image data written in HDD for the danger of
155. n for accessing the MIB object through SNMP selection assignment positive integer number an administrator configurable positive integer within assignment range of acceptable values assignment range of acceptable values an administrator configurable positive integer within 1 3 FIA_AFL 1 2 3 When the defined number of unsuccessful authentication attempts has been met or surpassed the TSF shall lassignment list of actions lassignment list of actions lt Action when it is detected gt Deny the access to the MIB object and lock the authentication function to use SNMP password lt Operation for recovering the normal condition gt Perform the delete function of authentication failure frequency offered within the administrator mode Hierarchical to No other components Dependencies FIA_UAU 1 FIA_UAU 2 2 FIA_AFL 1 4 Authentication failure handling FIA_AFL 1 1 4 The TSF shall detect when selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values unsuccessful authentication attempts occur related to assignment list of authentication events lassignment list of authentication events Authentication for accessing the TOE by user selection assignment positive integer number an administrator configurable positive integer within assignment range of acceptable values assignm
156. n it is re authenticated as an administrator and the new password satisfies the quality it is changed gt Offers the HDD lock password verification mechanism that verified the HDD lock password that consists of the character shown in Table 8 gt Return in verification for each character as feedback for the entered HDD lock password gt Verify the HDD lock password newly set if the following qualities are satisfied It is composed of the characters and by the number of digits shown in Table 8 It shall not be composed of one kind of character It shall not be matched with the current value Operation setting of encryption function When an optional encryption board is installed to MFP it can be operated lt Operation Setting ON gt When turning it ON from OFF it verifies that the encryption passphrase newly set satisfies the following qualities and F CRYPT is performed gt It is composed of the characters and by the number of digits shown in Table 8 gt It shall not be composed of one kind of character lt Encryption Passphrase Change gt Change the encryption passphrase By using the encryption passphrase currently set when it is re authenticated as an administrator and the new encryption passphrase satisfies the quality F CRYPT is performed gt Offers the encryption passphrase verification mechanism that verified the encryption passphrase that consists of the character shown in Table 8
157. n operation of the administrator password and the SNMP password that is performed along with the execution of the overwrite deletion operation of all area in the administrator mode FSERVICE permits the initialization operation of the administrator password and the SNMP password which is performed along with the execution of the initializing function in the service mode Accordingly this functional requirement is satisfied e FMT_MTD 1 12 FMT_MTD 1 12 regulates the management of the account ID the account password the S MIME certificate the transmission address data and the setting data of the trusted channel function Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 124 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target F ADMIN permits the registrations operation of the account ID the account password the S MIME certificate the transmission address data and the setting data of the trusted channel function in the administrator mode Accordingly this functional requirement is satisfied e FMT_MTD 1 13 FMT_MTD 1 13 regulates the management of the belonging account F ADMIN permits the registration setting operation of the belonging account related with the user in the administrator mode F USER sets the concerned account as the belonging account of user by the authentication success when a user is authenticated as the user who is permitted the use of
158. n that is available in the administrator mode Accordingly this functional requirement is satisfied e FIA_AFL 1 7 FIA_AFL 1 7 regulates the action for the authentication failure to the account authentication In case that the account authentication is operated when the user accesses the authentication failure of failure frequency threshold 1 3 times that the administrator sets is detected so that FUSER locks the authentication function of the concerned account from then on F ADMIN clears the authentication failure frequency and releases the lock status by the lock release function that is available in the administrator mode Accordingly this functional requirement is satisfied e FIA_AFL 1 8 FIA_AFL 1 8 regulates the action for the authentication failure to the various authentication on the panel F SERVICE rejects all input receipts from a panel when the authentication failure is detected in the authentication of service engineer for accessing the service mode F ADMIN rejects all input receipts from a panel when the authentication failure is detected in the administrator authentication for accessing the administrator mode F USER rejects all input receipts from a panel when the authentication failure is detected in the user authentication for the access of user from a panel Moreover it rejects all input receipts from a panel when the authentication failure is detected in the account authentication from a panel F BOX rejects all inp
159. ncies E No dependencies FIA_SOS 1 7 Verification of secrets FIA_SOS 1 1 3 The TSF shall provide a mechanism to verify that secrets User Box Password Account Password meet assignment a defined quality metric lassignment a defined quality metric Number of digits 8 digits Character type ASCII code 0x20 Ox7E Rule Do not composed by only the same kind of character strings Hierarchical to No other components Dependencies No dependencies FIA_SOS 2 TSF Generation of secrets FIA_SOS 2 1 The TSF shall provide a mechanism to generate secrets Session information that meet lassignment a Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 37 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target defined quality metric lassignment a defined quality metric 10 and above FIA_SOS 2 2 The TSF shall be able to enforce the use of TSF generated secrets for lassignment list of TSF functions lassignment list of TSF functions e Administrator authentication Access through the network e User authentication Access through the network User box authentication Access through the network Hierarchical to No other components Dependencies No dependencies FIA_UAU 2 1 User authentication before any action FIA_UAU 2 1 1 The TSF shall require each user
160. nction in the printing operation by the PC removes the possibility that other users stole a glance at the printing of high leveled confidential data and lost it into the other printings 2 5 2 User Box Function The directory named user box can be created as an area to store the image file in HDD Three types of user box exist the first is the personal user box which a user possesses the second is the public user box which the registered user making a group within a certain number uses jointly and the third is the group box which the users belong to same account uses jointly As for the personal user box the operation is limited only for the user who owns it the public user box performs access control by sharing a password set to the user box among users and group box the operation is limited only for the user who the use of the account is permitted TOE processes the following required operation against the user box or the image file in a user box for an operation requests that is transmitted from the panel or the network unit through a network from a client PC O Print transmission and download from client PC of image file in a user box gt The encryption of box file is possible in the E mail that is one of the transmission methods e Deletion of the image file in the user box and move and copy to other user boxes O Storage period setting of image file in user box Delete automatically after the period passes O Change of user
161. neral it is assumed that the person elected from the employees in the office plays this role O Service Engineers A user who performs management of maintenance for the MFP Service Engineer performs the repair and adjustment of MFP In general the person in charge at the sales companies that performs the maintenance service of MFP and is in cooperation with Konica Minolta Business Technologies Inc is assumed O Person in charge at the Organization that uses the MFP A person in charge at the organization that manages the office where the MFP is installed This person assigns an administrator who carries out the management of the operation of the MFP O Person in charge at the Organization that manages the Maintenance of the MFP A person in charge at the organization that carries out management of the maintenance for the MFP This person assigns service engineers who perform the maintenance management for the MFP Besides this though not a user of TOE a person who goes in and out the office are assumed as an accessible person to TOE 2 5 Functions provided by the TOE 2 5 1 A User uses a variety of functions of the TOE from the panel and a client PC via the network The following explains typical functions such as the basic function the user box function to manage the image files stored the user identification and authentication function the administrator function manipulated by administrator the service engineer function manip
162. nment access control SFP information flow control SFP to provide selection choose one of restrictive permissive lassignment other property default values for security attributes User attributes of the user box that are used to enforce the SFP selection choose one of restrictive permissive lassignment other property assignment other property Responded the registered situation of the user box classified into the following cases Public when an user box is registered by the operation of user or administrator O User ID of the user who performed the relevant job when an user box is registered automatically according to the operation of stored job specifying unregistered user box lassignment access control SFP information flow control SFP User box access control FMT_MSA 3 2 1 The TSF shall allow the lassignment the authorized identified rolesl to specify alternative initial values to override the default values when an object or information is created lassignment the authorized identified roles Case UD identified in assignment other property of FMT_MSA 3 1 User Case identified in lassignment other property of FMT_MSA 3 1 None Hierarchical to No other components Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 43 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target Dependencies F
163. nnninnnnnonncinnc enea 56 6 1 2 FADMIN SNMP SNMP administrator fUNCiION oooonnonnininnnnnnnninninnnnnn 64 6 1 3 FSERVICE Service Mode function oooononioninniniinninncin aere aE AE E aa EAEE p Ea ea EER 65 6 14 FUSER User Func Sess e r ar a tah Net ce soit aa Ne te tk a ea ee 67 6 1 5 BOX USERBOX FUNCION tte 69 Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 3 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target 7 8 6 1 6 F PRINT Secure PINE FUNCHION sucess See eA id id 72 6 1 7 FOVERWRITE ALL All area overwrite deletion function woe eeeececeteeteeteeteetetneteeceeeeeesesetiesieteeseeeeeeenenietaeey 73 6 1 8 CRYPT Encryption key generation function ooooonioiiinninnnnininnnnnciccnannnr een 73 6 1 9 FHDD HDD verification function ooo 74 6 1 10 FRESET Authentication Failure Frequency Reset Function 2 c cccccccceseeesscenseenseeseeeeesseseeesnseseeenetanes 74 6 1 11 F TRUSTED PASS Trust Channel Function ooooconiocnniniconccnnnnacnonccnoncnnancc non ronca 74 6 1 12 F S MINE S MINE Encryption Processing FUNCTION cccscccesseceseeceneeeeeeceneeeseeeeseeeeeeeseaeeeseaeeeneeeseneeentens 74 6 2 TOE Security Strength of F nctioN aru tenet ty AH nen e ited ete 75 6 3 Correspondence between TOE Security Functions and Function Requirements 000 75 6 4 ASSUPANCE Measures miii dada 75 A AATE 77 RatoNal usina ras 7
164. nteger within assignment range of acceptable values assignment range of acceptable values an administrator configurable positive integer within 1 3 FIA_AFL 1 2 7 When the defined number of unsuccessful authentication attempts has been met or surpassed the TSF shall assignment list of actions lassignment list of actions lt Action when it is detected gt Lock the authentication function for the concerned account and deny the access to the TOE by the user who permitted the use of the account lt Operation for recovering the normal condition gt Perform the delete function of authentication failure frequency offered within the administrator mode Hierarchical to k No other components Dependencies FIA_UAU 1 FIA_UAU 2 6 FIA_AFL 1 8 Authentication failure handling FIA_AFL 1 1 8 The TSF shall detect when selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values unsuccessful authentication attempts occur related to assignment list of authentication events lassignment list of authentication events Authentication when it accesses service mode Authentication when it accesses administrator mode from the panel User authentication when user accesses TOE from the panel Account authentication when user accesses TOE from the panel Authentication when it accesses secure print file Authentication when it access
165. ntication attempts has been met or surpassed the TSF shall lassignment list of actions lassignment list of actions lt Action when it is detected gt Log off from the authentication status of the service mode if it is and lock the authentication function which uses the CE password If it s not under the authentication status lock the authentication function which uses the CE password lt Operation for recovering the normal condition gt Perform the lock release function of CE authentication by specific operation When CE authentication lock time passed from specific operation the release process is performed Hierarchical to No other components Dependencies FIA _UAU 1 FIA_UAU 2I 1 FIA_AFL 1 2 Authentication failure handling FIA_AFL 1 1 2 The TSF shall detect when selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values unsuccessful authentication attempts occur related to lassignment list of authentication events lassignment list of authentication events e Authentication for accessing the administrator mode Re authentication for changing the administrator password selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values assignment range of acceptable values an administrator configurable positive in
166. o 451 Control Software Security Target The TSF shall require each user User who is permitted to use the public user box to be successfully authenticated before allowing any other TSF mediated actions on behalf of that user User who is permitted to use the public user box Hierarchical to 3 FIA_UAU 1 Dependencies E FIA_UID 1 FIA_UID 2 5 FIA_UAU 2 6 User authentication before any action FIA_UAU 2 1 6 The TSF shall require each user User who is permitted to use the account to be successfully authenticated before allowing any other TSF mediated actions on behalf of that user User who is permitted to use the account Hierarchical to FIA_UAU 1 Dependencies FIA_UID 1 FIA_UID 2 6 FIA_UAU 6 Re authenticating FIA_UAU 6 1 The TSF shall re authenticate the use under the conditions lassignment list of conditions under which re authentication is required lassignment list of conditions under which re authentication is required When the administrator modifies the administrator password When the service engineer modifies the CE password When the administrator changes the HDD lock setting When the administrator changes the Encryption function setting Hierarchical to No other components Dependencies No dependencies FIA_UAU 7 Protected authentication feedback FIA_UAU 7 1 The TSF shall provide only assignment list of feedback to the
167. o the same requirement a user ID of the user who executes a job concerned is appointed automatically lt Necessary requirement to keep the administrator secure gt refer to set admin lt Necessary requirement to keep the service engineer secure gt gt refer to set service lt Role and controlling function for each management gt As the role of doing these managements FMT_SMR 1 2 maintains an administrator and FMT_SMR 1 3 maintains a user permitted the use of the user box FMT_SMF 1 specifies these management functions This security objective is satisfied by the completion of these multiple functional requirements e O PUBLIC BOX a public user box access control This security objective permits the inspection of the public user box to all users and limits the setting of the public user box and the operation of the user box file in the public user box only to the user who permitted the utilization of that public user box And it needs the various requirements that related to the access control Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 87 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target lt User box access control a public user box gt FDP_ACC 1 1 and FDP_ACF 1 1 permits the list display operation to the user box where public is set to the user attribute to the task of acting the user who has user ID It is required to be a u
168. o user box gt As for FDP_ACF 1 1 that regulates the user box access control the by pass prevention is supported by FIA _UAU 2 3 that regulates the authentication of the user FIA_UAU 2I6 that regulates the account authentication FIA_UAU 2 5 also contributes to the by pass prevention of FDP_ACF 1 1 for the access to the public user box In addition because FIA UAU 2 3 that regulates the authentication of the user FIA_UAU 2 6 that regulates the account authentication and FIA_UAU 2 5 that regulates the authentication of the user who is permitted the use of the public user box are called by FPT_RVM 1 without fail and so the by pass prevention is supported lt By pass prevention of functional requirement that relates to secure print gt As for FDP_ACF 1 2 that regulates the secure print file access control the by pass prevention is supported by FIA_UAU 2 3 that regulates the authentication of the user Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 104 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target FIA_UAU 2 6 that regulates the account authentication and FIA_UAU 2 4 that authenticates the authorized user to use the secure print file In addition because FIA_UAU 2 3 that regulates the authentication of the user FIA_UAU 2 6 that regulates the account authentication and FIA_UAU 2 4 that regulates the authentication of the authorized user to use
169. of leaking information from MFP collected from the user O OVERWRITE ALL is that TOE offers the function to overwrite data for the deletion to all area of HDD and initializes the information of NVRAM so that the possibility of the threat is removed by executing this function before MFP is collected Accordingly this threat is countered sufficiently e T BRING OUTSTORAGE Unauthorized taking out of HDD This threat assumes the possibility that the image data in HDD leaks by being stolen from the operational environment under MFP used or by installing the unauthorized HDD and taking away with the data accumulated in it For the above the possibility of the threat is removed because at least either of the following two measures is selected by the administrator MO CRYPT KEY generates the encryption key for TOE to encrypt data to be written in HDD and the encryption board encodes data by OE CRYPT QOE LOCK HDD doesn t permit to read data from any other MFP as a function of the HDD but the MFP where this HDD is installed In the above mentioned when only is selected danger of leaking exists by taking out the another HDD without the function of having been secretly replaced For the above because the validity of HDD installed by TOE is verified by O CHECK HDD data is not written in the HDD replaced secretly The possibility of the threat is removed consequently Accordingly this threat is countered sufficiently e T ACCESS PRIVATE BOX Unaut
170. of the belonging account of user is permitted only to the administrator by FMT_MTD 1 3 This supports the prevention of unauthorized interference and destruction of FIA_UAU 2I6 lt Management of setting data for the external server authentication gt The setting of the external server authentication setting data used for the external server authentication is permitted only to the administrator by FMT_MTD 1 10 This supports the prevention of unauthorized interference and destruction of FIA_UID 2 7 lt Management of auto logoff time gt FMT_MTD 1 3 permits the modification operation of the panel auto logoff time only to the administrator This supports the prevention of unauthorized interference and destruction of FTA_SSL 3 lt Management of authentication failure frequency threshold gt The modification operation of the authentication frequency failure threshold which is set in all the authentication activities such as the service engineer authentication the administrator authentication the user authentication the secure print authentication the user authentication and the MIB object access authentication is permitted only to the administrator by FMT_MTD 1 3 This supports the prevention of unauthorized interference and destruction of FIA_AFL 1 1 FIA _AFL 1 2 FIA _AFL 1 3 1 FIA_AFL 1 4 FIA_AFL 1 5 FIA_AFL 1 6 FIA_AFL 1 7 lt Management of trusted channel function gt The registration of the trusted channel functi
171. on setting data is restricted only to the administrator by FMT_MTD 1 12 Also the modification operation is permitted only to the administrator by FMT_MTD 1 3 This supports the prevention of unauthorized interference and destruction of FTP_ITC 1 lt Management of CE authentication lock time gt The setting of the CE authentication lock time is permitted only to the service engineer by FMT_MTD 1 9 This supports the prevention of unauthorized interference and destruction of FIA_AFL 1 2 lt Management of administrator authentication lock time gt The setting of the administrator authentication lock time is permitted only to the service engineer by FMT_MTD 1 3 This supports the prevention of unauthorized interference and destruction of FIA_AFL 1 1 lt Management of S MIME certificate gt The registration of the S MIME certificate is restricted only to the administrator by FMT_MTD 1 12 Also the modification operation is permitted only to the administrator by FMT_MTD 1 3 This supports the prevention of unauthorized interference and destruction of FCS_CKM 1 FCS_COP 1 3 Deactivation Prevention lt Maintenance of Enhanced Security function gt Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 107 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target FMT_MOF 1 1 permits only to the administrator and the service engineer the operation setting of
172. oncnnancncncn cancer cnn 131 8 3 4 Rationale for Assurance MeasureS oooniicinnnicinnnniccnnncccccnercc rr 131 9 4 PP Calis rationale x acerca nidad anida 131 List of Figures Figure 1 An example of the expected environment for usage of the MFP ooooonccccnnonccccnonanccnnannnnno 8 Figure 2 Hardware composition that relates to TOE oonoonnncccnnnccnnonaninanacinanananna nana na nana nanancncnnanann 9 List of Tables Table 1 Cryptographic Key Generation Relation of Standards Algorithm Key sizes 27 Table 2 Cryptographic Operation Relation of Algorithm Keysizes Cryptographic Operation 27 Table 3 User Box Access Control Operational LiSt ooonooocnnnnnncccnnnoocccononncnconananncnnnnnnnnnonnnrnncnnnnno nc 28 Table 4 Secure Print File Access Control Operational LiSt oooocononcccnnnoccccnnacaccnnnnarnnconananncnnann nc 28 Table 5 Setting Management Access Control Operational List ooooococnnoniniccccccconcnccanananaccncncncnnnns 29 Table 6 TOE Security Assurance Requirements oooccccoooccccnonocccnnnnanncnonnnnnnonnn conc cnn n narco nn r nan ncnrnnnnnno 54 Table 7 The list of the name and identifier of TOE Security function 56 Table 8 character and number of digits used for PAssWOTO ooooocccconococinonaccnonanancnnnonannnncnnnnoncnnnnnn nc 57 Table 9 A type of overwrite deletion of all area and the method of overwriting ceeeee 60 Table 10 Correspondence between TO
173. oration operation and so it is possible to browse the SNMP password the User password the User box password the Secure Print password and the account password by means of the back up data which is acquired by back up operation Accordingly this functional requirement is satisfied e FMT_MTD 1 8 FMT_MTD 1 8 regulates the management of the Secure print password F PRINT permits the registration of the secure print password to the user along with the registration of the secure print file Accordingly this functional requirement is satisfied e FMT_MTD 1l9 FMT_MTD 1 9 regulates the management of the CE password and the CE authentication lock time F SERVICE permits the change operation of the CE password and the CE authentication lock time in the service mode Accordingly this functional requirement is satisfied e FMT_MTD 1 10 FMT_MTD 1 10 regulates the management of the user ID F ADMIN permits the registration of the user ID in the administrator mode FUSER registers the user ID of the authenticated user when the External server authentication is selected for the user authentication method and if the user who succeeds in the user authentication is not registered in the MFP This is equal to the registration to an external server Accordingly this functional requirement is satisfied e FMT_MTD 1 11 FMT_MTD 1 11 regulates the management of the administrator password and the SNMP password F ADMIN permits the initializatio
174. ovide a mechanism to verify that secrets Administrator Password CE Password meet lassignment a defined quality metricl lassignment a defined quality metric Number of digits 8 digits Character type ASCII code 0x21 Ox7E except 0x22 and0x2B Rule OD Do not composed by only the same kind of character strings Do not set the same password as the current setting Hierarchical to No other components Dependencies No dependencies FIA_SOS 1 2 Verification of secrets FIA_SOS 1 1 2 The TSF shall provide a mechanism to verify that secrets SNMP Password meet lassignment a defined quality metricl lassignment a defined quality metric e Number of digits 8 digits or more Character type ASCII code 0x20 0x7E Hierarchical to No other components Dependencies No dependencies FIA_SOS 1 3 Verification of secrets FIA_SOS 1 1 3 The TSF shall provide a mechanism to verify that secrets User Password meet assignment a defined quality metric lassignment a defined quality metric Number of digits 8 digits or more Character type ASCII code 0x20 Ox7E Rule Do not composed by only the same kind of character strings Hierarchical to No other components Dependencies No dependencies FIA_SOS 1 4 Verification of secrets Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 36 131
175. ox attribute of the subject attribute to do the printing the E mail transmission include the S MIME transmission the FTP transmission the fax transmission the SMB transmission download the movement to other user boxes and the copy operations to other user boxes e User attribute change of a public user box The user attribute of the user box can be changed gt Specify the registered user And change to a personal user box for the registered user gt Specify the account ID and then it becomes a group user box that can be accessed by a user who is permitted the use of the concerned account Change of a public user box password Change the user box password of the public user box When the user box password newly set satisfies the following qualities it is changed gt Itis composed of the characters and by the number of digits shown in Table 8 gt It shall not be composed of one kind of character 6 1 5 3 Group User Box Function aAccess control function for Group User Box The task to act for the identified and authenticated user has the Account ID as the Account Name that is related to the identified and authenticated user This task is permitted the display of the list of the group user box which has a corresponding user attribute with this account ID Access control function to a user box file in a group user box When the user box to operate is selected User Box ID of the user box is related to the task as a user box
176. perates other security functional requirements validly Bypass Prevention FPT_RVM 1 FPT_RVM 1 FPT_RVM 1 z z z z 2 z Z SISISISIS S S S N N A N A N A N A N A N A z gt a z A gt Z z z z gt gt z gt Z Z2 Z Z Ziz 2122 2 a z ez a Z H Ple zz a Z H ele N A N A Z gt zzz gt gt gt z eye alza 2 gt gt gt gt N gt lInterference Destruction Prevention MT_MTD 1 7 FMT_MTD 1 3 FMT_MTD 1 7 MT_MTD 1 12 Z Z gt e zZ 5 lt x ele z un Z Z MT_MTD 1 10 Z gt z gt ele S H un FMT_MTD 1 3 FMT_MTD 1 12 FMT_MTD 1 3 N A VA N A VA VA VA VA VA VA N A N A N A N A N A N A N A N A N A N A N A N A Z e z zz gt gt z gt 103 131 Deactivation Prevention FMT MOF 1 1 FMT MOF 1 1 H S s 3 gjaja sjala ele Sls en en ee E 0 oS BEER IRIE jejeje El S TE w Hm z S al E E m m m a e g A Z gt s S sS 3 3 13 3 3 Re ela ty Z a Z H Salas tj Z a z so m SIS S S 5 S 3 3 3 3 m ua m z SAE Bele z z S INE E 1050 ve LA r FT E apa aji 8 8 8828 28 a Sra EB Eg a a a a a e a el a z A ee Disabling Detection bizhub C550 bizhu
177. permits only the administrator the setting modification of the threshold of the Authentication failure frequency which is the trial frequency of the failure authentication in the user authentication FIA_SOS 1 6 secures the quality verification of the session information used in the user authentication via the network and FIA_SOS 2 secures the quality of the session information which is generated and used lt Necessary requirements for managing session of user who is identified and authenticated gt The duration of session of the user who is identified and authenticated contributes to reduce the chance of attacking associated with unnecessary session connection by ending the session after the panel automatic logoff time elapses with FTA_SSL 3 when it logs in from the panel The change in the panel auto logoff time is limited to the administrator by FMT_MTD 1 3 lt Necessary requirement for managing the identification and authentication information of the user gt When the machine authentication is chosen in a method of the user authentication by FMT_MTD 1 1 the initial registration of a user password in the user s registration is permitted only by the administrator When the machine authentication has been selected in the method of the user authentication the registration of the user ID in the user registration is permitted to the administrator by FMT_MTD 1 10 When the external server authentication has been selected in the
178. pyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 119 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target Accordingly this functional requirement is satisfied e FIA UID 2 7 FIA_UID 2 7 regulates the identification of the external server F USER identifies the external server which is accessed for the inquiry of user information when the external server authentication is selected for the user authentication method Accordingly this functional requirement is satisfied e FIA USB 1 FIA_USB 1 regulates the security attribute association to subject that substitutes the user F PRINT associates the secure pint internal control 1D of the concerned secure print file to the task of substituting the user when authenticated for the access to the secure print file F BOX associates the User Box ID of the concerned user box or the concerned user box file to the task of substituting the user when authenticated for the access to the user box or the user box file F USER associates the Account ID to the task of substituting the user in the case that the account authentication is the method not synchronized when authenticated for the account and in the case that the account authentication is the synchronized method when authenticated for the user Accordingly this functional requirement is satisfied e FMT_MOF 1 1 FMT_MOF 1 1 regulates the behavior management of the enhanced secu
179. quired Account Name is associated with the user ID if succeeding the account authentication and the use of F BOX and F PRINT is permitted to the user who is identified and authenticated e Offers account authentication mechanism that is authenticated the account by the account password that consists of the characters shown in Table 8 for each character as feedback for the entered account password Return Resets the number of authentication failure when succeeding in the authentication Not accept the access from the panel for five seconds when the authentication failed When the authentication failure that becomes 1 3 times at total for the concerned account is detected it locks all the authentication functions to the account gt The administrator specifies the failure frequency threshold by the unauthorized access detection threshold setting function The lock of the authentication function is to perform the lock release function to the concerned account of FADMIN When accessing from a network the account is not authenticated after the user authentication but the user and the account are processed with one sequence When authenticating the account the account ID is associated with the user ID and the user ID and the account ID are measured by the session information which is the same as user identification and authentication in the account authentication the synchronized method lt Automatic registration of the User ID gt
180. quired by back up operation and to change user ID a SNMP password the panel auto logoff time the failure number of times threshold a secure print password the setting data of the external server authentication the account ID the account password the S MIME certificate the transmission address data the setting data of the trusted channel function the belonging account of user and the administrator authentication lock time as a result of performing the restoration operation F ADMIN SNMP permits the change operation of the SNMP password to the administrator authenticated by the SNMP password Accordingly this functional requirement is satisfied e FMT_MTD 1 4 FMT_MTD 1 4 regulates the management of the user box password F ADMIN permits the change operation of the user box password that is set to the public user box in the administrator mode In addition FADMIN permits the administrator the back up and restoration operation and so it is possible to change the back up data which is acquired by back up operation and to change the user box password as a result of performing the restoration operation F BOX permits the change operation of the user box password to the authenticated user as the user who is permitted the use of the user box concerned Accordingly this functional requirement is satisfied e FMT_MTD 1 5 FMT_MTD 1 5 regulates the management of the user box password F ADMIN permits the registration operation of the user box
181. ransmission data 192 bit 256 bit SP800 67 3 Key Triple DES 168 bit Encryption of S MIME transmission data FIPS 186 1 RSA 1024 bit Encryption of cryptographic key to encrypt 2048 bit S MIME transmission data 3072 bit 4096 bit Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 27 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target 5 1 1 2 User data protection FDP_ACC 1 1 Subset access control FDP_ACC 1 1 1 The TSF shall enforce the lassignment access control SFP on lassignment list of subjects objects and operations among subjects and objects covered by the SFP lassignment list of subjects objects and operations among subjects and objects covered by the SFP Listed in Table3 User box access control operational list lassignment access control SFP User Box access control Hierarchical to No other components Dependencies FDP_ACF1 FDP_ACF1 1 Table 3 User Box Access Control Operational List Sub ject Ob ject Operational List A task to act for a user A List of user boxes User Box File Print Transmission E mail transmission FTP transmission SMB transmission and FAX transmission Download Move to other user boxes e Copy to other user boxes Backup FDP_ACC 1 2 Subset access control FDP_AGC 1 1 2 The TSF shall enforce the assignment access control SFP on lassignment
182. related especially to the behavior of the security function O Authentication setting of the service engineer with the CE password gt Select ON or OFF O Setting of remote diagnostic function later description gt Able to select permission or prohibition O Setting of a TOE update function via Internet gt Able to select permission or prohibition O Setting of maintenance function gt Able to select permission or prohibition e The format function of HDD gt Alogical format and a physical format are executable O Installation setting of HDD gt An explicit installation setting is necessary to use HDD as a data storage area gt When the installation setting done a logical format is executed e Initialization function gt The various setting values that the user or the administrator has set and the data that the user has stored are deleted 2 5 7 Other Functions TOE provides the functions that run background without awareness of the user and the updating function of TOE The following explains the major functions Encryption key generation function When the encryption board an optional product is installed in MFP controller the encoding and decoding is processed on the encryption board due to the reading and writing data in HDD TOE does not process the encryption and description itself The operation setting of this function is performed by the administrator function When it operates TOE generates the encryption key
183. rength level that is required by security objective Refer to chapter 6 TOE summary specification for the description related to this algorithm This security objective is satisfied by the completion of these multiple functional requirements Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 93 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target e O CHECK HDD Validity confirmation of HDD This security objective regulates that it verifies the validity of HDD in order to confirm the unauthorized HDD doesn t exist and needs various requirements that relate to the verification of an external entity from TOE FIA_NEW 1 identifies HDD before the action from TOE to HDD and cancels the scheduled action when the identification fails This security objective is satisfied by the completion of this function requirement e O TRUSTED PASS Usage of Trusted Channel This security objective generates the Trusted Channel in the transmission and reception such as a user box file and a secure print file and the requirement that relates with the Trusted Channel is necessary FTP_ITC 1 generates the Trusted Channel according to the requirement from the remote Trusted IT product and it is applied to the transmission and reception such as the user box file and the secure print file This security objective is satisfied by the completion of this function requirement e O CRYPTO MAIL Usag
184. rity function F ADMIN provides the settings of the enhanced security function in the administrator mode and manages the stop operation of the concerned function In addition although it is possible to change the back up data acquired by back up operation and to set off the Enhanced Security function as a result of performing the restoration operation F ADMIN limits the back up and restoration operation only to the administrator Although the execution of the HDD logical format and the overwrite deletion function of all area makes the Enhanced Security setting invalid F ADMIN permits the operation only to the administrator F SERVICE offers the HDD logical format function HDD physical format function the HDD installation setting function and the initialization function to make the Enhanced Security function invalid in the service mode along with execution and manages the setting off operation of the Enhanced Security function Accordingly this functional requirement is satisfied e FMT_MOF1l2 FMT_MOF 1 2 regulates the behavior management of the Trusted Channel function the S MIME function the user authentication and the SNMP password authentication F ADMIN offers a setting function of the user authentication function a setting function of the encryption method of the Trusted Channel function a setting function of the encryption method of the S MIME function in the administrator mode and permits the setting of the operational mode for each f
185. rmation O Reset the authentication failure frequency if it succeeds in authentication gt In the case of both the Privacy password and the Authentication password are used the authentication failure frequency is reset only when both passwords together succeeded in the authentication When the authentication failure that becomes the 1 3 times at total in each authentication function by using the SNMP password is detected all the authentication functions to use the SNMP password are locked The access to the MIB object is refused gt The administrator specifies the failure frequency threshold by the unauthorized access detection threshold setting function gt In the case of both the Privacy password and the Authentication password are utilized even though both passwords together fails in authentication it is detected as one failure e To release the lock the lock release function to the MIB object of FADMIN is performed or the F RESET function operates e The lock status is released when the lock release function to the MIB object of F ADMIN is performed 6 1 2 2 Management function using SNMP When it is identified and authenticated that the user is an administrator by the SNMP password the access to the MIB object is permitted and then the operation of the setting data shown as followings is permitted to be done Q Network Settings Setting operation of the following setting data is performed gt Setting data that relates
186. rolled operations on controlled objects lassignment rules governing access among controlled subjects and controlled objects using controlled operations on controlled objects lt Operation control to Personal user box gt A task to act for a user is permitted to do the list display operation to the user box with the user attribute user ID of an object attribute corresponding to the user attribute user ID of the subject attribute lt Operation control to user box file in Personal user box gt A task to act for a user is permitted to print transmit E mail transmission FTP transmission SMB transmission and FAX transmission download move to other user boxes and copy to the other user boxes to the user box file that have the matched user attributes User ID and user box attribute user box ID of the object attribute with the user attributes User ID and user box attribute user box ID of the subject attribute lt Operation control to Group user box gt A task to act for a user is permitted to do the list display operation to the user box with the Account The MFP address group object is a series of data concerning the address of the main body of MFP such as IP address and the Appletalk printer name Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 29 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target Name account ID of an objec
187. ry requirement to keep administrator secure set admin the set of necessary requirement to keep service engineer secure set service gt set admin Set of necessary requirement to keep administrator secure lt Identification and Authentication of an administrator gt FIA_UID 2 2 and FIA_UAU 2 2 identifies and authenticates that the accessing user is a administrator FIA_UAU 7 returns for each character entered as feedback protected in the panel and supports the authentication FIA_AFL 1 8 refuses in case of the failure authentication tried from the panel all the input receipts from the panel for five seconds in every failure When the failure authentication reaches 1 3 times FIA_AFL 1 2 logoffs if it s under authentication and locks all the authentication functions that use the administrator password from then on The release function is executed by starting TOE with turning OFF and ON the power supply so that the lock is released after the administrator authentication lock time passed FMT_MTD 1 3 permits only to the administrator the setting of the threshold of the authentication failure frequency which is the trial frequency of the failure authentication in the administrator authentication lt Management of session of identified and authenticated administrator gt The duration of session of the administrator who is identified and authenticated contributes to reduce the chance of attacking associated with unnecessary sess
188. s Dependencies FMT_SMF1 FMT_SMF1 FMT_SMR 1 FMT_SMR 1 1 FMT_SMR 1 2 FMT_MTD 1 7 Management of TSF data FMT_MTD 1 1 7 The TSF shall restrict the ability to selection change_default query modify delete clear lassignment other operations the lassignment list of TSF data to lassignment the authorized identified roles lassignment ist of TSF datal SNMP password User password Account password User box password Secure print password selection change default query modify delete clear lassignment other operations query lassignment the authorized identified roles Administrator Hierarchical to No other components Dependencies FMT_SMF 1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_MTD 1 8 Management of TSF data FMT_MTD 1 1 8 The TSF shall restrict the ability to selection change_default query modify delete clear lassignment other operations the assignment list of TSF data to lassignment the authorized identified roles lassignment list of TSF datal Secure print password selection change_default query modify delete clear lassignment other operations assignment other operations Registration lassignment the authorized identified roles User Hierarchical to No other components Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 46 131 bizhub C5
189. s by the lock release function that is available in the administrator mode e FIA_AFL 1 5 FIA_AFL 1 5 regulates the action for the authentication failure to the authentication of the user permitted the use of the secure print file In the authentication of a user permitted the use of the secure print file when the authentication failure of failure frequency threshold 1 3 times that an administrator sets is detected F PRINT denies the access to the secure print Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 114 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target file and locks an authentication function F ADMIN clears the authentication failure frequency and releases the lock status by the lock release function that is available in the administrator mode Accordingly this functional requirement is satisfied e FIA_AFL 1 6 FIA_AFL 1 6 regulates the action for the authentication failure to the authentication of the user permitted the use of the public user box In the authentication for accessing the public user box and changing a public user box password when the authentication failure of failure frequency threshold 1 3 times that an administrator sets is detected F BOX logs off if it s under authentication and locks an authentication function F ADMIN clears the authentication failure frequency and releases the lock status by the lock release functio
190. s lassignment list of functions to assignment the authorized identified roles lassignment list of functions User Authentication Function SNMP password authentication function selection determine the behavior of disable enable modify the behavior of modity the behavior of lassignment the authorized identified roles Administrator Hierarchical to No other components Dependencies FMT _SMF1 FMT_SMF1 FMT_SMR 1 FMT_SMR 1 2 FMT_MOF 1 3 Management of security functions behavior FMT_MOF 1 1 3 The TSF shall restrict the ability to selection determine the behavior of disable enable modify the behavior of the functions lassignment list of functions to assignment the authorized identified roles lassignment list of functions Account Authentication Function selection determine the behavior of disable enable modify the behavior oft disable modify the behavior of lassignment the authorized identified roles Administrator Hierarchical to No other components Dependencies FMT_SMF1 FMT_SMF1 FMT_SMR 1 FMT_SMR 1 2 FMT_MSA 1 1 Management of security attributes FMT_MSA 1 1 1 The TSF shall enforce the lassignment access control SFP information flow control SFP to restrict the ability to selection change_default query modify delete lassignment other operations the security attributes lassignment list of security attributes to lassi
191. secure print file by the authentication of the secure print password and it doesn t allow the interference by the unauthorized subject F SERVICE maintains the service engineer authentication domain that is provided various functions permitted to operate only by the service engineer and it doesn t allow the interference by the unauthorized subject Accordingly this functional requirement is satisfied e FTA_SSL 3 FTA_SSL 3 regulates the forced termination of a session to an administrator accessing from a panel F ADMIN logs off automatically if the panel auto log off time elapses from the last operation at the time of access from the panel by the administrator and denies the access to the administrator authentication domain F USER logs off automatically if the panel auto log off time elapses from the last operation at the time of access from the panel by the administrator and denies the access to the user authentication domain Accordingly this functional requirement is satisfied e FTP_ITC 1 FTP_ITC 1 regulates the Trusted Channel F TRUSTED PASS generates the Trusted Channel by SSL TSL responding to the request from the Trusted IT product and protects the communication data of the secure print file the Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 129 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target user box file or the image file that beco
192. sed of the characters and by the number of digits shown in Table 8 Setting of SNMP password authentication function The authentication method in the SNMP password authentication function is set to Only Authentication password or the Authentication password and Privacy password Account Settings gt Account registration Account is registered by setting the account ID and registering the account password It verifies whether the account password newly set have been satisfied the following qualities It is composed of the characters and by the number of digits shown in Table 8 It shall not be composed of one kind of character gt Change of account ID and account password Account ID and account password is changed It verifies whether the account password newly set have been satisfied the following qualities It is composed of the characters and by the number of digits shown in Table 8 It shall not be composed of one kind of character gt Account deletion Account ID and account password are deleted When the Group box of the account ID exists that group user box is automatically set to the public user box of user attributes public Setting of Administrator Authentication Lock Time Set the Administration authentication lock time between 1 60 minutes Setting of Trusted Channel function Set the setting data of Trusted Channel function by SSL TLS gt Communication Encryption Strength Setting Modification of the
193. selected ASCII code 0x21 0x7E except 0x22 and 0x2B Number 0 9 Alphabet Capital letter and small letter ere Password Symbols amp 7 5 5 gt 0 ease eee ee o EN Print Password 8 digits 93 characters in total can be selected ASCII code 0x20 0x7E except 0x22 and 0x2B Number 0 9 Alphabets Capital letter and small letter Symbols amp 7 3 lt 5 _ l SPACE HDD Lock Password 20 digits 83 characters in total can be selected ASCII code 0x21 0x7E except 0x22 0x28 0x29 0x2C 0x3A 0x3B 0x3C 0x3E 0x5B 0x5C and 0x5D Number 0 9 Alphabets Capital letter and small letter Symbols amp l SOA ds as SNMP Password 8 digits or 95 characters in total can be selected Privacy Password more ASCII code 0x20 0x7E Authentication Password Number 0 9 Alphabets Capital letter and small letter Symbols 1 4 8 1 1 5 6 gt 7 Account Password digl 1 _ 1 3 SPACE User Box Password 6 1 1 2 Auto logoff function of administrator mode Encryption passphrase While accessing an administrator mode from a panel if not accepting any operation during the panel automatic logoff time it logs off the administrator mode automatically 6 1 1 3 Function offered in Administrator mode Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved
194. ser who is permitted the use of the user box to operate the user box file in the public user box FIA_UID 2 5 and FIA_UAU 2 5 identifies and authenticates that it is a user who is permitted the use of the user box FIA_UAU 7 returns for each entered character as feedback protected by the panel and supports the authentication In the case of the failure authentication from the panel FIA_AFL 1 8 refuses all input acceptances from the panel for 5 seconds in every failure When the authentication failure reaches 1 3 times FIA_AFL 1 6 locks the authentication function for that user from then on This lock status is released by the administrator s release operation FMT_MTD 1 3 permits only to the administrator the setting of the threshold of the unauthorized access detection value that is the trial frequency of the failure authentication in the authentication of the user who is permitted the use of the user box When FIA_ATD 1 and FIA_USB 1 relates a user box ID to the task of acting use FDP_ACC 1 1 and FDP_ACF 1 1 permit the user box file that has a corresponding object attribute to the user box ID of the subject attribute and is set public to the user attribute of user box the operation such as a print a download transmissions a movement and a copy FIA_SOS 1 6 secures the quality verification of the session information used in the user box authentication via the network and FIA_SOS 2 secures the quality of the session information
195. ssion information or more gt Return for each character as feedback for the entered user box password gt Resets the number of authentication failure when succeeding in the authentication gt Incase of the access from the panel when it fails in the authentication an input from the panel is not accepted for five seconds gt When the authentication failure that becomes the 1 3 times in total is detected for the public user box concerned the authentication function to the public user box concerned is locked The administrator specifies the failure frequency threshold by the unauthorized access detection threshold setting function gt The lock of the authentication function is released by the lock release function to the public user box of FADMIN executed The following is a function that the user who is permitted the use of the user box is offered in the user box identification and authentication domain of the user box Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 70 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target O Access control to a user box file in a public user box The task to act for the user is related the User Box ID of the user box as a user box attribute in addition to the user attribute This task is permitted the user box file which have been set the public to the user attribute and have a corresponding user box attribute to the user b
196. strator and prevents a direct display of the administrator password F SERVICE returns for each character for the entered CE password from the panel in the authentication and re authentication of the service engineer and prevents a direct display of the CE password Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 118 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target F PRINT returns for each character for the entered secure print password from the panel in the authentication of the authorized user who can use the secure print file and prevents the direct display of the secure print password F USER returns for each character for the entered user password from the panel in the authentication of the user and prevents a direct display of the user password Moreover it returns for each character for the entered account password from the panel in the authentication of the account and prevents a direct display of the of the account password F BOX returns for each character for the entered user box password from the panel in the authentication of the user who is permitted the use of the public user box and prevents a direct display of the user box password Accordingly this functional requirement is satisfied e FIA UID 2 1 FIA_UID 2 1 regulates the identification of the service engineer F SERVICE identifies the user who accesses the ser
197. t attribute corresponding to the Account Name account ID of the subject attribute lt Operation control to user box file in Group user box gt A task to act for a user is permitted to print transmit E mail transmission FTP transmission SMB transmission and FAX transmission download move to other user boxes and copy to the other user boxes to the user box file that have the matched the Account Name Account ID and user box attribute user box ID of the object attribute with the Account Name Account ID and user box attribute user box ID of the subject attribute lt Operation control to Public user box gt A task to act for the user who is related to the user attribute user ID is permitted to do the list display operation to the user box where Public is set to the user attributes of the object attribute lt Operation control to a user box file in Public user box gt A task to act for the user who is related to the user attribute User ID and user box attribute user box ID is permitted to print transmit E mail transmission FTP transmission SMB transmission and fax transmission download move to other user boxes and copy operation to other user boxes to the user box file that Public is set to the user attribute of the object attribute and has matched user box attribute with the user box attribute of subject attribute FDP_ACF 1 3 1 The TSF shall explicitly authorize access of subjects to objects based on the fol
198. t can be performed only by administrator is permitted F SERVICE definitely activates Service engineer authentication function of which performance is indispensable before the use of various functions that can be performed only by the service engineer is permitted FUSER definitely activates User authentication function of which performance is indispensable before the use of various functions that can be performed only by the user is permitted It surely starts Account authentication function when the user access in the case that the account authentication method is the synchronized authentication method and in the case that the account name is not registered to the user in the method not synchronized F BOX definitely activates Authentication function by the user box password of which performance is indispensable before the use of various functions that can be performed only by the authorized user who can use the public user box is permitted F PRINT definitely activates Authentication function by the secure print password of which performance is indispensable before the use of various functions that can be performed only Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 128 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target by the authorized user who can use the secure print is permitted F HDD definitely activates Validity verification function of HDD o
199. taking HDD that is the medium that stores the image data in MFP out illegally by installing the encryption board which is the option parts of MFP Besides TOE has the deletion method to follow various overwrite deletion standards It deletes all the data of HDD completely and it contributes to the prevention of the divulging information of the organization that uses MFP by using the method at the time of abandonment or the lease returns This ST is the documentation for describing the necessity and sufficiency of these TOE Security Functions Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 7 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target 2 TOE Description 2 1 TOE Type The bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software that is the TOE is an embedded software product that controls the operation of whole MFP overall in the flash memory on the MFP controller 2 2 Environment for the usage of MFP Figure 1 shows the expected general environment for the usage of MFP equipped with TOE Moreover the matters assumed in the environment for the usage show by a run of the item below Office Firewall MFP ces TOE SMTP Server DNS Server FTP Server Y gt ka Pu
200. task to act for a user HDD Lock Password Object Settings Encryption passphrase Object SMTP Server Group Object Settings DNS Server Group Object Restore MFP Address Group Object FDP_ACF 1 1 Security attribute based access control FDP_ACF 1 1 1 The TSF shall enforce the lassignment access control SFP to objects based on the following lassignment list of subjects and objects controlled under the indicated SFP and for each the SFP relevant security attributes or named groups of SFP relevant security attributes lassignment list of subjects and objects controlled under the indicated SFP and for each the SFP relevant security attributes or named groups of SFP relevant security attributes lt Subject gt lt Subject attributes gt A task to act for a user gt User Attribute User ID Account Name Account ID User Box Attribute User Box ID Administrator Attribute lt Object gt lt Object attributes gt User Box gt User Attribute User ID or Public or Account ID User Box File gt User Attribute User ID or Public or Account ID User Box Attribute User Box ID lassignment access control SFP User Box access control FDP_ACF 1 2 1 The TSF shall enforce the following rules to determine if an operation among controlled subjects and controlled objects is allowed lassignment rules governing access among controlled subjects and controlled objects using cont
201. teger within 1 3 FIA_AFL 1 2 2 When the defined number of unsuccessful authentication attempts has been met or surpassed the TSF shall assignment list of actions lassignment list of actions lt Action when it is detected gt Log off from the authentication status of the administrator mode if it is and lock the Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 32 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target authentication function which uses the administrator password If it s not under the authentication status lock the authentication function which uses the administrator password lt Operation for recovering the normal condition gt Perform the lock release function offered within the service mode Perform the boot process of the TOE Release process is performed after Administrator authentication lock time by the boot process Hierarchical to No other components Dependencies FIA UAU 1 FIA_UAU 2I2 FIA_AFL 1 3 Authentication failure handling FIA_AFL 1 1 3 The TSF shall detect when selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values unsuccessful authentication attempts occur related to assignment list of authentication events lassignment list of authentication events Authenticatio
202. th OE N SERVICE the organization that manages the maintenance of the MFP educates the service engineer Also the administrator needs to observe the maintenance of the MFP so that the reliability of service engineers is assured e ANETWORK Network Connection Conditions for the MFP This condition assumes that there are no wiretapping activities for the intra office LAN and no access by an unspecified person from an external network OE N NETWORK regulates the wiretapping prevention by the installation of devices such as a wiretapping detection device and device to perform the encryption communication on the intra office LAN It also regulates the unauthorized access prevention from external by the installation of devices such as firewall in order to block access to the MFP from the external networks so that this condition is realized e ASECRET Operating condition concerning confidential information This condition assumes each password and encryption passphrase using for the use of TOE should not be leaked by each user OE N SECRET regulates that the administrator makes the user to execute the operation rule concerning the secure print password the user box password user password and account password and that the administrator executes the operation rule concerning the administrator password the HDD lock password SNMP password encryption passphrase and account password It also regulates that the service engineer executes the operation rule
203. that the protected feedback is returned for the entered password in the administrator s authentication and OE SESSION is also regulated to log off after the operations of the administrator mode ends so that O CONFIG is supported Accordingly this organizational security policies is sufficiently to achieve 8 2 IT Security Requirements Rationale 8 2 1 Rationale for IT Security Functional Requirements 8 2 1 1 Necessity The correspondence between the security objectives and the IT security functional requirements are shown in the following table It shows that the IT security functional requirements correspond to at least one security objective Table 12 Conformity of IT Security Functional Requirements to Security Objectives Security Objective UIWPe Jes X BOIAIOS OS X Security 43SN d3431SID3I48 O Functional Requirements set service FCS_CKM 1 FCS_COP 1 FDP_ACC 1 1 FDP_ACC 1 2 FDP_ACC 1 3 FDP_ACF 1 1 FDP_ACF 1 2 FDP_ACF 1 3 FIA_AFL 1 1 FIA_AFL 1 2 le e lolo aa elelelelele ele sinooo ARANA es Ee R MAEE FEO e A AMAN Eat SR E RHRR RCE E AAI 828920 U D lt gt 4 m W O x lt 0 0 BE bt Ez bs n IAS ARES SETE AO aeara A arar ol TT ttt H AAAI comenzo del 11111 W Copyright O 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 83 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Secur
204. the functional requirement are shown in the table below Table 14 Mutual Support Correlations of IT Security Functional Requirements N A Not Applicable Functional requirement component IT Security that operates other security functional requirements validly Functional Requirement FCS_CKM 1 N A FCS_COP 1 N A FDP_ACC 1 1 N A FDP_ACC 1 2 N A Bypass Prevention FDP_ACC 1 3 N A FDP_ACF 1 1 FDP_ACF 1 2 FIA UAU FDPZACE AB FIA_UAU 2 2 FIA_AFL 1 1 T_MTD 1 3 FIA_AFL 1 2 N FIAAFL1 3 NV PFIALAFLA 4 N PFIALAFLA 5 N FIA_AFL 1 6 N FIA_AFL 1 7 N N N N N N N FPT_RVM FIA_UAU 2 2 Interference Deactivation Disabling Destruction f Prevention Detection Prevention FMT_MTD 1 3 A FMT_MTD 1 3 E FMT_MTD 1 12 FMT_MOF 1 1 FMT_MOF 1 1 FMT_MOF 111 FMT_MSA 1 1 FMT_MSA 11 2 f FMT_MSA 1 3 FMT_MOF 1 1 N A FPT_SEP 1 Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 102 131 IT Security Functional Requirement FIA_UAU 2 4 FIA_UAU 2 5 FIA_UAU 2 6 FIA_UID 2 6 FMT_MTD 1 6 FMT_MTD 1 7 FMT_MTD 1 5 FMT_SMR 1 5 FMT_MTD 1 12 Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target Functional requirement component that o
205. the Enhanced Security function The Enhanced Security function influences all the security structures of TOE and this supports the deactivation prevention of all the security functions achieved by the security requirements of TOE except FCS_COP 1 FMT_MOF 1 1 FMT_MOF 1 3 FIA_SOS 1 6 FIA_SOS 2 and FNEW_RIP 1 lt Maintenance of account authentication function gt FMT_MOF 1 3 permits the administrator the operation setting management of stop operation of account authentication function This supports the deactivation prevention of FIA_UID 2 6 FIA_UAU 2 6 FIA_AFL 1 7 FMt_SMR 1 6 related with the account authentication Disabling Detection The requirement that supports the disabling detection doesn t exist 8 2 2 Rational for Minimum Strength of Function The MFP that is loaded with this TOE is connected to an intra office LAN with appropriately controlled connections with external networks Therefore there is no possibility that it is directly attacked by unspecified people via the Internet As long as it has a strength level that can counter the threat by users who are users of the TOE and a person who can enter the office and not user of the TOE as an agent it is acceptable as explicitly described in section 3 3 Therefore this TOE regulates security objectives by assuming an unskilled attacker and thus the selection of the SOF Basic as the minimum strength of function is reasonable 8 2 3 Rationale for IT Securit
206. the account in the account authentication Accordingly this functional requirement is satisfied eo FMT_SMF 1 FMT_SMF 1 specifies the security management function F ADMIN provides the following security management functions gt Operation setting function of user authentication function Operation setting function of account authentication function Operation setting function of trusted channel function Encryption method setting etc Operation setting function of S MIME function Encryption method setting etc Setting function of authentication failure frequency threshold VV VV V Back up and restoration function It consequentially corresponds to the inquiry function of the following TSF data SNMP password User password User box password Secure Print password Account password It also corresponds to the modification function of the following TSF data SNMP password User password User box password Secure print password Account password User ID User attribute of the user box Panel auto log off time Operational setting data of the Enhanced Security function Authentication failure frequency threshold of the authentication operation prohibited function Account ID S MIME certificate Transmission address data Setting data of the Trusted Channel function Belonging Account of user CE authentication lock time Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved
207. the authorized identified roles e User who is permitted to use that public user box Administrator lassignment access control SFP information flow control SFP User box access control Hierarchical to No other components Dependencies FDP_ACC 1 or FDP_IFC 1 FDP_ACC 1 1 FMT_SMF 1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 4 FMT_MSA 1 3 Management of security attributes FMT_MSA 1 1 3 The TSF shall enforce the lassignment access control SFP information flow control SFP to restrict the ability to selection change_default query modify delete lassignment other operations the security attributes lassignment list of security attributes to lassignment the authorized identified roles lassignment list of security attributes User attributes of user box that is set the Account ID selection change default query modify delete lassignment other operations modify modify to fuser ID public or other account ID lassignment the authorized identified roles e User who is permitted to use that account e Administrator lassignment access control SFP information flow control SFP User box access control Hierarchical to gt No other components Dependencies FDP_ACC 1 or FDP_IFC 1 FDP_ACC 1 1 FMT_SMF1 FMT_SMF1 FMT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 6 FMT_MSA 3 1 Static attribute initialization FMT_MSA 3 1 1 The TSF shall enforce the assig
208. the secure print file are called by FPT_RVM 1 without fail so that the by pass prevention is supported lt By pass prevention of validity verification of HDD gt FIA_NEW 1 that verifies the validity of HDD is called by FPT_RVM 1 without fail so that the by pass prevention is supported Interference and Destruction Prevention lt Maintenance of user box access control gt The user attribute that is the security attribute of the user box when Public is set permits the modification only to the user who is allowed to use the user box or the administrator by When User ID is set FMT_MSA 1 1 permits the modification only to the user and the administrator When Account ID is set FMT_MSA 1 3 permits the modification only to the user who are allowed to use the account and administrator Moreover by FPT_SEP 1 only the subject of three types such as the authenticated user who is assumed by the user box access control the authenticated administrator and the user who is permitted the use of the authenticated public user box can operate the user box and the user box file With four requirements in the above mentioned FDP_ACF 1 1 is supported in the prevention of interference and destruction from other illegal subject lt Maintenance of secure print file access control gt FPT_SEP 1 permits the operation of the secure print file only to the three types of subject which are the authenticated user who is assumed by the secure print
209. the service mode Accordingly this functional requirement is satisfied e FIA_AFL 1 3 FIA_AFL 1 3 regulates the action for the authentication failure to the administrator authentication when accessing to the MIB object by using SNMP In the authentication using the SNMP password for accessing to the MIB object when the authentication failure of failure frequency threshold 1 3 times that the administrator set is detected F ADMIN SNMP denies the access to the MIB object and locks an authentication function F RESET releases the lock status by the reboot of TOE by turning OFF and ON the power supply that clears the times of failure in each authentication function F ADMIN clears the authentication failure frequency and releases the lock status by the lock release function that is available in the administrator mode Accordingly this functional requirement is satisfied e FIA_AFL 1 4 FIA_AFL 1 4 regulates the action for the authentication failure to the authentication of the user In the user authentication for accessing of user or changing the user password by user when the authentication failure of failure frequency threshold 1 3 times that the administrator sets is detected FUSER logs off if it s under the authentication status and locks the authentication function of the concerned user from then on Accordingly this functional requirement is satisfied F ADMIN clears the authentication failure frequency and releases the lock statu
210. tive In order to activate the enhanced security function the prerequisite is required that an Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 16 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target administrator password and a CE password should be set along with the password policy Setting of user identification and authentication function Valid Either the machine authentication or the external server authentication are available User Setting of access of PUBLIC Prohibit Setting of a service engineer authentication function Valid Setting of password policy function Valid Setting of secure print authentication method Authentication operation prohibition function effective method In conjunction with it it becomes in the state of the panel lock for five seconds at the time of the authentication failure in the panel And it becomes the account lock Failure frequency threshold 1 3 times as well Setting of user box collective management function Prohibit Setting of the network setting modification function with SNMPv1 and v2 Prohibit Setting of HDD lock function Valid Setting of Encryption function Valid Setting of print capture function Prohibit Setting of maintenance function Prohibit Remote diagnostic function Prohibit Network setting management reset function Prohibit TOE update function via Internet Prohibit Setting f
211. to access MFP offers the appropriate feedback protected for input user password user box password account password and administrator password 4 2 2 Non IT environment security objective OE N ADMIN A reliable administrator The person in charge in the organization who uses MFP will assign a person who can faithfully execute the given role during the operation of the MFP with TOE as an administrator OE N SERVICE The service engineer s guarantee The person in charge in the organization that carries out the maintenance management of the MFP educates a service engineer in order to faithfully carry out the given role for the installation of the TOE the set up of TOE and the maintenance of the MFP with TOE The administrator observes the maintenance work of MFP with TOE by a service engineer OE N NETWORK Network Environment in which the MFP is connected The person in charge in the organization who uses MFP carries out the tapping prevention measures by setting the cipher communications equipment and the tapping detection equipment to the LAN of the office where MFP with TOE is installed The person in charge in the organization who uses MFP carries out the measures for the unauthorized access from the outside by setting up the equipment such as the firewall to intercept the access from an external network to MFP with TOE OE N SECRET Appropriate management of confidential information The administrator has the user implement t
212. tributes gt task substituted for a user gt File attributes Secure print internal control ID e User attributes User ID Administrator attributes lt Object gt lt Object attributes gt e Secure print file gt File attributes Secure print internal control ID lassignment access control SFP Secure print file access control FDP_ACF 1 2 2 The TSF shall enforce the following rules to determine if an operation among controlled subjects and controlled objects is allowed lassignment rules governing access among controlled subjects and controlled objects using controlled operations on controlled objects Copyright O 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 30 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target lassignment rules governing access among controlled subjects and controlled objects using controlled operations on controlled objects A task to act for a user who has a user attribute user ID is permitted to display of the list of all the secure print files A task to act for a user who has a user attribute user ID and the file attribute the secure print internal control ID is permitted the print operation to the secure print file that has matched the file attribute secure print internal control ID with the file attribute secure print internal control ID FDP_ACF 1 3 2 The TSF shall explicitly author
213. ty to selection change_default query modify delete clear lassignment other operations the lassignment list of TSF data to lassignment the authorized identified roles lassignment ist of TSF datal User box password selection change_default query modify delete clear lassignment other operations assignment other operations Registration 5 Tt intends the operation of replacing a settable digital certificate for each user in stead of the modification of the value itself Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 45 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target lassignment the authorized identified roles User Administrator Hierarchical to No other components Dependencies FMT_SMF 1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 3 r FMT_MTD 1 6 Management of TSF data FMT_MTD 1 1 6 The TSF shall restrict the ability to selection change_default query modify delete clear lassignment other operations the assignment list of TSF data to lassignment the authorized identified roles lassignment ist of TSF datal Administrator password selection change default query modify delete clear lassignment other operations modify lassignment the authorized identified roles Administrator Service Engineer Hierarchical to No other component
214. ulated by service engineer and the function operated in the background without user s awareness Basic Function In MFP a series of function for the office work concerning the image such as copy print scan and fax exists as a basic function and TOE performs the core control in the operation of these functions It converts the raw data acquired from the external device of the MFP controller into the image file and registered in RAM and HDD After two or more conversion processing is done the compression conversion is done as for the print image file from PC The image file which has been compressed is decompressed into data for the print or for the transmission and is transmitted to the device outside of the MFP controller concerned Operations of copy print scan and fax are managed by the unit of job and can be changed the operation order can be modified the finishing if it s a printing job and can be cancelled the Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 11 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target operation by the command from the panel The following is the functions related to the security in the basic function O Secure Print Function When the Secure Print password is received with the printing data the image data is stored as the standby status And the print command and password input from the panel allows printing This fu
215. unction F ADMIN SNMP permits the administrator who is authenticated by the SNMP password the setting operation of the SNMP password authentication Accordingly this functional requirement is satisfied Copyright O 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 120 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target e FMT_MOF 1 3 FMT_MOF 1 3 regulates the behavior management and the stop operation management of the account authentication function F ADMIN offers a setting function of the account authentication function in the administrator mode and permits the operation of a setting of the operational mode of each function and a stop function of the account authentication Accordingly this functional requirement is satisfied e FMT_MSA 1 1 FMT_MSA 1 1 regulates the management of the user attribute of user box When user ID is set F ADMIN permits the change operation of the user attribute that is set to the user box in the administrator mode Also FADMIN permits the administrator the back up and restoration operation so that it is possible to change the back up data which is acquired by the back up operation and to change the user attribute of the user box as a result of restoration In addition when a user concerned owns a personal user box by the deletion operation of registered user the user box is changed to the public user box F BOX permits the authenticated user
216. unction of transmission address data by user Prohibit Operation setting of Trusted Channel function Valid Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 17 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target 3 TOE Security Environment This chapter will describe the concept of protected assets assumptions threats and organizational security policies 3 1 Protected Assets Security concept of TOE is the protection of data that can be disclosed against the intention of the user As MFP is generally used the following image file in available situation becomes the protected assets e Secured print file image file registered by secured print e User Box file image file stored in the personal user box and public user box As for a image file of a job kept as a wait state by activities of plural jobs and a image file of a job kept that prints the remainder of copies becoming as a wait state for confirmation of the finish and other than the image file dealt with the above mentioned is not intended to be protected in the general use of MFP so that it is not treated as the protected assets In the print of the secure print file and the transmission of the user box file making in the preparation for the threat thought when illegal MFP or mail server is connected by any chance the setting of MFP IP address etc requires not to be modified illegal
217. unctions are specified by FMT_SMF 1 This security objective is satisfied by the completion of these multiple functional requirements e O PRIVATE BOX personal user box access control This security objective limits access to the personal user box and the user box file in the personal user box to only the user who owns that user box and needs various requirements that relate to the access control lt User box access control a personal user box gt By FDP_ACC 1 1 and FDP_ACF 1 1 the task of acting the user has a user ID and is permitted to display the list of the user box with a corresponding user attribute In addition after the user box has been selected when the user box ID is related to the task of acting a use by FIA_ATD 1 and FIA_USB 1 the operation such as a print a download transmissions a movement and a copy is permitted to the user box file that has a corresponding object attribute to user ID and user box ID of the subject attribute lt Management of a personal user box gt FMT_MSA 1 1 permits to the user and the administrator the change operation of the user attribute of the user box where the user ID is set As for the registration of the user box public is appointed to the user attribute of the user box by FMT_MSA 3 1 and it is permitted only to the user being able to give the initial value to change In addition when the job to store the non registered user box into the user box appointed is executed due t
218. user authentication method the user who is authenticated the identification is permitted from an external server and registered automatically by this requirement This corresponds to the user ID registration of the external server At this registration the external server accessing TOE is identified the external server registered by FIA_UID 2 7 This management behavior is maintained as the role of the external server by FMT_SMR 1 5 In addition the registration function of user ID is specified for the administration function by FMT_SMEF 1 The setting change operation of an external server is limited to only the administrator by FMT_MTD 1 3 The quality of the user password is verified by FIA_SOS 1 3 When machine authentication is selected in the method of the user authentication a change of the user password is limited to the user itself and the administrator by FMT_MTD 1 2I lt Necessary requirement to keep the administrator secure gt gt refer to set admin lt Necessary requirement to keep the service engineer secure gt gt refer to set service Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 86 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target lt Role and management function for each management gt The role to do these managements is maintained as a administrator by FMT_SMR 1 2 and a user by FMT_SMR 1 3 Moreover these management f
219. user authentication gt Automatic registration of the User ID for an unregistered user in MFP by the External server when the External server authentication is selected as the method of the user authentication gt Registration function of the account name when the account name is unregistered in the case that the account authentication method is the method not synchronized F BOX offers the following security management functions gt Modification function of the user attribute of the user box Modification of a personal user box by the user User ID gt Public or Other User ID or Account ID Modification of a public user box by the user who is permitted the use of the public user box Public gt User ID or Account ID Modification of a group user box by the user who is permitted the use of the group user box Account ID Public or User ID or Other Account ID Overwrite function of the default value of the user attribute of the user box v gt Registration Modification of the user box password gt Automatic registration of a personal user box by the stored job in the user box that specifies unregistered user box by the user F PRINT offers the following security management functions gt Registration of the Secure Print password F ADMIN and FOVERWRITE ALL offer the following security management functions gt Stop function of the Enhanced Security function Overwrite deletion function of all area gt Initialization of the adm
220. user while the authentication is in progress lassignment list of feedback Display every character data input Hierarchical to f No other components Dependencies FIA_UAU 1 FIA_UAU 2 1 FIA_UAU 2 2 FIA_UAU 2 3 FIA_UAU 2 4 FIA_UAU 2 5 FIA_UID 2 1 User identification before any action FIA_UID 2 1 1 The TSF shall require each user Service Engineer to identify itself before allowing any other TSF mediated actions on behalf of that user Service Engineer Hierarchical to FIA UID 1 Dependencies No dependencies FIA_UID 2 2 User identification before any action Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 39 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target FIA_UID 2 1 2 The TSF shall require each user Administrator to identify itself before allowing any other TSF mediated actions on behalf of that user Administrator Hierarchical to a FIA_UID 1 Dependencies No dependencies FIA_UID 2 3 User identification before any action FIA_UID 2 1 3 The TSF shall require each user User to identify itself before allowing any other TSF mediated actions on behalf of that user User Hierarchical to FIA UID 1 Dependencies No dependencies FIA_UID 2 4 User identification before any action FIA_UID 2 1 4 The TSF shall require each user Us
221. ut receipts from a panel when the authentication failure is detected in the authentication for accessing to the public user box from a panel F PRINT rejects all input receipts from a panel when the authentication failure is detected in the authentication of a user permitted the use of the secure print file These series of operation is released automatically in five seconds Accordingly this functional requirement is satisfied e FIA ATD 1 FIA_ATD 1 regulates the security attribute related by the user F BOX assigns user box 1D to the task of substituting the user Copyright O 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 115 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target F PRINT assigns the internal control ID of the secure print to the task of substituting the user FUSER assigns account name account ID to the task of substituting the user Accordingly this functional requirement is satisfied e FIA_SOS 1 1 FIA_SOS 1 1 regulates the quality of the administrator password and the CE password F ADMIN verifies the quality of the administrator password that is composed of ASCII code 0x21 0x7E except 0x22 and 0x2B in total of 92 characters by eight digits is not composed of one kind of character and does not correspond to the value currently set F SERVICE verifies the quality of CE password and the administrator password that is composed of ASCII code 0x21 0x7E e
222. values assignment range of acceptable values an administrator configurable positive integer within 1 3 FIA_AFL 1 2 5 When the defined number of unsuccessful authentication attempts has been met or surpassed the TSF shall assignment ist of actions lassignment list of actions lt Action when it is detected gt Deny the access to the secure print file and lock the authentication function for the secure print file lt Operation for recovering the normal condition gt Perform the delete function of authentication failure frequency offered within the administrator mode Reboot the TOE Hierarchical to No other components Dependencies FIA_UAU 1 FIA_UAU 2 4 FIA_AFL 1 6 Authentication failure handling FIA_AFL 1 1 6 The TSF shall detect when selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values unsuccessful authentication attempts occur related to assignment list of authentication events lassignment list of authentication events Authentication for accessing the public user box selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values assignment range of acceptable values an administrator configurable positive integer within 1 3 FIA_AFL 1 2 6 When the defined number of unsuccessful authentication atte
223. vice mode is a service engineer Accordingly this functional requirement is satisfied e FIA UID 2 2 FIA_UID 2 2 regulates the identification of the administrator F ADMIN identifies the user who accesses the administrator mode is an administrator F ADMIN SNMP identifies the user who accesses the MIB object is an administrator Accordingly this functional requirement is satisfied e FIA_UID 2 3 FIA_UID 2 3 regulates the identification of the user F USER identifies the user who is registered by the user ID that is set to each user Accordingly this functional requirement is satisfied e FIA UID 2 4 FIA_UID 2 4 regulates the identification of the user who is permitted the use of the secure print file F PRINT identifies a user who is permitted the use of the secure print file by selecting the secure print file as an operation target Accordingly this functional requirement is satisfied e FIA _UID 2l5 FIA_UID 2 5 regulates the identification of the user who is permitted the use of the public user box F BOX identifies the user who is permitted the use of the public user box by selecting the user box as the operation target Accordingly this functional requirement is satisfied e FIA UID 2 6 FIA_UID 2 6 regulates the identification of the account F USER identifies as a registered account by the account ID that is set for each account when the method of the account authentication is the method not synchronized Co
224. which external server belongs needs to be set gt Account authentication function synchronized method The method which utilizes an account ID related to user ID beforehand gt Account authentication function method not synchronized The method to authenticate by the account ID and the account password at the time of access without utilizing the account ID that related to user ID beforehand gt Account authentication function not use Utilize only the authentication function by user ID and not utilize the authentication by account information Setting of unauthorized access detection threshold The unauthorized access detection threshold in the authentication operation prohibition function is set for 1 3 times Setting and execution of all area overwrite deletion function The deletion method shown in the following table is selected first and then the overwrite deletion at the data area of HDD and the initialization of NVRAM are performed Perform FOVERWRITE ALL Table 9 A type of overwrite deletion of all area and the method of overwriting Method Overwritten data type and their order Mode 1 0x00 Mode 2 Random numbers gt Random numbers gt 0x00 Mode 3 0x00 gt OxFF gt Random numbers gt Verification Mode 4 Random numbers gt 0x00 gt OxFF Mode 5 0x00 gt OxFF gt 0x00 gt OxFF Mode 6 0x00 gt OxFF gt 0x00 gt OxFF gt 0x00 gt OxFF gt Random numbers Mode 7 0x00 gt OxFF gt 0x00 gt OxFF gt
225. who is authenticated by the user box password as the authorized user who can use the public user box Accordingly this functional requirement is satisfied e FMT_SMR 1 5 FMT_SMR 1 5 regulates the role as an external server F USER recognized the reference to the user information as an external server when it is under the external server authentication Accordingly this functional requirement is satisfied e FMT_SMR 1 6 FMT_SMR 1 6 regulates the role as a user who is permitted the use of the account F USER recognizes as a user who is permitted the use of the account by the account name of the user concerned when the user authenticated in the case that the account authentication method is the synchronized method It recognizes as a user who is permitted the use of the account when the account authenticated in the case of the account authentication method not synchronized Accordingly this functional requirement is satisfied FPT_RVM 1 FPT_RVM 1 regulates to support that a corresponding TSP execution function must be called before each TOE security function is permitted to start its operation F ADMIN definitely activates Administrator authentication function of which performance is indispensable before the use of various functions that can be performed only by administrator is permitted FADMIN SNMP definitely activates Administrator authentication function of which performance is indispensable before the use of network functions tha
226. with Active Directory 2 5 4 Account Authentication Function TOE can manage the MFP users by grouping them into Account unit The methods of Account Authentication are as follows Method synchronized with User Authentication The user is set Account ID which he belongs to beforehand and the user is related to account ID of belonging account when user is certified Method not synchronized with User Authentication When the certification is done by the account password set to each account ID the user is related to the concerned account ID 2 5 5 Administrator Function TOE provides the functions such as the management of user boxes management of user information at the time of MPF authentication and management of various settings of the network image quality etc in the administrator mode that only authenticated administrator can manipulate The following shows the function related to the security e The user registration management gt Registration or change in user ID and user password and deletion of a user e The account registration management gt Registration or change in account ID and account password O Management of user box settings gt Registration or change in user box password and management of user attributes O Operation setting of automatic system reset gt Setting of the function that logs out automatically when the setting time passed O Management of network setting gt Connection setting of the intra offic
227. with the registered HDD lock password and encryption Passphrase object When the authentication is succeeded the HDD lock password and the encryption passphrase are allowed to be changed Moreover when the CE attribute is related to the task of acting the user FDP_ACC 1 3 and FDP_ACF 1 3 permit the setting operation to the HDD lock password object and the encryption Passphrase object to the task of acting the user lt Necessary requirement for accessing MIB object gt The SMTP server group object the DNS server group object and the MFP address group object exists as an MIB object as well so that the restriction is necessary even in the access from the SNMP FIA_UID 2 2 and FIA_UAU 2 2 identifies and authenticates that the user who accesses the MIB object is an administrator FIA_AFL 1 3 locks the authentication function to access the MIB object when the failure authentication reaches 1 3 times This lock is released by the start of TOE or the lock release operation by the administrator FMT_MTD 1 3 restricts the threshold setting of the unauthorized access detection value that is the trial frequency of the failure authentication in the administrator authentication using the SNMP password only to the administrator FMT_MTD 1 3 restricts the change in the SNMP password to the administrator FIA_SOS 1 2 verifies the quality of the SNMP password FMT_MTD 1 11 restricts the initialization of the SNMP password only to the administrator
228. xcept 0x22 and 0x2B in total of 92 characters with eight digits is not composed of one kind of characters and does not correspond to the value currently set Accordingly this functional requirement is satisfied e FIA_SOS 1 2 FIA_SOS 1 2 regulates the quality of the SNMP password FADMIN verifies that the quality of the SNMP password Privacy password Authentication password is composed of ASCII code 0x20 0x7E in total of 95 characters by eight or more digits FADMIN SNMP also verifies that the quality of the SNMP password Privacy password Authentication password is composed of ASCII code 0x20 0x7E in total of 95 characters with eight or more digits Accordingly this functional requirement is satisfied e FIA_SOS 113 FIA_SOS 1 3 regulates the quality of the user password F ADMIN verifies that the quality of the user password is composed of ASCII code 0x20 0x7E in total of 95 characters by eight or more digits Also it verifies that the first 8 characters are not composed of one kind of characters F USER verifies that the quality of the user password is composed of ASCII code 0x20 0x7E in total of 95 characters by eight or more digits Also it verifies that the first 8 characters are not composed of one kind of characters Accordingly this functional requirement is satisfied e FIA_SOS 1 4 FIA_SOS 1 4 regulates the quality of the HDD lock password and the encryption passphrase F ADMIN verifies that the quality of the HDD
229. y delete clear lassignment other operations lassignment other operations Registration lassignment the authorized identified roles Administrator Hierarchical to No other components Dependencies FMT_SMF 1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_MTD 1 2 Management of TSF data FMT_MTD 1 1 2 When the machine authentication is selected as the User authentication method The TSF shall restrict the ability to selection change_default query modify delete clear assignment other operations the lassignment list of TSF data to assignment the authorized identified roles lassignment list of TSF datal User s own user password selection change default query modify delete clear lassignment other operations modify lassignment the authorized identified roles User Administrator Hierarchical to No other components Dependencies FMT_SMF1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_SMR 1l3 Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 44 131 bizhub C550 bizhub C451 ineo 550 ineo 451 Control Software Security Target FMT_MTD 1 3 Management of TSF data FMT_MTD 1 1 3 The TSF shall restrict the ability to selection change_default query modify delete clear lassignment other operationsll the assignment list of TSF data to assignment the authorized identified roles lassignment list of
230. y Assurance Requirements This TOE is installed and used in an environment where adequate security is maintained in terms of the physical personnel and connectivity Nonetheless adequate effectiveness in the environment where the TOE is used must be assured As a general commercial office product the execution of tests based on function specifications and high level design and analysis of the strength of function and a search for vulnerabilities are required In addition it is desirable that it has a development environment control a configuration management for the TOE and a secure distribution procedure And therefore the selection of EAL3 which provides an adequate assurance level is reasonable The secure requirement dependency analysis is assumed to be appropriate because the package EAL has been selected therefore details are not discussed 8 2 4 Consistency rationale for the set of IT security functional requirement The followings show the rationale in which the IT security requirement with a possibility to compete does not exist 1 Though this is not shown in the mutual support analysis FIA_AFL 1 requirement supports respectively against the attack that aims at the disabling of each authentication function This is sufficient to maintain the security objective of this TOE This content is specified by the dependency analysis Copyright 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 108 131

Download Pdf Manuals

Related Search

Related Contents

BCAM - ビートソニック    Samsung CE283GN Manual de utilizare  Betriebsanleitung für Airless-Geräte Graco Mark VII Max, Mark X  Uso y Cuidados    me-ecobati-claylime-creatina  Joycare JC-437 personal scale  

Copyright © All rights reserved. Failed to retrieve file