Home

bizhub 501 / bizhub 421 / bizhub 361 / ineo 501

1. Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 55 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target FMT_MSA 3 1 Static attribute initialization FMT_MSA 3 1 1 The TSF shall enforce the assignment access control SFP information flow control SFP to provide selection choose one of restrictive permissive assignment other property default values for security attributes User attributes of the user box that are used to enforce the SFP selection choose one of restrictive permissive assignment other property assignment other property Responded the registered situation of the user box classified into the following cases 1 Public when an user box is registered by the operation of user or administrator 2 User ID of the user who performed the relevant job when an user box is registered automatically according to the operation of stored job specifying unregistered user box assignment access control SFP information flow control SFP User box access control FMT_MSA 3 2 1 The TSF shall allow the assignment the authorized identified roles to specify alternative initial values to override the default values when an object or information is created assignment the authorized identified roles Case 1 identified in assignment other p
2. cccceeseseeeeeeeeeeees 8 Figure 2 Hardware composition that relates to TOE c cccccceeeeeeeeeeeeeeeeeeeeeeseeaeeeeeeeeeeseseeneeaeeees 9 List of Tables Table 1 Conformity of Security Objectives to assumptions and Threats ccccceeseeeeeeeeeeeeeees 28 Table 2 Cryptographic Key Generation Relation of Standards Algorithm Key sizes 06 39 Table 3 Cryptographic Operation Relation of Algorithm Keysizes Cryptographic Operation 40 Table 4 User Box Access Control Operational List ce cceeeeeeeeeeeeeseeeeeeseeeeeeeeeneeeeeesneeeeeteaaes 41 Table 5 Secure Print File Access Control Operational List cc cc eeecseeeeeeeeeeeeeeneeeeeeeneeeeeesenees 41 Table 6 Setting Management Access Control Operational List 0 ccccceeceeeeeeeeeeeeeeeeeeeeeeeeeetes 42 Table 7 TOE Security Assurance Requirements cccceeeeseeeeeeeneeeeceennaeeeetecaeeeeeeeneeeeeesneeeereeeaes 66 Table 8 Conformity of IT Security Functional Requirements to Security Objectives ee 67 Table 9 Dependencies of IT Security Functional Requirements Component sassen 80 Table 10 The list of the name and identifier of TOE Security function 85 Table 11 character and number of digits used for password ou eee eeeeeeeeteeeeeenteeeeteneeeeeteneaeeeeeneaeees 86 Table 12 A type of overwrite deletion of all area and the meth
3. The TSF shall be able to associate users with roles Hierarchical to No other components Dependencies FIA _UID 1 FIA_UID 2I 7 D FMT_SMR 1 6 Security roles FMT_SMR 1 1 6 The TSF shall maintain the roles assignment the authorized identified roles assignment the authorized identified roles The user who is permitted to use of the account FMT_SMR 1 2 6 The TSF shall be able to associate users with roles Hierarchical to No other components Dependencies FIA_UID 1 FIA_UID 2 6 6 1 1 5 TOE Access FTA_SSL 3 TSF initiated termination FTA_SSL 3 1 The TSF shall terminate an interactive session after a lassignment time interval of user inactivity assignment time interval of user inactivity Time decided from the final operation depending on the panel auto logoff time 1 9 minute s while a administrator or a user is operating on the panel Hierarchical to No other components Dependencies No dependencies 6 1 1 6 Trusted pass channel SS _ _ _ _ _ _ _ _ 1 FTP_ITC 1 Inter TSF trusted channel FTP_ITC 1 1 The TSF shall provide a communication channel between itself and a other trusted IT product that is logically distinct from other communication channels and provides assured identification of its end
4. Hierarchical to No other components Dependencies FIA_UAU 1 FIA_UAU 2 2 FIA_AFL 1 3 Authentication failure handling FIA_AFL 1 1 3 The TSF shall detect when selection assignment positive integer number an administrator configurable positive integer within assignment range of acceptable values unsuccessful Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 45 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target authentication attempts occur related to assignment List of authentication events assignment Jist of authentication events Authentication for accessing the MIB object through SNMP selection assignment positive integer number an administrator configurable positive integer within assignment range of acceptable values assignment range of acceptable values an administrator configurable positive integer within 1 3 FIA_AFL 1 2 3 When the defined number of unsuccessful authentication attempts has been selection met surpassed the TSF shall lassignment Jist of actions selection met surpassed Surpassed assignment List of actions lt Action when it is detected gt Deny the access to the MIB object and lock the authentication function to use SNMP password lt Operation for recovering the normal condition gt Perform the delete function of authentication failure freq
5. FIA_AFL 1 5 Authentication failure handling FIA_AFL 1 1 5 The TSF shall detect when selection assignment positive integer number an administrator configurable positive integer within assignment range of acceptable values unsuccessful authentication attempts occur related to assignment List of authentication events lassignment list of authentication events Authentication for accessing the secure print file selection assignment positive integer number an administrator configurable positive integer within assignment range of acceptable values assignment range of acceptable values an administrator configurable positive integer within 1 3 Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 46 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target FIA_AFL 1 2 5 When the defined number of unsuccessful authentication attempts has been selection met surpassed the TSF shall assignment List of actions selection met surpassed Surpassed assignment List of actions lt Action when it is detected gt Deny the access to the secure print file and lock the authentication function for the secure print file lt Operation for recovering the normal condition gt Perform the delete function of authentication failure frequency offered within the administrator mode Reboo
6. Transmission address data Belonging Account of User Administrator authentication lock time 7 Tt intends the operation of replacing a settable digital certificate for each user in stead of the modification of the value itself Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 57 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Encryption passphrase HDD lock password CF lock password SNMP password TST receiving setting data selection change_default query modify delete clear assignment other operations modity assignment the authorized identified roles Administrator Hierarchical to No other components Dependencies FMT_SMF 1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_MTD 1 4 Management of TSF data FMT_MTD 1 1 4 The TSF shall restrict the ability to selection change_default query modify delete clear assignment other operations the assignment list of TSF data to assignment the authorized identified roles assignment list of TSF datal User box password of the relevant user box selection change_default query modify delete clear assignment other operations modity assignment the authorized identified roles User who is permitted to use that public user box Administrator Hierarchical to No ot
7. Component leveling FAD_RIP Remaining Information Protection of All Data FAD_RIP 1 Remaining Information Protection of All Data after the explict deletion operation requires of TSF to assure that the subset of the defined object controlled by TSF cannot utilize every remainng information of every resource under the allocation of resource or the release of it Audit FAD_RIP 1 The use of the user identification information with the explicit deletion operation Management FAD_RIP 1 No expected management activity Remaining Information Protection of All Data after the explict FAD_RIP 1 deletion operation FAD_RIP 1 TSF shall ensure that the content of the information allocated to source before shall not be available after the explicit deletion operation against the object and TSF data assignment object list and TSF data list Hierarchical to No other components Dependencies No dependencies 5 1 2 FIA_EID 1 Definition Family behaviour This family corresponds to the necessity to ensure that IT environment entity is not illegally replaced when IT environment entity out of TOE provides the security functions This family requires the verification of the authentication of IT environment entity Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 36 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Se
8. points and protection of the channel data from modification or disclosure FTP_ITC 1 2 The TSF shall permit selection the TSF the other trusted IT product to initiate communication via the trusted channel selection the TSF the other trusted IT product The other trusted IT product FTP_ITC 1 3 The TSF shall initiate communication via the trusted channel for assignment Jist of functions for which a trusted channel is required assignment Jist of functions for which a trusted channel is required Download of the user box file Upload of the image file that will be stored as a user box file Upload of the image file that will be the secure print file Hierarchical to No other components Dependencies No dependencies 6 1 1 7 Extension Remaining all information protection Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 63 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target FAD_RIP 1 Protection of all remaining information after explicit deletion operation FAD_RIP 1 1 TSF shall guarantee not to be able to use the content of any information before having been assigned to the resource on the explicit deleting operation to the following objects and the TSF data assignment list of object and list of TSF datal assignment List of object and list of TSF datal lt Obyjects gt User Box
9. Setting of Trusted Channel SSL TLS encryption communication Function gt Create or import SSL TLS server certificate gt Setting of encryption method that is used for communication Setting of Transmission address data gt Setting of address or method that is used for box file transmission etc gt Import S MIME certificate gt Setting of encryption method that is used for data encryption Setting of FAX server function gt Selecting ON or OFF gt FTP service is the function to manage counter information such as the number of prints per user gt Each account and user information can also be managed with counter information 1 4 3 6 Service Engineer Function TOE provides a management function of administrator and a maintenance function such as adjusting the device for Scan Print etc within the service mode that only a service engineer can operate The following shows the functions related to the security Modification function of administrator password The followings are the operation setting function related especially to the behavior of the security function Authentication setting of the service engineer with the CE4 password gt Select ON or OFF Setting of remote diagnostic function later description gt Able to select permission or prohibition Setting of a TOE update function via Internet gt Able to select permission or prohibition Setting of maintenance function gt Able to select permi
10. gt HDD physical format function A function to rewrite the entire disk in HDD with a regulated pattern including the signal rows such as the track and sector information The setting of the Enhanced Security function is invalidated along with the execution of this physical format gt Initialization function Function to reset every setting value written in NVRAM to the factory default The setting of the Enhanced Security function is invalidated by executing this initialization function As described above FMT MOF 1 1 FMT _SMF1 and FMT_SMR 1 1 are realized 7 4 FUSER User Function F USER identifies and authenticates the user for the use of MFP various function To the identified and authenticated user it offers the management function of the user password that is Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 97 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target managed in the MFP at the time of machine authentication besides the permission of the use of functions such as F BOX and F PRINT 7 4 1 User Identification and Authentication Function lt Account Authentication User identification and authentication in the synchronized method gt When the access request for the user box and the request for the registration of the secure print file it is identified and authenticated to be a user Account Name account ID is associa
11. FMT_MTD 1 3 permits only the administrator the setting modification of the threshold of the Authentication failure frequency which is the trial frequency of the failure authentication in the user authentication FIA_SOS 1 6 secures the quality verification of the session information used in the user authentication via the network and FIA_SOS 2 secures the quality of the session information which is generated and used lt Necessary requirements for managing session of user who is identified and authenticated gt The duration of session of the user who is identified and authenticated contributes to reduce the chance of attacking associated with unnecessary session connection by ending the session after the panel automatic logoff time elapses with FTA_SSL 8 when it logs in from the panel The change in the panel auto logoff time is limited to the administrator by FMT_MTD 1 3 lt Necessary requirement for managing the identification and authentication information of the user gt When the machine authentication is chosen in a method of the user authentication by FMT_MTD 1 1 the initial registration of a user password in the user s registration is permitted only by the administrator When the machine authentication has been selected in the method of the user authentication the registration of the user ID in the user registration is permitted to the administrator by FMT_MTD 1 10 When the external server authentication has been selec
12. O CHECK CF Validity confirmation of CF TOE verifies that correct CF is installed O TRUSTED PASS The use of Trusted Channel TOE offers the function that communicates via Trusted Channel the following image file which is transmitted and received between MFP and client PC lt Image file transmitted from MFP to client PC gt e User box file lt Image file transmitted from client PC to MFP gt e Image file that will be stored as user box file e Image file that will be stored as secure print file O CRYPTO MAIL The use of encrypted mail TOE offers the function that encrypts and transmits the user box file transmitted from MFP to the correct destination with e mail O AUTH CAPABILITY The support operation to utilize user identification and authentication function TOE supports the necessary operation to utilize the user identification and authentication function by user information management server using ActiveDirectory O CRYPTO CAPABILITY The support operation to utilize cryption function TOE supports the necessary operation to utilize the cryption function by cryption kit Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 25 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target O LOCK HDD CAPABILITY The support operation to utilize HDD lock function TOE supports the necessary operation to utilize the HDD lock function by HDD O LOC
13. FMT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 5 FMT_MTD 1 11 Management of TSF data FMT_MTD 1 1 11 The TSF shall restrict the ability to selection change_default query modify delete clear assignment other operations the assignment list of TSF data to assignment the authorized identified roles assignment list of TSF data Account ID Account password S MIME certificate Transmission address data Encryption passphrase selection change default query modify delete clear assignment other operations assignment other operations Registration lassignment the authorized identified roles Administrator Hierarchical to No other components Dependencies FMT_SMF 1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_MTD 1 12 Management of TSF data FMT_MTD 1 1 12 The TSF shall restrict the ability to selection change_default query modify delete clear assignment other operations the assignment list of TSF data to assignment the authorized identified roles assignment list of TSF data Belonging Account of a user oneself selection change_default query modify delete clear assignment other operations assignment other operations Registration assignment the authorized identified roles Administrator the user who is permitted to use of the account Hierarchical to No other components Dependencies FMT
14. List of Standards Cryptographic Key Generation Algorithm Cryptographic Key sizes FIPS 186 Pseudorandom number Generation Algorithm 128 bit 192 bit 168 bit Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 39 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 256 bit KonicaMinolta KonicaMinolta HDD Encryption Key Generation 128 bit Encryption Algorithm SHA 256 specification standard FCS_COP 1 Cryptographic operations FCS _COP 1 1 The TSF shall perform assignment List of Cryptographic operations in accordance with a specified cryptographic algorithm assignment cryptographic algorithm and cryptographic key sizes assignment cryptographic key sizes that meet the following assignment Jist of standards assignment J st of standards Listed in Table3 Cryptographic operation Relation of Algorithm Key sizes Cryptographic operation lassignment cryptographic algorithm Listed in Table3 Cryptographic operation Relation of Algorithm Key sizes Cryptographic operation assignment cryptographic key sizes Listed in Table3 Cryptographic operation Relation of Algorithm Key sizes Cryptographic operation assignment list of cryptographic operation Listed in Table3 Cryptographic operation Relation of Algorithm Key sizes Cryptographic operation Hierarchical to No other components Dependencies FDP_ITC 1 or FDP
15. assignment the authorized identified roles lassignment the authorized identified roles Administrator FMT_SMR 1 2 2 The TSF shall be able to associate users with roles Hierarchical to No other components Dependencies FIA_UID 1 FIA_UID 2 2 FMT_SMR 1 3 Security roles FMT_SMR 1 1 3 The TSF shall maintain the roles assignment the authorized identified roles assignment the authorized identified roles User FMT_SMR 1 2 3 The TSF shall be able to associate users with roles Hierarchical to No other components Dependencies FIA_UID 1 FIA_UID 2 3 FMT_SMR 1 4 Security roles FMT_SMR 1 1 4 The TSF shall maintain the roles assignment the authorized identified roles assignment the authorized identified roles User who is authorized to use that public user box FMT_SMR 1 2 4 The TSF shall be able to associate users with roles Hierarchical to No other components Dependencies FIA_UID 1 FIA_UID 2 5 FMT_SMR 1 5 Security roles FMT_SMR 1 1 5 The TSF shall maintain the roles assignment the authorized identified roles assignment the authorized identified roles External server FMT_SMR 1 2 5 Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 62 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target
16. ALC_DVS 1 Developer defined life cycle model ALC_LCD 1 Conformance claims ASE_CCL 1 Extended components definition ASE_ECD 1 ST introduction ASE_INT 1 Security objectives ASE_OBJ 2 Class ASE Security Target Evalation Derived security requirements ASE_REQ 2 Security problem definition ASE_SPD 1 TOE summary specification ASE_TSS 1 ATE_COV 2 Class ATE Testing basic design ATE_DPT 1 Tests ATE_FUN 1 Independent testing sample ATE_IND 2 Class AVA Vulnerability analysis AVA_VLA 1 Vulnerability Assessment 6 2 IT Security Requirements Rationale 6 2 1 Rationale for IT Security Functional Requirements 6 2 1 1 Necessity Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 66 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target The correspondence between the security objectives and the IT security functional requirements are shown in the following table It shows that the IT security functional requirements correspond to at least one security objective Table 8 Conformity of IT Security Functional Requirements to Security Objectives 7 Ololojolioiolojojojojojojojojojoj j Security Objective A 3 c 2 f 8 2 5 z z z 5 5 O O g g oIrPlEsl el SGlDIJDBIBVlJoso ey uy FILVIASTAyTe s e SA S O DI Fl OlSlAFIAIA lM lalolalziol2ise m m oo Bi AIT O F S F P alls 18 DYDiwliolio J SIU o
17. As it must be a user who is permitted the use of the secure print file to print it FLA_UID 2 4 and FIA_UAU 2 4 identifies and authenticates that it is a user who is permitted the use of the secure print file FIA_UAU 7 returns for each entered character as feedback protected by the panel and supports the authentication FIA_AFL 1 8 refuses all input acceptances from the panel for 5 seconds in every failure When the authentication failure reaches 1 3 times FIA_AFL 1 5 locks the authentication function for to the concerned secure print file This lock status is released by the administrator s release operation FMT_MTD 1 3 permits only to the administrator the setting of the threshold of the authentication failure frequency that is the trial frequency of the failure authentication in the authentication of the user who is permitted the use of the secure print file When FIA_ATD 1 and FIA_USB 1 relate the secure print internal control ID to the task of acting use FDP_ACC 1 2 and FDP_ACF 1 2 permit the print operation to the secure print file that has a corresponding object attribute to the secure print internal control ID of the subject attribute As for secure print internal control ID FMT_MSA 3I 2 gives the value uniquely identified when the secure print file is registered lt Secure print password gt FMT_MTD 1 8 permits only to the user the registration of the secure print password used for the authentication FIA_SOS 1 5 veri
18. Controller on the flash memory on the MFP controller which builds in the body of the MFP and is loaded and run on the RAM when main power is switched ON The following explains about the unique hardware on the MFP controller the hardware having the interface to the MFP controller and the connection by using RS 232C shown in Figure 2 Compact Flash memory Hereafter use CF as abbreviated name Storage medium that stores the object code of the System Controller of MFP Control Software that is the TOE Additionally it stores the message data of each country s language to display the response accessed through the panel and network This medium also stores various setting values which are needed for the operation of the MFP used for processing of TOE As for security related data various setting values are included except Administrator password CE password HDD lock password encryption passphrase and CF lock password As a feature function the security function CF lock function is installed being possible to set the password and not being possible to read and write unless it agrees to the password Furthermore when the frequency of uniformity of it becomes unsuccessful in password collation the function is also ready to lock the password collation function Flash memory Storage medium that stores the object code of the BIOS Controller of MFP Control Software HDD Option Hard disk drive of 60GB in capacity It is utiliz
19. FMT_MOF 1 1 3 The TSF shall restrict the ability to selection determine the behavior of disable enable modify the behavior off the functions assignment Jist of functions to assignment the authorized identified roles assignment List of functions Account Authentication Function Trusred Channel Function selection determine the behavior of disable enable modify the behavior oft disable modity the behavior of assignment the authorized identified roles Administrator Hierarchical to No other components Dependencies FMT_SMF1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_MOF 1 4 Management of security functions behavior FMT_MOF 1 1 4 The TSF shall restrict the ability to selection determine the behavior of disable enable modify the behavior of the functions assignment Jist of functions to assignment the authorized identified roles assignment Jist of functions Maintenance Function selection determine the behavior of disable enable modify the behavior oft Enable assignment the authorized identified roles Service engineer Hierarchical to No other components Dependencies FMT SMF1 FMT _SMF 1 FMT_SMR 1 FMT_SMR 1 1 Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 54 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security
20. HDD lock password and the encryption passphrase confidential The administrator password the account password the SNMP password the HDD lock password the CF lock password and the encryption Passphrase should be properly changed The service engineer executes the following operation Should not set the value that can be guessed for the CE password Keep the CE password confidential The CE password should be properly changed When the service engineer changes the administrator password make the administrator to change it promptly OE SETTING SECURITY Operation setting of Enhanced Security function The administrator makes the setting of the enhanced security function effective for the operation of TOE The administrator sets Authentication password and Privacy password to set the security level for Authentication operation in SNMPv3 sets uner TOE operation Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 27 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 4 3 Security Objectives Rationale 4 3 1 Necessity The correspondence between the assumptions threats and security objectives are shown in the following table It shows that the security objectives correspond to at least one assumption or threat Table 1 Conformity of Security Objectives to assumptions and Threats Assumption Treat NINGV V ASIAYAS V LAYOsS V ONILLAS V
21. SMF1 FMT _SMF1 FMT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 6 FEMT_SMEF 1 Specification of Management Functions EMT_SME 1 1 The TSF shall be capable of performing the following security management functions assignment List of security management functions to be provided by the TSF assignment list of security management functions to be provided by the TSF Stop Function of Enhanced security function by administrator Operation Method Setting Function of User Authentication Function by administrator Operation Method Setting Function of Account Authentication Function by administrator Operation Setting Function of SNMP password authentication function by administrator Setting function of authentication failure frequency threshold by administrator in the authentication operation prohibition function Backup Function by administrator 9 Restoration Function by administrator 1 8 A user who isn t related with an account name and who was informed of the account password for the account ID from the administrator off line LA part of a backup function corresponds to the inquiry function of TSF data Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 60 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Registration function of account ID by administrator Modification function of account ID by administrator Registration func
22. SNMP password Privacy password and Authentication password is changed Verify that the SNMP password newly set satisfies the following qualities gt It is composed of the characters and by the number of digits shown in Table 11 As described above FIA_SOS 1 2 FMT_MTD 1 3 FMT _SMF1 and FMT_SMR 1 2 are realized 3 Setting of SNMP password authentication function The authentication method in the SNMP password authentication function is set to the Authentication password only or the Privacy password and the Authentication password As described above FMT MOF 1 2 FMT_SMF 1 and FMT_SMR 1 2 are realized 7 3 FSERVICE Service mode function F SERVICE is a series of security function that the service engineer operates such as the service engineer identification authentication function in service mode accessing from a panel and a security management function that includes a change in the CE password and the administrator password Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 95 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 7 3 1 Service engineer identification authentication function It is identified and authenticated the accessing user as the service engineer in response to the access request to the service mode from the panel Offers the CE authentication mechanism that is authenticated by the CE password that
23. TSF shall detect when selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values unsuccessful authentication attempts occur related to assignment List of authentication events assignment Jist of authentication events Authentication for accessing the administrator mode Re authentication for changing the administrator password selection assignment positive integer number an administrator configurable positive integer within assignment range of acceptable values assignment range of acceptable values an administrator configurable positive integer within 1 3 FIA_AFL 1 2 2 When the defined number of unsuccessful authentication attempts has been selection met surpassed the TSF shall assignment ist of actions selection met surpassed Surpassed assignment ist of actions lt Action when it is detected gt Log off from the authentication status of the administrator mode if it is and lock the authentication function which uses the administrator password If it s not under the authentication status lock the authentication function which uses the administrator password lt Operation for recovering the normal condition gt Perform the lock release function offered within the service mode Perform the boot process of the TOE Release process is performed after Administrator authentication lock time by the boot process
24. This security objective generates the Trusted Channel in the transmission and reception such as a user box file and a secure print file and the requirement that relates with the Trusted Channel is necessary FTP_ITC 1 generates the Trusted Channel according to the requirement from the other Trusted IT product and it is applied to the transmission and reception such as the user box file and the secure print file This security objective is satisfied by the completion of this function requirement O CRYPTO MAIL Usage of Encryption mail This security objective regulates the encryption of a user box file when transmitting the user box file by e mail and various requirements related to the encryption are necessary FCS_CKM 1 generates the encryption key 128bit 168bit 192bit or 256bit by using Pseudorandom number Generation Algorithm according to FIPS 186 2 FCS_COP 1 encrypts the user box file by using AES encryption key 128bit 192bit or 256bit of FIPS PUB 197 Git becomes a transmission data of S MIME Also the same requirement encrypts the user box file by using 3 Key Triple DES encryption key 168bit of SP800 67 By the same token it becomes a transmission data of S MIME Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 77 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target FCS COP 1 encrypts these encryption keys are encrypted by RSA
25. access control FDP_ACF 1 2 1 The TSF shall enforce the following rules to determine if an operation among controlled subjects and controlled objects is allowed assignment rules governing access among controlled subjects and controlled objects using controlled operations on controlled objects assignment rules governing access among controlled subjects and controlled objects using controlled operations on controlled objects lt Operation control to Personal user box gt A task to act for a user is permitted to do the list display operation to the user box with the user attribute user ID of an object attribute corresponding to the user attribute user ID of the subject attribute lt Operation control to Group user box gt A task to act for a user is permitted to do the list display operation to the user box with the Account Name account ID of an object attribute corresponding to the Account Name account ID of the subject attribute lt Operation control to Public user box gt A task to act for the user who is related to the user attribute user ID is permitted to do the list display operation to the user box where Public is set to the user attributes of the object attribute lt Operational control to User box file gt A task to act for a user is permitted to print transmit E mail transmission FTP transmission SMB transmission FAX transmission and WebDAV transmission download move to other user boxes and copy to the
26. and FDP_ACF 1 1 are realized User attribute change of a public user box The user attribute of the user box can be changed gt Specify the registered user And change to a personal user box for the registered user gt Specify the account ID and then it becomes a group user box that can be accessed by a user who is permitted the use of the concerned account As described above FMT_MSA 1 2 FMT _SMF 1 and FMT_SMR 1 4 are realized Change of a public user box password Change the user box password of the public user box When the user box password newly set satisfies the following qualities it is changed gt Itis composed of the characters and by the number of digits shown in Table 11 gt It shall not be composed of one kind of character As described above FIA_SOS 1 5 FMT_MTD 1 4 FMT_SMF1 and FMT_SMR 1 4 are realized 7 5 3 Group User Box Function 1 Access control function for Group User Box The task to act for the identified and authenticated user has the Account ID as the Account Name that is related to the identified and authenticated user This task is permitted the display of the list of the group user box which has a corresponding user attribute with this account ID As described above FIA_ATD 1 FIA_USB 1 FDP_ACC 1 1 and FDP_ACF 1 1 are realized 2 Access control function to a user box file in a group user box When the user box to operate is selected User Box ID of the user box is related to the task a
27. and v2 Prohibit Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 17 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Authentication Operation when writing using SNMPv3 Valid Setting of HDD lock function Valid Setting of CF lock function Valid Setting of print capture function Prohibit Remote diagnostic function Prohibit Network setting management reset function Prohibit TOE update function via Internet Prohibit Setting function of transmission address data by user Prohibit Operation setting of Trusted Channel function Valid Administrator Authentication lock Time Prohibit for 1 4 minutes CE Authentication Lock Time Prohibit for 1 4 minutes Setting of FTP Server function Prohibit Panel auto log off time System auto reset more than 1 minute The following function becomes as follows at the timing of the operation settings of the Enhanced Security Function but contrary to above mentioned settings this setting can be changed individually Setting of maintenance function Prohibit Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 18 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 2 Conformance Claims 2 1 CC Conformance Claim This ST conforms to the following standard
28. change of the network environment constitution by the malicious person by for instance illegally being changed the address of the SMTP server that relays E mail for the E mail or illegally being changed the address of the DNS server where the domain name is inquired when the address of the SMTP server is used for a search of the domain name For FTP transmission by being likely to use the mechanism of the search of the domain name is concerned about the similar possibility of the incident might be occurred by E mailing Furthermore when the network setting which is related to the address of MFP is modified illegally it assumes the possibility to use the print function to the unauthorized entity from client PC by the user who believes as TOE Especially it becomes a problem if a secure print file which is required to be concealed from other users in the office is transmitted to the unauthorized entity The setting of PC FAX operation and the setting of TSI reception assumes the possibility of unintended box file storing at FAX reception On the other hand O CONFIG regulates that the role to operate the network setting relating to the transmission of TOE the setting of PC FAX operation and the setting of TSI reception are limited to the administrator and so the possibility of this threat is removed OE FEED BACK uses the application regulating that the feedback protected is returned for the entered password by the administrator s authentication and O
29. consists of the character shown in Table 11 gt The CE authentication mechanism by the separate session information is not required because the service mode can only be accessed from the panel Return for each character as feedback for the entered CE password Resets the number of the authentication failure when succeeding in the authentication Not accept the input from the panel for five seconds when the authentication failed When the authentication failure that becomes 1 3 times at total in each authentication function by using the CE password is detected it locks all the authentication functions to use the CE password The access to the service mode is refused gt The administrator specifies the failure frequency threshold by the unauthorized access detection threshold setting function Lock of authentication function is released with F RESET function operated As described above FIA_AFL 1 1 FIA_AFL 1 8 FIA_UAU 2 1 FIA_UAU 7 and FIA_UID 2I 1 are realized 7 3 2 Function offered in service mode When a user is identified and authenticated as a service engineer by the service engineer identification authentication function at the access request to the service mode the use of the following functions is permitted 1 Change of CE password When a user is re authenticated as a service engineer and the new password satisfies the quality it is changed gt Offers the CE authentication mechanism that is re authenticat
30. controller with Video bus It is not pre installed in MFP as standard according to the circumstances in sales but is an optional part but it is an essential component under this ST assumption Panel The exclusive control device for the operation of the MFP equipped with the touch panel of a liquid crystal monitor ten key start key stop key screen switch key etc Main power supply Sub power supply The power switch for activating MFP Network Unit The interface device to connect to the Ethernet It supports 1OBASE T 100BASE TX and Gigabit Ethernet Local Connecting Unit Option A unit that connects the client PC with USB It is available to use Print function through this interface USB The Port to print with local connection It has interface connected directly to MFP controller to backup the setting values to update the TOE in addition to use Print function FAX Unit Option parts A device that is used for the communication for sending and receiving FAX and for the remote diagnosis function described later via public line It is not pre installed in MFP as standard according to the circumstances in sales but is sold as an optional part Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 10 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Scan Unit An automatic manuscript feeder The device that scans i
31. enhanced security function operational settings condition and the security level of SNMPv3 authentication operation are satisfied OE SETTING SECURITY regulates that this is used after the administrator activates the enhanced security function and that the setting of security level for Authentication operation in SNMPv3 sets Authentication password and Privacy password so that this condition is realized Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 29 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 4 3 3 Sufficiency of Threats The security objectives against threats are described as follows T DISCARD MFP Lease return and disposal of MFP This threat assumes the possibility of leaking information from MFP collected from the user O OVERWRITE ALL is that TOE offers the function to overwrite data for the deletion of all area of HDD and initializes the information of NVRAM and CF so that the possibility of the threat is removed by executing this function before MFP is collected Accordingly this threat is countered sufficiently T BRING OUT STORAGE Unauthorized taking out of HDD This threat assumes the possibility that the image data in HDD leaks by being stolen from the operational environment under MFP used or by installing the unauthorized HDD and taking away with the data accumulated in it For the above the possibility of the
32. exposed This threat exists only in the case that the operation setting of PC FAX is meant to work as the operation setting for box storing T ACCESS SETTING An unauthorized change of a function setting condition related to security The possibility of leaking user box file and secure print file rises because malicious person or user changes the settings related to the enhanced security function T BACKUP RESTORE Unauthorized use of Backup function and restoration function The user box file and the secure print file can leak by malicious person or user using the backup function and the restoration function illegally Also highly confidential data such as password can be exposed and each setting values are falsified T BRING OUT CF An unauthorized carrying out of Compact Flash Memory The possibility of the following rises because a malicious person or a user with malicious intent illegally taking out and analyzing a CF in MFP e Leak of setting value SNMP password e Operation by a falsified password SNMP password other operation setting values of various functions e Operation under falsified TOE e Leak of image information existed in the Compact Flash Memory through remaining CF image file 3 4 Organizational Security Policies Recently there are a lot of organizations that demand security of network in office Although a threat of wiretapping activities etc in intra office LAN is not assumed in this ST TOE security environ
33. failure of SNMP password If there is a MIB object to which access is locked the lock is released As described above FIA_AFL 1 3 FIA_AFL 1 4 FIA_AFL 1 5 FIA_AFL 1 6 and FIA_AFL 1 7 are realized 7 1 3 5 Setting of user authentication function Set the following authentication method in a user authentication function Machine authentication Authentication method which utilizes a user password managed on MFP sides External server authentication Authentication method which utilizes a user password managed with a user information management server connected through a network Only Active Directory method is object gt When external server authentication is used the external server authentication setting data Contain the multiple authentication server information such as domain name to which external server belongs needs to be set Set the following authentication method in the account authentication function used with a user authentication function Account authentication function synchronized method The method which utilizes an account ID related to user ID beforehand Account authentication function method not synchronized The method to authenticate by the account ID and the account password at the time of access without utilizing the account ID that related to user ID beforehand Account authentication function not use Utilize only the authentication function by user ID and not utilize the authenticatio
34. file Secure print file On memory image file Stored image file Remaining image file Image related file Transmission addressee data file lt TSF data gt HDD lock password CF lock password Encryption passphrase Administrator password SNMP password User ID User password User Box password Secure print password Account ID Account password S MIME certificate Trusted Channel setting data Remaining TSF data Hierarchical to No other components Dependencies No dependencies 6 1 1 8 Extension Approval of access destination Identification of IT environment becoming an access object from TOE FIA_EID 1 1 FIA_EID 1 1 1 TSF shall demand to succeed in the IT environment entity s HDD identification before the action is taken to IT environment entity s HDD by TOE FIA_NEW 1 2 1 TSF shall stop the start of the action to IT environment entity s HDD identification by TOE if the IT environment entity s HDD identification is failed Hierarchical to No other components Dependencies No dependencies Identification of IT environment becoming an access object from TOE FIA_EID 1 2 FIA_EID 1 1 2 TSF shall demand to succeed in the IT environment entity s CP identification before the action is taken to IT environment entity s CH by TOE FIA_NEW 1 2 2 TSF shall stop the start of the action to IT environment entity s CP identification by T
35. identifies and describes the assumptions for the environment for using the TOE A ADMIN Personnel conditions to be an administrator Administrators in the role given to them will not carry out a malicious act during the series of permitted operations given to them A SERVICE Personnel conditions to be a service engineer Service engineers in the role given to them will not carry out a malicious act during series of permitted operations given to them A NETWORK Network connection conditions for MFP e The intra office LAN where the MFP with the TOE will be installed is not intercepted e When the intra office LAN where the MFP with the TOE will be installed is connected to an external network access from the external network to the MFP is not allowed A SECRET Operational condition about secret information Each password and encryption passphrase does not leak from each user in the use of TOE A SETTING Operational setting condition of Enhanced Security function e MFP with the TOE is used after enabling the enhanced security function e The setting of security level for Authentication operation in SNMPv3 sets Authentication password and Privacy password 3 3 Threats In this section threats that are expected during the use of the TOE and the environment for using the TOE are identified and described T DISCARD MFP Lease return and disposal of MFP When the leaser returned or the discarded MFP were collected secure print
36. in communication with support center of MFP produced by Konica Minolta business technologies Inc it manages the state condition of MFP and the machinery information such as frequency of printing In addition if necessary appropriate service shipment of an additional toner the account claim dispatch of the service engineer due to the failure diagnosis etc is provided Updating function of TOE TOE facilitated with the function to update itself As for the update means there are a method that exists as one of items of remote diagnostic function a method that downloads from FTP server through Ethernet TOE update function via Internet and a method that performs the connection of the memory medium such as USB memory Encryption Communication function TOE can encrypt the data transmitted from client PC to MFP and the data received by download from MFP by using SSL TLS The operation setting of this function is performed by the administrator function S MIME certificate automatic registration function It is the function to register the certificate for S MIME conforms to ITU T X 509 with each transmission address automatically When a certificate is attached in received e mail MFP recognizes user ID according to the information of e mail header and registers the certificate as certificate of the same user ID TOE uses effectively the security function of external entity as HDD and CF The following explains the major functions re
37. of FIPS 186 2 that is a public key of S MIME certificate of each destination This security objective is satisfied by the completion of these plural function requirements O AUTH CAPABILITY Support action to use user identification and authentication function This security objective regulates that the user identification and authentication function is used by the user information management server that is the entity of a necessary IT environment for the security maintenance of TOE and needs various requirements that relate to the encryption Applying FIT_CAP 1 1 the inquiry and the acquirement function for the identification and authentication objective user are achieved for the user identification and authentication function by the ActivrDirectory of the user information management server This security objective is satisfied by the completion of this function requirement O CRYPTO CAPABILITY Support action to use the encryption function This security objective regulates that TOE s support action for the data stored in HDD is encrypted by the encryption kit that is the entity out of TOE and needs various requirements that regulates the support of external entity action Applying FIT_CAP 1 2 the support function to process the image file through encryption function is achieved for the encryption function of the encryption kit This security objective is satisfied by the completion of this function requirement O LOCK HDD CAPABIL
38. of user Administrator authentication lock time PC FAX operation setting TSI receiving setting data lt Type C Object to which back up should be limited gt Secure print file User box file As described above FDP _ACC 1 1 FDP _ACC 1 2 FDP _ACC 1 3 FDP_ACF1 1 FDP_ACF1 2 FDP_ACF1 3 FMT_MOF1 1 FMT_MOF1 2 FMT MOF1 83 FMT_MSA 1 1 FMT_MSA 1 2 FMT_MSA 1 3 FMT_MTD 1 2 FMT_MTD 1 3 FMT_MTD 1 4 FMT_MTD 1 7 FMT_SMF 1 and FMT_SMR 1 2 are realized 7 1 3 10 Operation setting function of HDD lock function lt Modification of HDD lock password gt Change the HDD lock password By using the HDD lock password currently set when it is re authenticated as an administrator and the new password satisfies the quality it is changed Offers the HDD lock password verification mechanism that verified the HDD lock password that consists of the character shown in Table 11 Return in verification for each character as feedback for the entered HDD lock password Verify the HDD lock password newly set if the following qualities are satisfied gt Itis composed of the characters and by the number of digits shown in Table 11 gt It shall not be composed of one kind of character gt It shall not be matched with the current value As described above FIA_SOS 1 4 FLA_UAU 2 2 FIA_UAU 7 FIA_UAU 6 FMT_MTD 1 3 FMT_SMF 1 and FMT_SMR 1 2 are realized 7 1 3 11 Operation setting function of CF lock functio
39. of user box file that are used to enforce the SFP selection choose one of restrictive permissive lassignment other property assignment other property Corresponds with the value of the user box attributes of the user box that selected as a target to store the user box file concerned assignment access control SFP information flow control SFA User box access control FMT_MSA 3 2 3 The TSF shall allow the lassignment the authorized identified roles to specify alternative initial values to override the default values when an object or information is created Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 56 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target lassignment the authorized identified roles None Hierarchical to No other components Dependencies FMT_MSA 1 N A FMT_SMR 1 N A Se FMT_MTD 1 1 Management of TSF data FMT_MTD 1 1 1 When the machine authentication is selected as the User authentication method The TSF shall restrict the ability to selection change_default query modify delete clear assignment other operations the assignment ist of TSF data to assignment the authorized identified roles assignment list of TSF datal User password selection change default query modify delete clear assignment other operations
40. other user boxes to the user box file that have the matched the user box attribute user box ID of the object attribute with the user box attribute user box ID of the subject attribute The MFP address group object is a series of data concerning the address of the main body of MFP such as IP address and the Appletalk printer name Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 42 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target FDP_ACF 1 3 1 The TSF shall explicitly permit access of subjects to objects based on the following additional rules assignment rules based on security attributes that explicitly authorize access of subjects to objects assignment rules based on security attributes that explicitly authorize access of subjects to objects A task to act for the user that has a administrator attribute is permitted to operate displaying of user box list A task to act for the user that has a administrator attribute is permitted to operate the back up the user box file FDP_ACF 1 4 1 The TSF shall explicitly deny access of subjects to objects based on the assignment rules based on security attributes that explicitly deny access of subjects to objects assignment rules based on security attributes that explicitly deny access of subjects to objects None Hierarchical to No othe
41. restoration function All the setting data stored in NVRAM CF and HDD is backed up and re stored except the administrator password the CE password CF lock password HDD lock password and Encryption passphrase As the object related to security due to the relation of confidentiality and completeness the one shown by the following classifications is targeted lt Type A Object to which back up and restoration should be limited gt SNMP password User password Account password Secure print password User Box password lt Type B Object to which restoration should be limited gt A series of data that relates to SMTP server setting A series of data that relates to DNS server setting A series of data that relates to MFP address setting Operation setting data of SNMP password authentication function Setting data of Enhanced Security function Setting data of operation method of user authentication function Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 90 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Authentication failure frequency threshold of authentication operation prohibition function Panel auto logoff time User ID User attribute of user box User box ID S MIME certificate Transmission address data Encryption strength setting data in S MIME function Trusted Channel function setting data Belonging Account
42. the status of CF is confirmed in the CF operation verifying at the time of TOE starting When the CF lock password certainly being set is returned as the result of status confirmation the access to CF is permitted If the CF lock password not being set is returned the access to CF is refused because of an illegitimate possibility As described above FIA_EID 1 2 is realized 7 11 FRESET Authentication Failure Frequency Reset Function F RESET is a function that releases the lock by resetting the authentication failure frequency when the account locks in the administrator authentication and CE authentication 1 CE Authentication function lock release processing function The function is executed by the specific operation and the lock is released by clearing the failure frequency of the CE authentication to 0 after CE authentication lock time As described above FIA_AFL 1 1 is realized 2 Administrator authentication function lock release processing function The function is executed by OFF ON of the main power supply and the lock is released by clearing the failure frequency of the administrator authentication to 0 after the administrator authentication lock time As described above FIA_AFL 1 2 is realized 7 12 RTRUSTED PASS Trust Channel Function E TRUSTED PASS is a function that generates and achieves the Trusted Channel by using SSL or TSL protocol when transmitting and receiving the following image file between client PC an
43. the user function for the public user box which each user shares to store the image file O REGISTERED USER assumes that only the user to whom TOE was registered is permitted to use MFP installing TOE furthermore the operation of the public user box and the user box file in the public user box is restricted only to the user who is permitted by O PUBLIC BOX so that the possibility of the threat is reduced When the user information management server is used the possibility of the threat is reduced because the user identification and authentication function is operated through O AUTH CAPABILITY supporting the operation for the user identification and authentication function by the user information management server of Active Directory and through OE SERVER setting to use the user management by the administrator OE FEED BACK uses the application regulating to return the protected feedback for the entered password in the user s authentication and user box s authentication and OE N SESSION requires the log off operation after the operation ends so that O REGISTERED USER and O PUBLIC BOX are supported sufficiently Accordingly this threat is countered sufficiently T ACCESS GROUP BOX Unauthorized access to a group user box using user function This threat assumes the possibility that an unauthorized operation is performed by using the user function for the group box that is a storage area of image file used by user who is permitted the use of the a
44. use of the external server only Active Directly method is applicable as the method of the user authentication function Because it deals when there are plural user information management servers there is the case which plural authentication server information are included in the external server information setting data Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 87 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target gt Itis composed of the characters and by the number of digits shown in the Table 11 gt It shall not be composed of one kind of character While the external server authentication is effective the user password cannot be registered Also register the belonging account account ID and relate The account setting is necessary beforehand Change of user password Only the user who uses with the machine authentication as User authentication method User password is changed It verifies whether the user password newly set have been satisfied the following qualities gt Itis composed of the characters and by the number of digits shown in the Table 11 gt It shall not be composed of one kind of character User deletion User ID and user password is deleted gt When a personal user box that a concerned user owns exists that personal user box is automatically set to the public user box of user attributes publ
45. user information management server in stead of MFP for the management of user account OE SESSION Termination of session after operation The administrator has the user implement the following operation e After the operation of the secure print file and the operation of user box and user box file end the logoff operation is performed The administrator executes the following operation e After the operation of the various function in administrator mode ends the logoff operation is performed The service engineer executes the following operation e After the operation of the various function in service mode ends the logoff operation is performed OE ADMIN A reliable administrator Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 26 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target The person in charge in the organization who uses MFP will assign a person who can faithfully execute the given role during the operation of the MFP with TOE as an administrator OE SERVICE The service engineer s guarantee The person in charge in the organization that carries out the maintenance management of the MFP educates a service engineer in order to faithfully carry out the given role for the installation of the TOE the set up of TOE and the maintenance of the MFP with TOE The administrator observes the maintenance work of MFP with TOE by a service en
46. 1 ineo 501 ineo 421 ineo 361 Control Software Security Target password that consists of the characters shown in Table 11 for each character as feedback for the entered account password Return Resets the number of authentication failure when succeeding in the authentication Not accept the access from the panel for five seconds when the authentication failed When the authentication failure that becomes 1 3 times at total for the concerned account is detected it locks all the authentication functions to the account gt The administrator specifies the failure frequency threshold by the unauthorized access detection threshold setting function The lock of the authentication function is to perform the lock release function to the concerned account of FADMIN As described above FIA_AFL 1 7 FIA_AFL 1 8 FIA_UAU 2I 6 FIA_UAU 7 and FIA_UID 2 6 are realized When accessing from a network the account is not authenticated after the user authentication but the user and the account are processed with one sequence When authenticating the account the account ID is associated with the user ID and the user ID and the account ID are measured by the session information which is the same as user identification and authentication in the account authentication the synchronized method As described above FIA_ATD 1 and FIA_USB 1 are realized lt Automatic registration of the User ID gt In the case of the External server authen
47. 21 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Hierarchical to No other components Dependencies FDP_ACC 1 FDP_ACC 1 2 FMT_MSA 3 FMT_MSA 3 2 FDP_ACF 1 3 Security attribute based access control FDP_ACF 1 1 3 The TSF shall enforce the assignment access control SFP to objects based on the following assignment list of subjects and objects controlled under the indicated SFP and for each the SFP relevant security attributes or named groups of SFP relevant security attributes assignment Jist of subjects and objects controlled under the indicated SFP and for each the SFP relevant security attributes or named groups of SFP relevant security attributes lt Subject gt lt Subject attributes gt Task substituted for a user gt Administrator attributes lt Object gt SMTP server group object DNS server group object MFP address group object PC FAX operation setting object No Object Attribute assignment access control SFP Setting management access control FDP_ACF 1 2 3 The TSF shall enforce the following rules to determine if an operation among controlled subjects and controlled objects is allowed assignment rules governing access among controlled subjects and controlled objects using controlled operations on controlled objects assignment rules governing access among controlled subjects and controlled objects using controlled operations on controll
48. ADVYOLS LNO ONIYE L XOd ALVAlYd SSA9DOV L XOd OINNENd SSADOV L XOd dNOYD SSS090V L INIYd SYNDAS SSADOV L ONILLAS SSA0DOV L AYOLSSAY dNMOVE L d9 LNO ONIYE L VLVG NOILVOINNNWOO d Security objectives O CRYPTO MAIL O CRYPTO CAPABILITY O LOCK HDD CAPABILITY O LOCK CF CAPABILITY O AUTH CAPABILITY IA a a H HARSANA ANANE AS AH HI EEREZEREEEE tt ft TT TTT ANININININININISISISISINTS ee EH HLEH Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 28 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 4 3 2 Sufficiency of Assumptions The security objectives for the assumptions are described as follows A ADMIN Personnel Conditions to be an Administrator This condition assumes that administrators are not malicious With OE ADMIN the organization that uses the MFP assigns personnel who are reliable in the organization that uses the MFP so the reliability of the administrator is realized A SERVICE Personnel Conditions to be a Service Engineer This condition assumes the service engineer are not malicious With OE SERVICE the organization that manages the maintenance of the MFP educates the service engineer Also the administrator needs to observe the maintenance of the MFP so that the reliability of service engineers is assured A NETWORK Network Connection Conditions for the MFP This condition assumes th
49. C All Rights Reserved 58 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target FMT_MTD 1 7 Management of TSF data FMT_MTD 1 1 7 The TSF shall restrict the ability to selection change_default query modify delete clear assignment other operations the assignment ist of TSF data to assignment the authorized identified roles assignment List of TSF datal SNMP password User password Account password User box password Secure print password selection change_default query modify delete clear assignment other operations query assignment the authorized identified roles Administrator Hierarchical to No other components Dependencies FMT_SMF 1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_MTD 1 8 Management of TSF data FMT_MTD 1 1 8 The TSF shall restrict the ability to selection change_default query modify delete clear assignment other operations the assignment list of TSF data to assignment the authorized identified roles assignment List of TSF datal Secure print password selection change_default query modify delete clear assignment other operations assignment other operations Registration assignment the authorized identified roles User Hierarchical to No other components Dependencies f FMT_SMF 1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 3
50. Class name FIT Support for IT environment entity Meaning of abbreviation FIT Functional requirement for IT environment support Class behaviour This class contains a family specifying the requirement related with the use of the security service provided by IT environment entity One family exists here Use of IT environment entity FIT_CAP Family behaviour This family corresponds to the capability definition for TOE at the use of security function of IT environment entity Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 37 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Component leveling FIT_CAP Capability of using IT environment entity Meaning of abbreviation CAP CAPability of using it environment FIT_CAP 1 Capability of using security seervice of IT environment entity corresponds to the substantiation of capability needed to use the security function correctly provided by IT environment entity Audit FIT_CAP 1 The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP ST a Minimal Failure of operation for IT environment entity b Basic Use all operation of IT environment entity success failure Management FIT_CAP 1 The following actions could be considered for the management functions in FMT There is no management activity expec
51. E N SESSION requires to logoff after the operation ends so that O CONFIG is supported sufficiently Accordingly this threat is countered sufficiently T ACCESS SETTING Unauthorized change of function setting condition related to security This threat assumes the possibility of developing consequentially into the leakage of the user box file and the secure print file by having been changed the specific function setting which relates to security O CONFIG regulates that only the administrator is permitted to perform the setting of the enhanced security function that controls all setting function related to a series of security and so the possibility of the threat is removed OE FEED BACK uses the application regulating that the feedback protected is returned for the entered various passwords by the administrator s authentication and OE N SESSION is also requested to logoff respectively after the operations of the administrator mode ends so that O CONFIG is supported sufficiently Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 32 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Accordingly this threat is countered sufficiently T BACKUP RESTORE Unauthorized use of back up function and restoration function This threat assumes a possibility that the user box file and the secure print file may leak since the back up function or the restora
52. FMT_MTD 1 9 Management of TSF data FMT_MTD 1 1 9 The TSF shall restrict the ability to selection change_default query modify delete clear assignment other operations the assignment list of TSF data to assignment the authorized identified roles assignment list of TSF data CE password CE authentication lock time selection change_default query modify delete clear assignment other operations modify l assignment the authorized identified roles Service Engineer Hierarchical to No other components Dependencies FMT_SMF 1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 1 FMT_MTD 1 10 Management of TSF data FMT_MTD 1 1 10 The TSF shall restrict the ability to selection change_default query modify delete clear assignment other operations the assignment ist of TSF data to assignment the authorized identified roles assignment List of TSF datal User ID selection change_default query modify delete clear assignment other operations Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 59 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target assignment other operations Registration l assignment the authorized identified roles Administrator External server Hierarchical to No other components Dependencies FMT_SMF 1 FMT_SMF 1
53. ICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 53 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target The TSF shall restrict the ability to selection determine the behavior of disable enable modify the behavior of the functions assignment Jist of functions to assignment the authorized identified roles assignment ist of functions Enhanced Security Setting selection determine the behavior of disable enable modify the behavior oft disable assignment the authorized identified roles Administrator Service Engineer Hierarchical to No other components Dependencies FMT_SMF1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 1 FMT_SMR 1 2 FMT_MOF 1 2 Management of security functions behavior FMT_MOF 1 1 2 The TSF shall restrict the ability to selection determine the behavior of disable enable modify the behavior off the functions assignment Jist of functions to assignment the authorized identified roles assignment Jist of functions User Authentication Function S MIME function SNMP password authentication function selection determine the behavior of disable enable modify the behavior oft modity the behavior of assignment the authorized identified roles Administrator Hierarchical to No other components Dependencies FMT SMF 1 FMT _SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_MOF 1 3 Management of security functions behavior
54. INC All Rights Reserved 82 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Functional Requirements Component for this ST i FMT_MTD 1 2 FMT_MTD 1 3 FMT_MTD 1 4 FMT_MTD 1 5 FMT_MTD 1 6 FMT_MTD 1 7 FMT_MTD 1 8 FMT_MTD 1 9 FMT_MTD 1 10 FMT_MTD 1 11 FMT_MTD 1 12 FMT_SMF 1 FMT_SMR 1 1 FMT_SMR 1 2 FMT_SMR 1 3 FMT_SMR 1 4 FMT_SMR 1 5 FMT_SMR 1 6 FTA _SSL 3 FTP_ITC 1 FNEW_RIP 1 FIA_EID 1 1 FIA_EID 1 2 FIT_CAP 1 1 FIT_CAP 1 2 Dependencies on CC Part 2 Dependencies Relation in this ST MT_SMR 1 MT_SMF 1 MT_SMR 1 MT_SMF 1 MT_SMR 1 MT_SMF 1 MT_SMR 1 MT_SMF 1 MT_SMR 1 MT_SMF 1 MT_SMR 1 MT_SMF 1 MT_SMR 1 MT_SMF 1 MT_SMR 1 MT_SMF 1 MT_SMR 1 MT_SMF 1 MT_SMR 1 MT_SMF 1 MT_SMR 1 MT_SMF 1 MT_SMR 1 2 FMT_SMR 1 3 yy MT_SMR 1 2 MT_SMF 1 MT_SMR 1 2 FMT_SMR 1 4 FMT_SMF 1 FMT_SMR 1 2 FMT_SMR 1 3 3 FMT _SMF1 FMT_SMR 1 1 FMT_SMR 1 2 F N F 5 z gja aja z rj m yy MT_ Al AL MT_SMR 1 2 FMT_SMF 1 FMT SI FMT_ ai Al Al oy z rj en MT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 4 gja yy yy NIA PA UDI FA UID FA UID Nee A Pose a C s aO Oooo o O k o Nons O OMA y O FIT_CAP 1 3 FIT_CAP 1 4 Yon Non Non Jon Non Non Non T Ton D Non None e None None None None None N A None e 6 2 2 Rationale fo
55. ITY Support action to use the HDD lock function This security objective regulates that TOE S support action refuses the unauthorized access from MFP other than the one that is set by the HDD that is the entity out of TOE and needs various requirements that regulates the support of external entity action Applying FIT_CAP 1 3 the support function to change the HDD lock password and to release the HDD lock function for the HDD lock function achieved by the HDD This security objective is satisfied by the completion of this function requirement O LOCK CF CAPABILITY Support action to use the CF lock function This security objective regulates that TOE S support action refuses the unauthorized access from MFP other than the one that is set by the CF that is the entity out of TOE and needs various requirements that regulates the support of external entity action Applying FIT_CAP 1 4 the support function to change the CF lock password and to release the CF lock function for the CF lock function achieved by the CF This security objective is satisfied by the completion of this function requirement gt set admin Set of necessary requirement to keep administrator secure lt Identification and Authentication of an administrator gt FIA_UID 2 2 and FIA_UAU 2 2 identifies and authenticates that the accessing user is a administrator FIA_UAU 7 returns for each character entered as feedback protected in the panel and supports the authenticatio
56. K CF CAPABILITY The support operation to utilize CF lock function TOE supports the necessary operation to utilize the CF lock function by CF 4 2 Security objectives for the operation environment In this section the security objectives for the environment in the operation environment of the usage of the TOE is described OE CRYPT Utilization of Encryption function The admnistrator buys a license of encryption protection chip to set encryption of image files stored in HDD under this TOE Then the administrator sets encryption kit with service engineer to encrypt image files to be written in HDD inside MFP OE FEED BACK Utilization of application to show secure password The administrator and user utilize the application of a browser etc used by client PC to access MFP that offers the appropriate feedback protected for input user password user box password account password administrator password secure print password and SNMP password OE LOCK HDD Utilization of HDD with HDD lock function The service engineer and the administrator install HDD with HDD lock function in MFP and set to utilize the function OE LOCK CF Utilization of CF with CF lock function The service engineer and the administrator install CF with CF lock function in MFP and set to utilize the function OE SERVER Utilization of user information management server The administrator sets to utilize user management by Active Directory in case of using external
57. Moreover these management functions are specified by FMT_SMF 1 This security objective is satisfied by the completion of these multiple functional requirements O PRIVATE BOX personal user box access control This security objective limits access to the personal user box and the user box file in the personal user box to only the user who owns that user box and needs various requirements that relate to the access control lt User box access control a personal user box gt After the user has been identified and authorized the user ID is related to the task of acting a use by FIA_ATD 1 and FIA_USB 1 By FDP_ACC 1 1 and FDP_ACF 1 1 the task of acting the user has a user ID and is permitted to display the list of the user box with a corresponding user attribute In addition after the user box has been selected when the user box ID is related to the task of acting a use by FIA_ATD 1 and FIA_USB 1 the operation such as a print a download transmissions a movement and a copy is permitted to the user box file that has a corresponding object attribute to user ID and user box ID of the subject attribute lt Management of a personal user box gt FMT_MSA 1 1 permits to the user and the administrator the change operation of the user attribute of the user box where the user ID is set As for the registration of the user box public is appointed to the user attribute of the user box by FMT_MSA 3 1 and it is permitted only to the user bei
58. OE if the IT_ 11 TSF data remaining in the HDD data area that cannot be deleted only by the deletion of the file management area Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 64 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target environment entity s CF identification is failed Hierarchical to No other components Dependencies No dependencies 6 1 1 9 Extension Capability of using IT environment entity FIT_CAP 1 1 Capability of using security service of IT environment entity FIT_CAP 1 1 1 TSF shall provide the necessary capability to use the service for assignment security service provided by IT environment entity assignment necessary capability list for the operation of security servicel assignment security service provided by IT environment entity User identification and authentication function of user information management server using ActiveDirectory assignment necessary capability list for the operation of security service Inquirey function of authentication information for the identification and authentication target user Acquirement function of authentication information for the identification and authentication target user Hierarchical to No other components Dependencies No dependencies FIT_CAP 1 2 Capability of using security s
59. OImMI F Zz vjoj l lo M O x x Z m lt o sizl lzlolk 7 x lt zZ gt Hail l zl s E 2 Cc rr dp rio vse Security 2 a 2 Z D z Functional D 7 5 Requirements lt taomni set service TX x x x xjx J TJ hh ICSi E i ETRE is EE Fes copa SSCS TTSS B Fop accan TXT XTX x fT tT T fFoP_acc i S CT TXT XT TT i pies FoP acca TT EXT OT TTT ht ht FDP_ACF fi TXT XTX x oT fT ft ht fFDP_acr if2 TT TXT XT TT T a ee I ae fFDP_acr i s TT TT EXT TT TT ft ht Fa artan TET TTT TT TT ot fT ht J3 Fia arta o Pie O T fx Fa arta TT TE EXT TTT T ee ie ee Fia arta TXT OT CT CT CT S TCT PAARS E AE Tea SP he iTS id es a De ee Fia arta TXT CT S CT CT CT rT CT FAREA WO 25 a a Fia artas TX TXT XTX TT Tx Xx PRAGA Det ee eT ee E all ailiaay asosan ee ea x Fia sosa TTX TT TT Sain aie Fia sosai SX S S SSTT TT a p Fia sosa o S TXT SS fFia_sos s f TX TXT XT TTT eee ee ed Fasos X x oT S UT CUT CT rT xt fFiacsos2 x x d CUT CT CT TC ae a i eae fFiAuAU 2i S CT CT CT CT TT S 3 CH a GD GA ee es ee Fia_uau 23 TXT S UT CT CT CT TT Fia uau TXT OT CT CTT O Fia_uau 25 TXT CT S CT CT CT TT fFiauau zi S TXT S S CT UT Fia uaus S SSS S TXT UT CT CT x
60. OS 1 1 verifies the quality of the administrator password Moreover FIA_SOS 6 verifies the quality of session information used to authenticate the administrator via the network and FIA_SOS 2 secures the quality of session information that is generated and used FMT_MTD 1 6 restricts the change in the administrator password to the administrator and the service engineer When the administrator changes the administrator password FIA_UAU 6 re authenticates it In this re authentication when the failure authentication reaches 1 3 times FIA_AFL 1 2 logoffs it if it s under authentication and releases the authentication status of the administrator from then on And it locks all the authentication functions to use the administrator password The release function is executed by starting TOE with turning OFF and ON the power supply so that the lock is released after the administrator authentication lock time passed lt Role and management function for each management gt FMT_SMR 1 1 have service engineer maintain the role to do these management and FMT_SMR 1 2 have the administrator do the same Additionally FMT_SMF 1 specifies these management functions gt set service Set of necessary requirement to keep service engineer secure lt Identification and Authentication of a service engineer gt FIA_UID 2 1 and FIA_UAU 2I1 identifies and authenticates that the accessing user is a service engineer FIA_UAU 7 returns every one character en
61. Part 2 Dependencies Relation in this ST FIA_UID 2 7 FIA_USB 1 TA_ATD 1 IA i FIA_ATD FMT_SMF 1 FMT_SMF 1 FMTZMOF 11 FMT_SMR 1 FMT_SMR 1 1 FMT_SMR 1 2 FMT_MOF 1 2 FMT_SMF 1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_MOF 1 3 FMT_SMF 1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_MSA 1 1 FMT_MSA 1 2 FMT_MSA 1 3 FMT_MSA 3 1 Neither is applicable lt The reason not to apply FMT_MSA 1 gt This is the internal control ID that is identified uniquely and this does not require the management FMT_MSA 3 2 such as change or deletion after this is assigned once lt FMT_SMR 1 gt The assignment of FMT_MSA 3 2 2 is not applicable FMT_SMR 1 is the dependency that is set relating to the following and so there is no necessity of application FMT_MSA 1 Neither is applicable FMT_SMR 1 lt The reason not to apply FMT_MSA 1 gt The user box attribute of a user box file always needs to correspond with the user box Therefore the value only has to be given at the time of storage It is not necessary to change the value of this attribute FMT_MSA 3 3 at the time of other operational timing Accordingly the management requirement is unnecessary lt FMT_SMR 1 gt The assignment of FMT_MSA 3 2 3 is not applicable FMT_SMR 1 is the dependency that is set relating to the following and so there is no necessity of application FMT_MTD 1 1 FMT_SMF 1 FMT_SMF 1 Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES
62. Setting of Trusted Channel function Set the setting data of Trusted Channel function by SSL TLS Communication Encryption Strength Setting Modification of the communication encryption method Operation and Stop Setting of theTrusted Channel function As described above FMT MOF 1 3 FMT _SMF1 and FMT_SMR 1 2 are realized 7 1 3 17 Setting of S MIME transmission function Set the setting data which are used when the user box file is S MIME transmitted Transmission address data e mail address Registration and modification of S MIME certificate Setting of Encryption Strength for S MIME function As described above FMT_MOF 1 2 FMT_MTD 113 FMT_MTD 1 11 FMT_SMF1 and FMT_SMR 1 2 are realized 7 1 3 18 Setting of PC FAX Set the setting data of FAX related settings as follows PC FAX operation Setting gt Setting either of two modes at PC FAX operation which are to store in each box and to store in common area for all users according to the desiginated information at FAX transmission TSI receiving Setting gt Setting the storing box at TSI receiving relating the transimitter s telephone number with the box as the identification information of transimitter s terminal As described above FDP_ACC 1 3 FDP_ACP 1 3 FMT_MTD 1 3 FMT_SMF 1 and FMT_SMR 1 2 are realized Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 93 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 i
63. Target FMT_MSA 1 1 Management of security attributes FMT_MSA 1 1 1 The TSF shall enforce the assignment access control SFP information flow control SFP to restrict the ability to selection change_default query modify delete assignment other operations the security attributes assignment J st of security attributes to assignment the authorized identified roles assignment list of security attributes User attributes of the user box that is set user s own user ID selection change default query modify delete assignment other operations Modify modify to other user s User ID account ID or publicl assignment the authorized identified roles User Administrator assignment access control SFP information flow control SFP User box access control Hierarchical to No other components Dependencies FDP_ACC 1 or FDP_IFC 1 FDP_ACC 1 1 FMT_SMF 1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 3 FMT_MSA 1 2 Management of security attributes FMT_MSA 1 1 2 The TSF shall enforce the assignment access control SFP information flow control SFP to restrict the ability to selection change_default query modify delete assignment other operations the security attributes assignment J st of security attributes to assignment the authorized identified roles assignment list of security attributes User attributes of user box that is set the public selection change default quer
64. USINESS TECHNOLOGIES INC All Rights Reserved 100 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target printing the E mail transmission include the S MIME transmission the FTP transmission the FAX transmission the SMB transmission WebDAV transmission download the removing to other user boxes and the copy operations to other user boxes As described above FIA_ATD 1 FIA_USB 1 FDP_ACC 1 1 and FDP_ACF 1 3 are realized 3 User attribute change of a personal user box The user attributes can be changed gt If another registered user is specified it becomes a personal user box that another user manages gt If public is specified it becomes a public user box It is necessary to register the user box password In this case it is verified that the user box password meets the following requirements It is composed of the characters and by the number of digits shown in Table 11 It shall not be composed of one kind of character gt Ifaccount ID is specified it becomes a group user box that can be accessed by a user who is permitted the use of the concerned account As described above FIA_SOS 1 5 FMT_MSA1 1 FMT_SMF1 and FMT_SMR 1 4 are realized 7 5 2 Public User Box Function When the user is identified and authenticated as a registered user the task to act for the user who is identified and authenticated has User ID of the identified and authenticated user
65. Xx FIAUAU 7 EX TXT XI XT TTJ Tf 33 Fia uban S SS ee Th keke A ees Fia uipa S S CT SaS SO xt Fia uD SX S S UT UT CT UT CT UT ee ee ee Faua S EXT UT CUT hE CU Faba pE Ea i LT aS wile a ae Eiai SEAE Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 67 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target x x Security Objective YASN GSaysALSIDAY O MVAN OLdAYO O ALIMEVdVO HLNV O ulwpe es SOIAI8S 8S Security ALIIEVdVO OLdAYS O ALIMIEVdV9 4D A9OT O Functional Requirements FAD_RIP 1 FIA_EID 1 1 FIA_EID 1 2 is a FIT_CAP 1 1 Er capa t eee elo ea AE el et e TTT teat Tod fmt Doe TTT fee xe ora efi et Pe ITITI eet Pf T Doel ef af Xan CuO A teat Peal TT teat TT Meet e A eed inaano PLL TT A Pee Pe TI Det Iste T T eel nlp af SN PE TTT TT TT TTT TT TEE Tamano CECE tT bt TTT TTT TEE TE TE EE aoao tte TTT TT TTT TTT TT ETT EEE EE e 4003H 0 fae Ef Pe Spa AIEEE e E ee E e E E rere U D lt gt 4 m i O x lt az m poe I i m ia zz Zz a i a O eal za de i x PLT TT ee fef ote Doel te TTT T Pe T T feet T e Note set admin and set service indicates the set of the requirements And the security objectives assumed to have the correspondence and presented by X also correspond t
66. _ITC 2 or FCS_CKM 1 FCS_CKM 1 only a part of events FCS_CKM 4 N A Table 3 Cryptographic Operation Relation of Algorithm Keysizes Cryptographic Operation List of standards Cryptographic Cryptographic Contents of Cryptographic operation algorithm key sizes FIPS PUB 197 128 bit Encryption of S MIME transmission data 192 bit 256 bit SSP800 67 3 Key Triple DES 168 bit Encryption of S MIME transmission data FIPS 186 1 RSA 1024 bit Encryption of cryptographic key to encrypt 2048 bit S MIME transmission data 3072 bit 4096 bit Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 40 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 6 1 1 2 User data protection FDP_ACC 1 1 Subset access control FDP_AGC 1 1 1 The TSF shall enforce the assignment access control SFP on assignment List of subjects objects and operations among subjects and objects covered by the SFP assignment list of subjects objects and operations among subjects and objects covered by the SFP Listed in Table4 User box access control operational list assignment access control SFP User Box access control Hierarchical to No other components Dependencies FDP _ACF1 FDP_ACE 1 1 Table 4 User Box Access Control Operational List Operational List A task to act for
67. a user A List of user boxes User Box File Print Transmission E mail transmission FTP transmission SMB transmission FAX transmission and WebDAV transmission Download Move to other user boxes Copy to other user boxes Backup FDP_ACC 1 2 Subset access control FDP_AGC 1 1 2 The TSF shall enforce the assignment access control SFP on assignment List of subjects objects and operations among subjects and objects covered by the SFP assignment list of subjects objects and operations among subjects and objects covered by the SFP Listed in Tabel5 Secure print file access control operational list lassignment access control SFP Secure print file access control Hierarchical to No other components Dependencies FDP_ACF1 FDP_ACF1 2 Table 5 Secure Print File Access Control Operational List Operational list A task to act for a user Secure Print File Access Control A List of Secure Print Files Print Back Up FDP_ACC 1 3 Subset access control FDP_ACC 1 1 3 The TSF shall enforce the assignment access control SFP on assignment List of subjects objects and operations among subjects and objects covered by the SFA assignment list of subjects objects and operations among subjects and objects covered by the SFP Listed in Table6 Setting management access control operational list assignment access control SFP Setting management access control Cop
68. and fax exists as a basic function and TOE performs the core control in the operation of these functions It converts the raw data acquired from the external device of the MFP controller into the image file and registered in RAM and HDD After two or more conversion processing is done the conversion is done as for the print image file from PC The image file which has been converted into data for the print or for the transmission and is transmitted to the device outside of the MFP controller concerned Operations of copy print scan and fax are managed by the unit of job and can be changed the operation order can be modified the finishing if it s a printing job and can be cancelled the operation by the command from the panel The following is the functions related to the security in the basic function Secure Print Function Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 11 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target When the Secure Print password is received with the printing data the image data is stored as the standby status And the print command and password input from the panel allows printing This function in the printing operation by the client PC removes the possibility that other users stole a glance at the printing of high leveled confidential data and lost it into the other printings 1 4 3 2 User Box Functio
69. arentheses after a label means that the functional requirement is used repeatedly lt Method of clear indication of dependency gt The label in the parentheses in the dependent section indicates a label for the security functional requirements used in this ST When it is a dependency that is not required to be used in this ST it is described as N A in the same parentheses 6 1 TOE Security Requirements 6 1 1 TOE Security Function Requirements 6 1 1 1 Cryptographic Support FCS_CKM 1 Cryptographic key generation FCS _CKM 1 1 The TSF shall generate cryptographic keys in accordance with a specified cryptographic key generation algorithm assignment cryptographic key generation algorithm and specified cryptographic key sizes assignment cryptographic key sizes that meet the following assignment Jist of standards lassignment list of standards Listed in Table Cryptographic key generation Relation of Standards Algorithm Key sizes lassignment cryptographic key generation algorithm Listed in Table Cryptographic key generation Relation of Standards Algorithm Key sizes assignment cryptographic key sizes Listed in Table Cryptographic key generation Relation of Standards Algorithm Key sizes Hierarchical to No other components Dependencies gt _FCS_CKM 2 or FCS_COP 1 FCS_COP 1 FCS_CKM 4 N A Table 2 Cryptographic Key Generation Relation of Standards Algorithm Key sizes
70. as the user attribute This task is permitted the display of the list of the public user box which is set the public as the user attribute The operation specification of each public user box is as follows As described above FIA_ATD 1 FIA_USB 1 FDP_ACC 1 1 and FDP_ACF 1 1 are realized Authentication function in access to a public user box For the access request for each public user box after the above mentioned verification function is operated the user who accesses is authenticated that it is a user permitted the use of a user box concerned respectively gt Offers the user box authentication mechanism that is authenticated by the user box password that consists of the character shown in Table 11 After the user box is authenticated to the access from the network it offers the user box authentication mechanism using the session information besides the user box password gt According to protocol it utilizes the 101 session information or more or generated and uses the 10 session information or more v Return for each character as feedback for the entered user box password v Resets the number of authentication failure when succeeding in the authentication gt Incase of the access from the panel when it fails in the authentication an input from the panel is not accepted for five seconds gt When the authentication failure that becomes the 1 3 times in total is detected for the public user box concer
71. ase as the current setting Hierarchical to No other components Dependencies No dependencies FIA_SOS 1 5 Verification of secrets FIA_SOS 1 1 5 Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 49 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target The TSF shall provide a mechanism to verify that secrets Secure Print Password Box Password Account Password meet assignment a defined quality metricl assignment a defined quality metric Number of digits 8 digits or more Character type ASCII code 0x20 0x7E Rule Do not composed by only the same kind of character strings Hierarchical to No other components Dependencies No dependencies FIA_SOS 1 6 Verification of secrets FIA_SOS 1 1 6 The TSF shall provide a mechanism to verify that secrets Session Information meet lassignment a defined quality metricl assignment a defined quality metric 101 and above Hierarchical to No other components Dependencies No dependencies FIA_SOS 2 TSF Generation of secrets FIA_SOS 2 1 The TSF shall provide a mechanism to generate secrets Session information that meet lassignment a defined quality metric assignment a defined quality metric 10 and above FIA_SOS 2 2 The TSF shall be able to enforce the use of TSF generated secrets f
72. assignment other operations Registration assignment the authorized identified roles Administrator Hierarchical to No other components Dependencies FMT_SMF 1 FMT_SMF 1 FAT_SMR 1 FMT_SMR 1 2 FMT_MTD 1 2 Management of TSF data FMT_MTD 1 1 2 When the machine authentication is selected as the User authentication method The TSF shall restrict the ability to selection change_default query modify delete clear assignment other operations the assignment ist of TSF data to assignment the authorized identified roles lassignment ist of TSF data User s own user password selection change_default query modify delete clear assignment other operations modity assignment the authorized identified roles User Administrator Hierarchical to No other components Dependencies EMT_SMF1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 3 FMT_MTD 1 3 Management of TSF data FMT_MTD 1 1 3 The TSF shall restrict the ability to selection change_default query modify delete clear assignment other operations the assignment list of TSF data to assignment the authorized identified roles assignment list of TSF datal User ID Account ID Account password Secure print password Panel auto log off time Threshold Number of authentication failure External server authentication setting data S MIME certificate
73. at when the encryption protection chip is installed the encryption key necessary to encrypt all the data written in HDD is generated and needs various requirements that relate to the encryption key generation Using KonicaMinolta HDD encryption key generation mechanism SHA256 according to KonicaMinolta encryption specification standard FCS_CKM 1 generates the 128bit encryption key This security objective is satisfied by the completion of this function requirement O CHECK HDD Validity confirmation of HDD This security objective regulates that it verifies the validity of HDD in order to confirm the unauthorized HDD doesn t exist and needs various requirements that relate to the verification of an external entity from TOE FIA_EID 1 1 identifies HDD before the action from TOE to HDD and cancels the scheduled action when the identification fails This security objective is satisfied by the completion of this function requirement O CHECK CF Validity confirmation of CF This security objective regulates that it verifies the validity of CF in order to confirm the unauthorized CF doesn t exist and needs various requirements that relate to the verification of an external entity from TOE FIA_EID 1 2 identifies CF before the action from TOE to CF and cancels the scheduled action when the identification fails This security objective is satisfied by the completion of this function requirement e O TRUSTED PASS Usage of Trusted Channel
74. at there are no wiretapping activities for the intra office LAN and no access by an unspecified person from an external network OE NETWORK regulates the wiretapping prevention by the installation of devices such as a wiretapping detection device and device to perform the encryption communication on the intra office LAN It also regulates the unauthorized access prevention from external by the installation of devices such as firewall in order to block access to the MFP from the external networks so that this condition is realized A SECRET Operating condition concerning confidential information This condition assumes each password and encryption passphrase using for the use of TOE should not be leaked by each user OE SECRET regulates that the administrator makes the user to execute the operation rule concerning the secure print password the user box password user password and account password and that the administrator executes the operation rule concerning the administrator password the HDD lock password the CF lock password SNMP password encryption passphrase and account password It also regulates that the service engineer executes the operation rule concerning the CE password and that the service engineer makes the administrator to execute the operation rule concerning the administrator password so that this condition is realized A SETTING Enhanced Security Function Operational Settings Condition This condition assumes the
75. ated to the address of MFP Backup function Restoration function The setting function of HDD Lock function The setting function of CF Lock function Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 24 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target e The setting function of Encryption function e The setting function of Trusted Channel function setting data e The setting function of certification transmission address data etc used for S MIME function e The setting of TSI receiving e The setting of PC FAX operation TOE permits the operation of the following functions only to the administrator and the service engineer e The function related to the setting of Enhanced Security function O OVERWRITE ALL Complete overwrite deletion TOE overwrites all data regions of HDD and CF in MFP by using the deletion data and makes all the image data of restoration impossible In addition TOE offers a function to initialize a setting value such as the highly confidential password on NVRAM Administrator Password HDD Lock Password Encryption Passphrase and password on CF SNMP Password that is set by a user or an administrator O CRYPT KEY Encryption key generation TOE generates the encryption key to encrypt and store the image file written in HDD in MFP O CHECK HDD Validity confirmation of HDD TOE verifies that correct HDD is installed
76. bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target KONICA MINOLTA bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software AORS50Y0 0100 G00 11 AORS5O0YO 1D00 G00 10 Security Target This document is a translation of the evaluated and certified security target written in Japanese Version 1 13 Issued on August 12 2008 Created by KONICA MINOLTA BUSINESS TECHNOLOGIES INC Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 1 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target lt Revision History gt Date Ver Division Revision 2008 03 20 1 00 Development Yamazaki Div 11 2008 04 18 1 01 Development Yamazaki Div 11 2008 05 12 1 02 Development 2008 05 15 1 03 Development 2008 05 23 1 04 Development Yamazaki eee Div 11 2008 06 09 1 06 Development Yamazaki Div 11 2008 06 11 1 07 Development Yamazaki Div 11 2008 07 17 1 08 Development 2008 07 18 1 09 Development Yamazaki Div 11 2008 07 31 1 10 Development Yamazaki Div 11 Div 11 Div 11 Div 11 ee ey Initial Version Kakutani Deal with typos Correspond to CCv3 1R2 Kakutani Add description of FAX related Function Setup for PC FAX and TSI reception Deal with typos Deal with expression Correspond to CCv3 1R2 resid
77. but the validity of CF installed by TOE is verified by O CHECK CF the replaced CF does not work The possibility of the threat is removed consequently Accordingly this threat is countered sufficiently 4 3 4 Sufficiency of Organizational Security Policies Security objective corresponding to organizational security policies is explained as follows PCOMMUNICATION DATA secure communication of image file This organizational security policy prescribes carrying out processing via trusted pass to a correct destination or encrypting to ensure the confidentiality about the image file which flows on a network in the case of the organization or the user expect to be protected As this corresponds as one s request there is no need to provide secure communication function for all communication At least one secure communication method between MFP and client PC needs to be provided when transmitting the secure print file or the user box file O TRUSTED PASS offers the Trusted Channel to a correct destination in the transmition and reception of an image such as from MFP to client PC or from client PC to MFP for the user box file and the secure print file that is a confidential image so that the organizational security policies is achieved Also the security objective offers the transmission function to a correct destination by encrypting the user box file transmitted by e mail from MFP to client PC by O CRYPTO MAIL so that the organizational security pol
78. cation password Privacy password for Authentication operation Setting of HDD lock function gt Selecting ON or OFF gt Register or change the HDD lock password when ON is selected Setting of CF lock function gt Selecting ON or OFF gt Register or change the CF lock password when ON is selected Setting of encryption function only when the encryption protection chip installed gt Selecting ON or OFF gt Register or change the Encryption passphrase when ON is selected 3 Abbreviation of Transmtting Subscriber Identification The Same meaning of Identification of Subscriber s Termnal TSI receiving is the function that can designate the Box to be stored for each Subscriber Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 14 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Setting of user box collective management function gt Select the permission or the prohibition for the user box collective management function Setting of the print capture function gt A function to verify the print data received by MFP when print function breaks down gt Selecting ON or OFF for the above mentioned function Setting of network setting management reset function gt Anetwork setting management reset function resets a series of items in a factory default gt Selecting permission or prohibition for the above mentioned function
79. ccesteceneeteneeceneeesieeeeeeeeseeseaeeessaeseaeessaeeseeeseeeteeees 83 T TOE Summary Specification sisii at ee et eee eee 85 7 1 FADMIN Administrator Function 0 ccccceeececeeeee cece cere eeeeceeeaeeeeeeeeeeseceeaeeaeeeeeeeeeececeaeeeeeeeeseeeaas 85 7 1 1 Administrator identification authentication FUNCTION cecccceseeeeenneetenneeetseneeeetseneeetseeeeeseeeeeeseeesensaaeetneneeeens 85 7 1 2 Auto logoff function Of administrator mode cceeeeeeeeneeeeteneeeeesnneeeteeeeeeteeeeeeseaeeeseeaaeeeseneeeeeseneeeseneeetseneneess 86 7 1 3 Function offered in Administrator MOE uu eeeeeeeeenceeeeneeeeteneeeeteeneeesseneeeesenneeesteanesesenaeeetseneeessenneeesenaeetseneneegs 87 Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 3 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 7 2 FADMIN SNMP SNMP administrator function 20 02 22 ce cece ceeeeeee eee ee eeeeene aces eeeeeeeeeenaaaeeeeeeeeteeeneaas 94 7 2 1 Identification and authentication function by SNMP password cscccecceeeeeeneeeseeeeneeeteaeeteaeeteaeeseaeetsaeeseneetes 94 7 2 2 Management function using SNMP ccccccccccseeeteseeceneeceaeeteneeceaaeesaaeeeaaeessaeesaeeseaeeseaeeseaeeseaeessaeeseeeeseneseeatenes 95 7 3 F SERVICE Service mode function 20 cceeeeeeceeeeeee cece eeee cece eaeeeeeeeeeeseceaaeeaeeeeeeeseeeecaeaeeeeeeseseeeeas 95 7 3 1 S
80. ccount or the user box file in it O REGISTERED USER assumes that only the user to whom TOE was registered is permitted to use MFP installed TOE furthermore the operation of the group user box and user box file in the group user box is restricted only to the permitted userby O GROUP BOX so that the possibility of the threat is removed When the user information management server is used the possibility of the threat is reduced because the user identification and authentication function is operated through O AUTH CAPABILITY supporting the operation for the user identification and authentication function by the user information management server of Active Directory and through OE SERVER setting to use the user management by the administrator OE FEED BACK uses the application regulating to return the protected feedback for the entered password in the user s authentication and account s authentication and OE N SESSION also requires the log off operation after the operation ends so that O REGISTERED USER and O GROUP BOX are supported sufficiently Accordingly this threat is countered sufficiently T ACCESS SECURE PRINT Unauthorized access to a secure print file using user function This threat assumes the possibility that an unauthorized operation is done to the secure print using user function O REGISTERED USER assumes that only the user to whom TOE was registered is permitted to use MFP installing TOE furthermore the operation of the secure p
81. character and number of digits used for password 12 Objectives Number Characters of digits CE Password 8 digits 92 characters in total can be selected ASCII code 0x21 0x7E except 0x22 and 0x2B Number 0 9 Alphabet Capital letter and small letter Administrator Password Symbols amp G o 75 5 53 5552 Lgl Waa otal ghee HDD Lock Password 20 digits 83 characters in total can be selected ASCII code 0x21 0x7E except 0x22 0x28 0x29 0x2C 0x3A 0x3B 0x3E 0x3F 0x5B 0x5C and 0x5D Number 0 9 Alphabets Capital letter and small letter Symbols amp lt oy tle 95 character in total can be selected more ASCII code 0x21 0x7E Account Password 8 digits Number 0 9 Alphabets Capital letter and small letter SNMP Password 8 digits or 93 characters in total can be selected Privacy Password more ASCII code 0x20 0x7E except 0x5C Authentication Password Number 0 9 Alphabets Capital letter and small letter Symbols amp 5 35 lt wll a tates Oa ee eae a Encryption passphrase 7 1 2 Auto logoff function of administrator mode While accessing an administrator mode from a panel if not accepting any operation during the panel automatic logoff time it logs off the administrator mode automatically 12 Table 11 shows the minimum passowrd space as the secuity specification Therefore the excluded characters a
82. cies FIA_UID 1 FIA_UID 2 3 FIA_UAU 2 4 User authentication before any action FIA_UAU 2 1 4 The TSF shall require each user User who is permitted to use secure print file to be successfully authenticated before allowing any other TSF mediated actions on behalf of that user User who is permitted to use secure print file Hierarchical to FIA_UAU 1 Dependencies FIA_UID 1 FIA_UID 2 4 FIA_UAU 2 5 User authentication before any action FIA_UAU 2 1 5 The TSF shall require each user User who is permitted to use the public user box to be successfully authenticated before allowing any other TSF mediated actions on behalf of that user User who is permitted to use the public user box Hierarchical to FIA_UAU 1 Dependencies FIA_UID 1 FIA_UID 2 5 FIA_UAU 2 6 User authentication before any action FIA_UAU 2 1 6 The TSF shall require each user User who is permitted to use the account to be successfully authenticated before allowing any other TSF mediated actions on behalf of that user User who is permitted to use the account Hierarchical to FIA_UAU 1 Dependencies FIA_UID 1 FIA_UID 2I 6 FIA_UAU 6 Re authenticating FIA_UAU 6 1 The TSF shall re authenticate the use under the conditions assignment ist of conditions under which re authentication is required assignment list of conditions under which re authentication is required When the administ
83. curity Target Component leveling FIA_EID External entity identification Meaning of abbreviation EID External entity IDentification FIA_EID 1 IT environment entity identification becoming an access object of TOE requires the success of validity verification for IT environment entity before the action is involved in IT environment entity Audit FIA_EID 1 The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP ST a Minimal Unsuccessful use of IT environment entity identification mechanism including offered IT environment entity identification information b Basic Use all of IT environment entity identification mechanism including offered IT environment entity identification information Management FIA_EID 1 The following actions could be considered for the management functions in FMT a management of IT environment entiry identification information Identification of IT environment becoming an access object from FIA_EID 1 TOE FIA_EID 1 1 TSF shall demand to succeed in the IT environment entity s identification before the action is taken to_IT environment entity by TOE FIA_EID 1 2 TSF shall stop the start of the action to IT environment entity by TOE if the IT environment entity s identification is failed Hierarchical to No other components Dependencies No dependencies 5 1 3 FIT_CAP 1 Definition
84. d MFP User box file download from MFP to client PC Image file that will be stored as a user box file upload from client PC to MFP Image file that will be stored as Secure Print file upload from client PC to MFP Image file that will be stored as ID amp Print file upload from client PC to MFP As described above FTP_ITC 1 is realized Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 106 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 7 13 7 14 7 15 F S MIME S MIME Encryption Processing Function F S MIME is a function to encrypt the User box file when transmitting the User box file as S MIME lt User box file Encryption Key generation gt The Encryption key is generated to encrypt the user box file by the pseudorandom number Generation Algorithm which FIPS 186 2 provides Encryption key length is 128bit 168bit 192bit or 256bit As described above FCS_CKM 1 is realized lt Encryption of User box file gt It is encrypted by AES which FIPS PUB 197 provides by using encryption key 128bit 168bit and 256bit to encrypt the user box file It is encrypted by the 3 Key Triple DES which SP800 67 provides by using the encryption key 168bit to encrypt the user box file As described above FCS_COP 1 is realized lt Encryption of User box file Encryption key gt The encryption key to encrypt the us
85. d Security Function Each value set is prohibited changing itself into the vulnerable one individually As the function that does not have a setting function of the operation individually there is the reset function of the network setting and the update function of TOE through the network but the use of these functions is prohibited The following explains the series of the setting condition of being the enhanced security function active In order to activate the enhanced security function the prerequisite is required that an administrator password and a CE password should be set along with the password policy Setting of user identification and authentication function Valid Either the machine authentication or the external server authentication are available User Setting of access of PUBLIC Prohibit Setting of a service engineer authentication function Valid Setting of password policy function Valid Setting of secure print authentication method Authentication operation prohibition function effective method Setting of Authentication Operation Prohibition function It becomes in the state of the panel lock for five seconds at the time of the authentication failure in the panel And it becomes the account lock Failure Frequency threshold 1 3 times Setting of User Box Prohibit Setting of user box collective management function Prohibit Setting of the network setting modification function with SNMPv1
86. d gt Deny all access from the panel lt Operation for recovering the normal condition gt Automatically release the lock after 5 seconds Hierarchical to No other components Dependencies FIA_UAU 1 FIA_UAU 2 1 FIA_UAU 2 2 FIA_UAU 2 3 FIA_UAU 2 4 FIA_UAU 2 5 FIA_UAU 2 6 FIA_ATD 1 User attribute definition FIA_ATD 1 1 The TSF shall maintain the following list of security attributes belonging to individual users assignment Jist of security attributes lassignment list of security attributes User attributes User ID User box attributes User box ID File attributes Secure print internal control ID Account name Account ID Administrator Attribute Hierarchical to No other components Dependencies No dependencies Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 48 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target FIA_SOS 1 1 Verification of secrets FIA_SOS 1 1 1 The TSF shall provide a mechanism to verify that secrets Administrator Password CE Password meet assignment a defined quality metric assignment a defined quality metric Number of digits 8 digits Character type ASCII code 0x21 Ox7E except 0x22 and0x2B Rule Do not compose by only the same kind of character strings Q Do not set the same password as the current sett
87. d in the paragraphs described below Table 10 The list of the name and identifier of TOE Security function 6 RPRINT Secure print function o O 8 RcRYPT Encryption key generation function 9 FVALIDATION HDD HDD validation function F VALIDATION CF CF validation function 13 F S MIME S MIME encryption processing function 14 F SUPPORT AUTH External Server authentication operation support function 15 F SUPPORT CRYPTO Cryption kit operation support function F SUPPORT HDD HDD lock operation support function F SUPPORT CF CF lock operation support function 7 1 FADMIN Administrator Function F ADMIN is a series of security function that administrator operates such as an administrator identification authentication function in an administrator mode accessing from a panel or through a network and a security management function that includes a change of an administrator password and a lock cancellation of a locked user box Nevertheless all functions are not feasible functions through both a panel and a network 7 1 1 Administrator identification authentication function It identifies and authenticates the accessing user as the administrator in response to the access request to the administrator mode Offers the administrator authentication mechanism authenticating by the administrator password that consists of the character shown in Table 11 gt Offers the administrator authentication mechanism using the sessi
88. d with the Account Name account ID in the security attribute of the subject is set It is required to be a user who is permitted the use of the group user box to operate the user box file in the group user box When the Account authentication method is the method not synchronized FIA_UID 2 6 and FIA_UAU 2 6 identifies and authenticates that it is a user who is permitted the use of the group user box When the account authentication method is synchronized method and the Account that user belongs to is not registered FIA_UID 2 6 and FIA_UAU 2 6 identifies and authenticates that it is a user who is permitted the use of the account FIA_UAU 7 returns for each entered character as feedback protected by the panel and supports the authentication In the case of the failure authentication from the panel FIA_AFL 1 8 refuses all input acceptances from the panel for 5 seconds in every failure When the authentication failure reaches 1 3 times FIA_AFL 1 7 locks the authentication function for that account from Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 72 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target then on This lock status is released by the administrator s release operation FMT_MTD 1 3 permits only the administrator the setting of the threshold of the unauthorized access detection value that is the trial frequency of the failu
89. ddress group object and PC FAX operation setting object lt Operation limitation of Backup and restoration function gt When the administrator attribute is related to the task of acting the use by FIA_ATD 1 and FIA_USB 1 the task of acting the user is permitted the back up operation of the user box files by FDP_ACC 1 1 and FDP_ACF 1 1 the secure print files by FDP_ACC 1 2 and FDP_ACF 1 2 In addition the restoration operation is permitted for SMTP server group object DNS server group object MFP address group object and PC FAX operation setting object by FDP_ACC 1 3 and FDP_ACF 1 3 Moreover the restoration operation is permitted for the enhanced security setting data by FAT_MOF 111 the Trusted Channel setting data by FMT_MOF 1 3 the user attribute of the user box by FMT_MSA 1 1 FMT_MSA 1 2 and FMT_MSA 1 3 the user password by FMT_MTD 1 2I the user ID the SNMP password the panel auto logoff time the authentication failure frequency the secure print password the external authentication setting data the account ID the account password the S MIME certificate the transmission address data the belonging account of user administrator authentication lock time TSI receiving setting by FMT_MTD 1 3 the restoration operation modification operation is permited only to the administrator for objective data of the user box password by FMT_MTD 1 4 FMT_MTD 1I 7 permits only to the administrator the backup o
90. e eeneeeeeeeneeeeeeenaeeeeeeaeeeeeenaeeeeeneeeeeees 105 7 9 FVALIDATION HDD HDD verification function 0 0 00 eeceeee cece eee eeeeeeeeeaeeeeeeeeeeeeeteaaeeeeeeeetees 105 7 10 FVALIDATION CF CF verification function cee ee ceeetee eee eeeeee cece eaeeeeee sete seeceneeaeeeeeeeetees 106 7 11 F RESET Authentication Failure Frequency Reset Function ccccceceseeeeeeseeeeeeeseneeeeees 106 7 12 F TRUSTED PASS Trust Channel Function 0 0 0 0 cccceeceeeeee eee eeee eee eeeeaeeeeeeeeeeseseneeeaeeeeeeeetees 106 7 13 F S MIME S MIME Encryption Processing FUnction c cceeecseeeeseeeeeeeenneeeeeenneeeeeneeeeeees 107 7 14 FSUPPORT AUTH External Server authentication operation support function 0 107 7 15 FSUPPORT CRYPTO Cryption kit operation Support function 0 ee eeeeeeeeeteeeeeeeeeeeeeeee 107 7 16 F SUPPORT HDD HDD lock operation support function 0 0 eee eeee teen eee eeenneeeeeeeeeeeeee 108 7 17 FSUPPORT CF CF lock operation Support function 0 ee cece eeeeteeeeeteeneeeeeenteeeeetetaeeeeee 108 Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 4 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target List of Figures 02 0000ns0e0snseenenennnennnnnnennnen Figure 1 An example of the expected environment for usage of the MFP
91. e jurisdiction of a user such as the use of MFP ended by the lease return or being disposed or the case of an HDD or CF theft a user has concerns about leak possibility of every remaining data Therefore in this case the following data files become protected assets e Secure Print File e User Box File e On Memory Image File gt Image file of job in the wait state e Stored Image File gt Stored image files other than secure print file and user box file e HDD remaining Image File gt The file which remains in the HDD data area that is not deleted only by general deletion operation deletion of a file maintenance area e CF remaining Image File gt The file which remains in the Compact Flash memory data area that is not deleted only by general deletion operation deletion of a file maintenance area The data leak possibility does not exist when HHD is preinstalled as standard When HDD is not preinstalled and image file happens to be in CF this leakage possibility exists Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 20 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target e File related to the Image gt Temporary data file generated in print image file processing e Transmission Address Data File gt File including E mail address and telephone numbers that become the destination to transmit an image 3 2 Assumptions The present section
92. e security function requirement to explain the protection of the remaining information exists only in FDP_RIP 1 for the user data There is no security function requirement to satisfy this requirement gt Reason for applied class FAD There is no requirement to explain both of the user data and the TSF data with no distinction Therefore new Class was defined gt Reason for applied family RIP As this is the extension upto the TSF data by using the content explained by the relevant family of FDP class the same label of this family was applied FIA EID 1 This is the security function requirement for regulating the conditions at the access to external entity from TOE gt Necessity of extension This is the approval of the action involved by TOE istsef to the external entity not the action of access to TOE from the external entity There is no security function requirement to satisfy this requirement gt Reason for applied class FIA As this regulates to distinguish the external entity FIA class is optimal to summarize the vaious security function requirements for identification certification gt Reason for applied family EID This requirement is judged to be not relevant to the content extension of the existing family Therefore new Family was defined FIT_CAP1 This is the security function requirement for regulating the necessary ability for TOE to use effectively the security function of the external entity IT environment gt N
93. ecessity of extension In case of TOE using the external security functions the external security function to be surely secure is important but TOE ability to provide is very important in order to used correctly the external security function But there is no concept as this requirement in the security function requirements gt Reason for applied class FIT There is no such concept in CC part 2 Therefore new Class was defined gt Reason for applied family CAP As similar to class there is no such concept in CC part 2 Therefore new Family was defined Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 35 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 5 1 1 FAD_RIP 1 Definition Class name FAD Protection of all data Meaning of abbreviation FAD Functional requirement for All Data protection Class behaviour This class contains a family specifying the requirement related with the protection of the user data and the TSF data with no distinction One family exists here Remaining Information Protection of All Data FAD_RIP Family behaviour This family corresponds to the necessity never to access the deleted data or newly created object and TSF data which should not set as accessible This family requires the protection for the information that was deleted or released logically but has a possibility to exist still in TOE
94. ed 7 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 1 4 2 Phisical Range of TOE 1 4 2 1 Environment for the usage Figure 1 shows the expected general environment for the usage of MFP equipped with TOE Moreover the matters assumed in the environment for the usage show by a run of the item below Office MFPre TOE SMTP Server DNS Server FTP Server Ni j 7 lps External Network Public line User Information Management Client PC Figure 1 An example of the expected environment for usage of the MFP The intra office LAN exists as a network in the office The MFP connects to the client PCs via the intra office LAN and has mutual data communication When the SMTP server or FTP server or WebDAV server are connected to the intra office LAN the MFP can carry out data communication with these Need the DNS Service when setting the Domain name of SMTP Server or FTP Server or WebDAV server The case which is unifying management of the user ID and the user password in the server also assumes In this case TOE can control the access to the MFP by using the user registration information in the user information ma
95. ed besides the image data is stored as a file Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 9 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target temporarily image data with such as extension conversion and as an area where the transmission address data kept As a feature function the security function HDD lock function is installed being possible to set the password and not being possible to read and write unless it agrees to the password Furthermore when the frequency of uniformity of it becomes unsuccessful in password collation the function is also ready to lock the password collation function It is not pre installed in MFP as standard according to the circumstances in sales but is an optional part but it is an essential component under this ST assumption NVRAM Nonvolatile Memory The memory medium that stores various setting values needed for the operation of the MFP used for processing of TOE Encryption Kit or Encryption Protection Chip Option The cryptographic function which is mounted in the Encryption Kit the hardware on the MFP Controller is installed in order to encipher image data to be written in HDD or CF Encryption Protection Chip sold as an optional part is necessary to work encryption function Image Controller Option parts The controller for image conversion process that be connected to MFP
96. ed by the CE password that consists of the characters shown in Table 11 gt Resets the number of authentication failure when succeeding in the re authentication gt Return for each character as feedback for the entered service codes in the re authentication gt When the authentication failure that becomes 1 3 times at total in each authentication function by using the CE password is detected it logoffs the service mode accessing from the panel and locks all the authentication functions to use the CE password The access to the service mode is refused The administrator specifies the failure frequency threshold by the unauthorized access detection threshold setting function v The F RESET function operates to release the lock of the authentication function gt It verifies that the CE password newly set satisfies the following qualities It is composed of the characters and by the number of digits shown in the Table 11 It shall not be composed of one kind of character It shall not be matched with the current value Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 96 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target As described above FIA_AFL 1 1 FIA_SOS 1 1 FIA_UAU 2I1 FIA_UAU 6 FIA_UAU 7 FMT_MTD 1 9 FMT_SMF 1 and FMT_SMR 1 1 are realized 2 Change of administrator password Change the administrator password Veri
97. ed objects A task act for a user who has a administrator attribute is permitted to set the SMTP server group object the DNS server group object the MFP address group object and the PC FAX operation setting object and to operate the restoration FDP_ACF 1 3 3 The TSF shall explicitly authorize access of subjects to objects based on the following additional rules assignment rules based on security attributes that explicitly authorize access of subjects to objects assignment rules based on security attributes that explicitly authorize access of subjects to objects None FDP_ACF 1 4 3 The TSF shall explicitly deny access of subjects to objects based on the assignment rules based on security attributes that explicitly deny access of subjects to objects assignment rules based on security attributes that explicitly deny access of subjects to objects None Hierarchical to No other components Dependencies FDP_ACC 1 FDP_ACC 1 3 FMT_MSA 3 N A 6 1 1 3 Identification and authentication FIA_AFL 1 1 Authentication failure handling FIA_AFL 1 1 1 The TSF shall detect when selection assignment positive integer number an administrator configurable positive integer within assignment range of acceptable values unsuccessful authentication attempts occur related to assignment List of authentication events assignment list of authentication events Authenticatio
98. entified and authorized the user ID is related to the task of acting a use by FIA_ATD 1 and FIA_USB 1 FDP_ACC 1 1 and FDP_ACF 1 1 permits the list display operation to the user box where public is set to the user attribute to the task of acting the user who has user ID It is required to be a user who is permitted the use of the user box to operate the user box file in the public user box FIA_UID 2 5 and FIA_UAU 2 5 identifies and authenticates that it is a user who is permitted the use of the user box FIA_UAU 7 returns for each entered character as feedback protected by the panel and supports the authentication In the case of the failure authentication from the panel FIA_AFL 1 8 refuses all input acceptances from the panel for 5 seconds in every failure When the authentication failure reaches 1 3 times FIA_AFL 1 6 locks the authentication function for that user from then on This lock status is released by the administrator s release operation FMT_MTD 1 3 permits only to the administrator the setting of the threshold of the unauthorized access detection value that is the trial frequency of the failure authentication in the authentication of the user who is permitted the use of the user box When FIA_ATD 1 and FIA_USB 1 relates a user box ID to the task of acting use FDP_ACC 1 1 and FDP_ACF 1 1 permit the user box file that has a corresponding object attribute to the user box ID of the subject attribute and is set public to the
99. er box file is encrypted by RSA which FIPS 186 2 provides The key length of the encryption key used in this case is 1024 bit 2048bit 3072bit or 4096bit As described above FCS_COP 1 is realized F SUPPORT AUTH External Server authentication operation support function F SUPPORT AUTH is the function that realizes the user identification and authentication function in cooperation with the user information management server of ActiveDirectory the function that operates with FUSER When the user information management server is used for user identification method the inquiry for the identification of the user is done for the user information management server under the user s request of the identification and authentication process After this inquiry the user identification and authentication process is realized by getting the user identification information returned back from user information management server As described above FCS_CAP 1 1 is realized FSUPPORT CRYPTO Cryption kit operation support function F SUPPORT CRYPTO is the function that operates the cryption function by cryption kit under TOE support The encryption process for the image files written in HDD is achieved through the cryption kit by setting the encryption key that F CRYPTO generates on it Furthermore the decryption process for the image files read from HDD is achieved through the cryption kit by setting the encryption key that F CRYPTO generates on i
100. ervice engineer identification authentication FUNCTION cccccceccceeessceetenceeeseneeeeseaeeesenseeessensesesenaesesenseeess 96 7 3 2 Function offered in service mode iecerei r a ea e a aa a a a eai aiae 96 TA FUSER User FUNCION cridia araa anaa a rea aAA Eaa da APES eare N e ERa nekera aahi 97 7 4 1 User Identification and Authentication Function ccccccccceessceeeeeeecesnneeeeeeeeeneeeeeeeeeeseneaaeeeeetetenessasseeeteeeeaaes 98 7 4 2 Auto logoff function in user identification and authentication domain seesseeessseeesirneerreerinnerrrererrnnsennens 99 7 4 3 Modification function of user PASSWOLO cccecceeeeneeteeneeeetenneeeetenneeesenaeeesseneeeeeseneeeseeaaeeeseeeeesneaeesenaaeetseneeeess 99 7 5 BOX User BOX FUNGON eesriie ct ccaveeesedceceadaastadeceesseugsapastsieveusheeseuaalccecchcaselasvabanecscea shave 100 7 5 4PersonaliOser Box FUunCuon e a a a a a a a aa a aaa a a E a aeara aaae e eaan ES 100 7o 2 Ppl USEF BOX FUON O r aa a a a a a a a dante ddan tess aaae a re areon a nET 101 7 5 3 Group User Box FUNGON atana a EA h ea a ad ets es 102 7 6 F PRINT Secure Print FUNGON ieena inaasa eeeeeeeeeeeeaeeeeeeeeeseseaaaeeseeeeeeeseeeeeeeaeeeeeeeess 103 7 6 1 SeCUre PANEFUNCHON e tek ree Ah ee PA is Re SE ee ak 103 7 7 F OVERWRITE ALL All area overwrite deletion fUNCtION cceccecceeeteeeeeeeeeeeeeteteeeeeeeeetes 104 7 8 F CRYPT Encryption key generation function cee ce
101. ervice of IT environment entity FIT_CAP 1 1 2 TSF shall provide the necessary capability to use the service for assignment security service provided by IT environment entity assignment necessary capability list for the operation of security servicel assignment security service provided by IT environment entity Encryption function achieved by encryption kit assignment necessary capability list for the operation of security service Support function of the the image files processing by encryption function Hierarchical to No other components Dependencies No dependencies FIT_CAP 1 3 Capability of using security service of IT environment entity FIT_CAP 1 1 3 TSF shall provide the necessary capability to use the service for assignment security service provided by IT environment entity assignment necessary capability list for the operation of security servicel assignment security service provided by IT environment entity ADD lock function achieved by HDD assignment necessary capability list for the operation of security service Support function of modifying HDD lock password Support function of releasing HDD lock function Hierarchical to No other components Dependencies No dependencies FIT_CAP 1 4 Capability of using security service of IT environment entity FIT_CAP 1 1 4 TSF shall provide the necessary capability to use the service for lassignment sec
102. fies the quality of the secure print password lt Necessary requirement to keep the administrator secure gt gt refer to set admin lt Necessary requirement to keep the service engineer secure gt gt refer to set service lt Role and controlling function for each management gt As the role of doing these managements FMT_SMR 1 2 maintains an administrator and FMT_SMR 1 3 maintains a user Moreover FMT_SMF 1 specifies these management functions This security objective is satisfied by the completion of these multiple functional requirements O CONFIG Access limitation to an management function This security objective limits the setting related to the SMTP server the setting related to the DNS server the setting related to the Enhanced Security function the backup function and the restorations function to the administrator and needs various requirements to limit the access to a series of setting function and the management function Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 74 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target lt Management of network setting gt When the administrator attribute is associated with the task of substituting the use FDP_ACC 1 3 and FDP_ACF 1 3 permits the task of substituting the user to operate the SMTP server group object the DNS server group object the settings for the MFP a
103. file a user box file on memory image file the stored image file the HDD remaining image file the CF remaining image file the image related file the transmission address data file and the set various passwords can leak by the person with malicious intent taking out and analyzing an HDD or CF or NVRAM in MFP T BRING OUT STORAGE An unauthorized carrying out of HDD e lt A secure print file a user box file a on memory image file a stored image file a HDD Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 21 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target remaining image file an image related file a transmission address data file and the set up various passwords can leak by a person or a user with malicious intent illegally taking out and analyzing an HDD in MFP A person or a user with malicious intent illegally replaces an HDD in MFP In the replaced HDD new files of the secure print file a user box file on memory image file a stored image file a HDD remaining image file an image related file a transmission address data file and set various passwords are accumulated A person or a user with malicious intent takes out and analyzes the replaced HDD and image files leak T ACCESS PRIVATE BOX Unauthorized access to the personal user box which used a user function Exposure of the user box file when a person or a user with mal
104. fy that the administrator password newly set satisfies the following qualities gt Itis composed of the characters and by the number of digits shown in the Table 11 gt It shall not be composed of one kind of character gt It shall not be matched with the current value As described above FIA_SO8 1 1 FMT_MTD 1 6 FMT _SMF1 and FMT _SMR 1I 1 are realized 3 Release of the lock of administrator authentication function Reset 0 clear the number of authentication failure for the administrator authentication gt If access is locked the lock is released As described above FIA_AFL 1 2 is realized 4 Setting of CE Authentication Lock Time Set the CE Authentication Lock Time between 1 60 minutes As described above FMT_MTD 1 9 FMT SMF 1 and FMT_SMR 1 1 are realized 5 Function that relates the operation setting of maintenance function Set the operation of the aintenance function Available to change from the halt condition to startup condition As described above FMT MOF 1 4 FMT _SMF1 and FMT_SMR 1 1 are realized 6 Function that relates to Enhanced Security function The functions that influence the setting of the Enhanced Security function that the service engineer operates are as follows gt HDD logical format function Function to write the value of management data using the file system of HDD The setting of the Enhanced Security function is invalidated along with the execution of this logical format
105. gineer OE NETWORK Network Environment in which the MFP is connected The person in charge in the organization who uses MFP carries out the tapping prevention measures by setting the cipher communications equipment and the tapping detection equipment to the LAN of the office where MFP with TOE is installed The person in charge in the organization who uses MFP carries out the measures for the unauthorized access from the outside by setting up the equipment such as the firewall to intercept the access from an external network to MFP with TOE OE SECRET Appropriate management of confidential information The administrator has the user implement the following operation Keep the user password and secure print password confidential Keep the user box password and account password confidential between the user who commonly utilizes it Should not set the value that can be guessed for the user password secure print password and the user box password The user password and the user box password should be properly changed When the administrator changes the user password or the user box password make the user to change them promptly The administrator executes the following operation Should not set the value that can be guessed for the administrator password the account password SNMP password the HDD lock password the CF lock password and encryption passphrase Keep the administrator password account password the SNMP password the
106. gistered box by user Machine non registered users user ID automatic registration function with external server when user authentication method is external server authentication Registration function of secure print password according to secure print file registration by user Modification function of user attribute of user box by user who is permitted the use of public user box Modification function of user box password of the user box by user who is permitted the use of public user box Modification function of the concerned user box s user attribute by user who is permitted the use of the group box 10A part of the restoration function corresponds to the modification function of the TSF data Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 61 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Hierarchical to No other components Dependencies No dependencies FMT_SMR 1 1 Security roles FMT_SMR 1 1 1 The TSF shall maintain the roles assignment the authorized identified roles lassignment the authorized identified roles Service Engineer FMT_SMR 1 2 1 The TSF shall be able to associate users with roles Hierarchical to No other components Dependencies FIA_UID 1 FIA_UID 2 1 FMT_SMR 1 2 Security roles FMT_SMR 1 1 2 The TSF shall maintain the roles
107. her components Dependencies FMT_SMF 1 FMT_SMEF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 4 FMT_MTD 1 5 Management of TSF data FMT_MTD 1 1 5 The TSF shall restrict the ability to selection change_default query modify delete clear assignment other operations the assignment List of TSF data to assignment the authorized identified roles assignment list of TSF data User box password selection change_default query modify delete clear assignment other operations assignment other operations Registration assignment the authorized identified roles User Administrator Hierarchical to No other components Dependencies FMT_SMF 1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 3 FMT_MTD 1 6 Management of TSF data FMT_MTD 1 1 6 The TSF shall restrict the ability to selection change_default query modify delete clear assignment other operations the assignment list of TSF data to assignment the authorized identified roles assignment list of TSF data Administrator password selection change_default query modify delete clear assignment other operations modity assignment the authorized identified roles Administrator Service Engineer Hierarchical to No other components Dependencies FMT_SMF1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 1 FMT_SMR 1 2 Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES IN
108. his chapter will describe the concept of protected assets assumptions threats and organizational security policies 3 1 Protected Assets Security concept of TOE is the protection of data that can be disclosed against the intention of the user As MFP is generally used the following image file in available situation becomes the protected assets e Secured print file Image file registered by secured print e User Box file Image file stored in the personal user box public user box and group user box As for a image file of a job kept as a wait state by activities of plural jobs and a image file of a job kept that prints the remainder of copies becoming as a wait state for confirmation of the finish and other than the image file dealt with the above mentioned is not intended to be protected in the general use of MFP so that it is not treated as the protected assets In the print of the secure print file and the transmission of the user box file making in the preparation for the threat thought when illegal MFP or mail server is connected by any chance or when operation setting of PC FAX is changed even if without illegal MFP the setting of MFP IP address etc and operation setting of PC FAX require not to be modified illegally Therefore the setting of MFP IP address etc and operation setting of PC FAX are considered as subsidiary protected assets On the other hand when the stored data have physically been separated from th
109. ic Change of the belonging account The belonging account that related to user is changed As described above FIA_SOS 1 3 FMT_MSA 1 1 FMT_MTD 1 1 FMT_MTD 1 2 FMT_MTD 1 12 FMT_SMF 1 and FMT_SMR 1 2 are realized 7 1 3 8 User Box Settings User Box Registration To register a personal user box or a public user box by selecting the user attribute to the non registration user box ID selected When it s registered it is possible to select User ID in the user attribute of the user box which have been specified Public as a default value gt Inthe case of the personal user box the arbitrary user ID registered is specified gt Inthe case of the public user box verify that a user box password registered satisfies the following conditions e Itis composed of the characters and by the number of digits shown in the Table 11 e It shall not be composed of one kind of character gt Specify the arbitrary account ID registered when Group user box Change of User Box Password gt The user box password set to the public user box is changed gt It verifies whether the user box password newly set have been satisfied the following qualities e Itis composed of the characters and by the number of digits shown in the Table 11 e Tt shall not be composed of one kind of character Change of user attribute of user box gt Specify the user attribute of a personal user box to the other user or the account that registered gt Spec
110. ical Range OF TOE a r a casas puch en ida ee a ae a Raa aa aaae a aaa e tanai 11 2 Conf rmance Clam S araoa ani rataan neama nea aabo saddca sean ececpacdecncaesusvecudsCandicevetaccecsdencecceactceas 19 2 1 CC Conformance Claims oeaan ia Wine INA SA e A A a Ae kee aise oe aa ia inaa en 19 PAPAA PP CANIM PONA EEEE EE E TE EEE A EEE E eee ee 19 2 3 P ckage Clairen eer din an ellie pea Eaa a a E e A a aa Ee PON ddata aaa aiaa AEN 19 2A aE O E E E E bene ein ea deel 19 3 Security Problem Definitio M iiir ainaani aa anaa eaa ne ees 20 Side Protected Wa CL AE EEEE TTA T TT E 20 EENT eiO 0 E E EEE T EE ETT 21 3 3 Threats a rea aa aN E E A at een ae ee eee eT ee 21 3 4 Organizational Security POliCi S r a r aa aea ar e aa E e e A Ea Taaa RE TTEN 23 4 Security Oblectives 224 5 a ae ee ee a ee kauaa Eran 24 4 1 Security Objectives for the TOE 0 eee ceeeescseeeeceseceeeceseaeeeeeseaneeeesaaeeeeseaaaeeenesaaaecesneseesesessansenenags 24 4 2 Security objectives for the operation ENVIFONMENL ce eeeeeceeeeeeeeeeeeeeeeeeeeeneeeeeseneaeeeensaeeeeeeaas 26 4 3 Security Objectives Rationale ceccccesssceceeseseeceeeeeeeeeeeensneeeesesaaeeceesaaeeeeeneseeeeseenaaaeneeneneeenags 28 4 3 1 NCCOSSILY este WAS eee a ee A ee i ee NEA 28 4 3 2 Sufficiency of ASSUMPTIONS a5 pne atin eels des Mise tai ai eae 29 4 3 3 Sufficiency Of Threats iz sited erret E aet ET aS EEEE E vie dapat eateries aetna A SEE EEE 30 4 3 4 Sufficiency of Organi
111. ical to FIA_UID 1 Dependencies No dependencies Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 52 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target FIA_UID 2 7 User identification before any action FIA_UID 2 1 7 The TSF shall require each user External Server to be successfully identified before allowing any other TSF mediated actions on behalf of that user External Server Hierarchical to FIA_UID 1 Dependencies No dependencies FIA_USB 1 User subject binding FIA_USB 1 1 The TSF shall associate the following user security attributes with subjects acting on the behalf of that user assignment Jist of user security attributes l assignment Jist of user security attributes User attributes User ID User box attributes User box ID File attributes Secure print internal control ID Account name Account ID Administrator Attribute FIA_USB 1 2 The TSF shall enforce the following rules on the initial association of user security attributes with subjects acting on the behalf of users assignment rules for the initial assocication of attributes assignment rules for the initial assocication of attributes lt User box attribute gt the user box ID of the concerned user box associates to the task acting on the behalf of users when authenticated with the access t
112. icies is achieved Furthermore Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 33 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target O CONFIG restricts the Trusted Channel function setting data the management of the user box files encryption by e mail and the transmission address data to the administrator And then OE FEED BACK uses the application regulating that the protected feedback is returned for the entered password in the administrator s authentication and OE SESSION is also regulated to log off after the operations of the administrator mode ends so that O CONFIG is supported Accordingly this organizational security policies is sufficiently to achieve Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 34 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 5 Extended Components Definition 5 1 Extended Function Component In this ST three extended function components are defined The necessity of each security function requirement and the reason of the labeling definition are described FAD RIP 1 This is the security function requirement for the protection of the remaining information of user data and TSF data gt Necessity of extension The regulation for the protection of the TSF data remaining information is necessary But th
113. icious intent accesses the user box where other user owns and downloads prints and transmits the user box file E mail transmission FTP transmission fax transmission SMB transmission and WebDAV transmission T ACCESS PUBLIC BOX Unauthorized access to public box which used a user function Exposure of the user box file when a person or the user with malicious intent accesses the public user box which is not permitted to use and downloads prints transmits E mail transmission FTP transmission FAX transmission SMB transmission and WebDAV transmission and removes and copies to the other user box the user box file T ACCESS GROUP BOX Unauthorized access to the group user box which used a user function Exposure of the user box file when a person or the user with malicious intent accesses the group user box which the account where a user does not belong to owns and downloads prints transmits E mail transmission FTP transmission FAX transmission SMB transmission and WebDAV transmission and removes and copies to the other user box the user box file T ACCESS SECURE PRINT Unauthorized access to the secure print file which used a user function Exposure of the secure print file when a person or the user with malicious intent prints the secure print file which is not permitted to use T ACCESS NET SETTING An unauthorized change of network setting Malicious person or user changes the network settings that is related
114. ify the user attribute of group user box to the user or the other account that Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 88 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target registered gt Specify the user attribute of public user box to the user or account that registered gt Specify the user attribute of a personal user box or group user box to public e The registration of a user box password is necessary at the same time and then the processing which is similar to a change of the above mentioned user box password should be done As described above FIA_SOS 1 5 FMT_MSA 1 1 FMT_MSA 1 2 FMT _MSA 1 3 FMT_MSA 3 1 FMT_MTD 1 4 FMT_MTD 1 5 FMT_SMF 1 and FMT_SMR 1 2 are realized 7 1 3 4 Release of Lock Reset 0 clear the number of authentication failure for each users Ifthere is a user to whom access is locked the lock is released Reset 0 clear the number of authentication failure for all secure prints If there is a secure print to which access is locked the lock is released Reset 0 clear the number of authentication failure of each user boxes Ifthere is a user box to which access is locked the lock is released Reset 0 clear the number of authentication failure of each account Ifthere is a user account to which access is locked the lock is released Reset 0 clear the number of authentication
115. ing Hierarchical to No other components Dependencies No dependencies FIA_SOS 1 2 Verification of secrets FIA_SOS 1 1 2 The TSF shall provide a mechanism to verify that secrets SNMP Password meet assignment a defined quality metric assignment a defined quality metric Number of digits 8 digits or more Character type ASCII code 0x20 Ox7E except 0x5C Hierarchical to No other components Dependencies No dependencies FIA_SOS 1 3 Verification of secrets FIA_SOS 1 1 3 The TSF shall provide a mechanism to verify that secrets User Password meet assignment a defined quality metric assignment a defined quality metric Number of digits 8 digits or more Character type ASCII code 0x20 0x7E Rule Do not composed by only the same kind of character strings Hierarchical to No other components Dependencies No dependencies FIA_SOS 1 4 Verification of secrets FIA_SOS 1 1 4 The TSF shall provide a mechanism to verify that secrets HDD Lock Password CF Lock Password Encryption passphrase meet lassignment a defined quality metricl assignment a defined quality metric Number of digits 20 digits Character type ASCII code 0x21 Ox7E except 0x22 0x28 0x29 Ox2C Ox8A Ox8B Ox8E Ox8F Ox5B Ox5C and 0x5D Rule 1 Do not compose by only the same kind of character strings 2 Do not set the same password or passphr
116. ing of the intra office LAN setting of DNS server gt SMTP setting setting of SMTP server utilized by E mail transmission gt IP address NetBIOS name and AppleTalk printer name etc Backup or restore function of NVRAM CF and HDD gt It is performed through the network by using an application exclusive use for the management installed in the client PC Complete overwrite deletion function of HDD gt There is the data deletion method conformed to various military standards ex Military Standard of United States Department of Defense gt When it s started in conformity with a set method the overwrite deletion is executed for all area of HDD Format function of HDD 2 Abbreviation of NT LAN Administrator Authentic method used in directory service that Windows NT offers to consolidate user information in network environment of Windows platform Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 13 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target gt A logical format is executable Management of FAX setting gt Setting of TSI receiving gt Setting of FAX output at PC FAX receiving Storing in Box or common Boxarea for all users are available FTP Serverfunction setting gt Selecting On or OFF The followings are the operation setting function related especially to the behavior of the security function Method
117. is a security function related to the secure print function It offers the access control function that allows the printing and displaying the list of the secure print file after authenticating if a user is the authorized person to use the secure print file for the access to the secure print file from the panal to the identified and authenticated user 7 6 1 Secure Print Function 1 Authentication function by the secure print password When the user is identified and authenticated as the registered user it authenticates that the accessing user is a user to whom the use of the secure print file concerned is permitted in response to the access request to each secure print file gt Offers the secure print password authentication mechanism that is authenticated by the secure print password that consists of the character shown in Table 11 Vv The secure print authentication mechanism by the separate session information is not needed because it becomes only an access from the panel in the case of the secure print Return for each character as feedback for the entered secure print password Resets the number of authentication failure when succeeding in the authentication The access from the panel is not accepted for 5 seconds when the authentication is failed VV VV When the authentication failure that becomes the 1 3 times in total for the secure print file concerned is detected the authentication function to the secure print file i
118. lated to the external entity 1 Utilization of HDD Lock Function HDD as an external entity has the HDD lock function as measure against the illegal taking out when the password is set Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 16 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target The administrator function does the operation setting of this function As for the starting operation of MFP the access to HDD is permitted by the matching of the HDD lock password set to the HDD and the one set on the MFP Even if HDD is taken out it is impossible to use it excluding the MFP that the concerned HDD installed 2 Utilization of CF Lock Function CF as an external entity has the CF lock function as measure against the illegal taking out when the password is set The administrator function does the operation setting of this function As for the starting operation of MFP the access to CF is permitted by the matching of the CF lock password set to the CF and the one set on the MFP Even if CF is taken out it is impossible to use it excluding the MFP that the concerned CF installed 1 4 3 8 Enhanced Security Function Various setting functions related to the behavior of the security function for the Administrator function and the Service engineer function can be set collectively to the secure values by the operation settings of the Enhance
119. lue of the selected user box as storage is set by FMT_MSA 3 3 lt Necessary requirement to keep the administrator secure gt gt refer to set admin lt Necessary requirement to keep the service engineer secure gt gt refer to set service lt Role and controlling function for each management gt As the role of doing these managements FMT_SMR 1 2 maintains an administrator and FMT_SMR 1 4 maintains a user permitted the use of the user box FMT_SMF 1 specifies these management functions This security objective is satisfied by the completion of these multiple functional requirements O GROUP BOX Group user box access control This security objective permits the browser of the group box only to the user who is permitted the use of the account and limits the operation of the user function of the box file in the group user box set of the group box only to the user who is permitted the use of the group user box and requires various requirements that relate to the access control lt User box access control a group user box gt After the user has been identified and authorized the user ID is related to the task of acting a use by FIA_ATD 1 and FIA_USB 1 And after the account has been authorized the account ID is related to the task of acting a use by FIA_ATD 1 and FIA_USB 1 FDP_ACC 1 1 and FDP_ACF 1 1 permits a task to act for the user to operate the list to the user box group user box where the user attribute corresponde
120. ly the registered user to user the MFP installing TOE O PRIVATE BOX Personal user box access control TOE permits only a user to use the user function of the personal user box which this user owns TOE permits only a user to use the user function of the use box file in the personal user box which this user owns O PUBLIC BOX Public user box access control TOE permits the registered user the reading operation of the public user box TOE permits the user function of the public user box only to the user who is permitted the use of this public user box TOE permits the user function of the user box file in the public user box only to the user who is permitted the use of this public user box O GROUP BOX Group user box access control TOE permits the user function of the group user box which this account owns only to the user who is permitted the use of this account TOE permits the user function of the user box file in the group user box which this account owns only to the user who is permitted the use of this account O SECURE PRINT Secure print file access control TOE permits the print of the secure print file only to the user who is permitted the use of this secure print file O CONFIG Access limitation to management function TOE permits only the administrator the operation of the following functions The setting function related to the SMTP server The setting function related to the DNS server The setting function rel
121. mages and photos from a paper and converts them into the digital data Printer Unit The device that actually prints the converted image data for printing when demanded to print by the MFP controller RS 232C The serial connection can be done It can utilize a remote diagnostic function later description to connect with the modem connected with the public circuit 1 4 2 8 Guidance Service Manual Security Function bizhub 501 bizhub 421 bizhub 361 Japanese Service Manual Security Function bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 English User s Guide Security Operations bizhub 501 bizhub 421 bizhub 361 Japanese User s Guide Security Operations bizhub 501 bizhub 421 bizhub 361 English User s Guide Security Operations ineo 501 ineo 421 ineo 361 English 1 4 3 Logical Range of TOE A User uses a variety of functions of the TOE from the panel and a client PC via the network The following explains typical functions such as the basic function the user box function to manage the image files stored the user identification and authentication function the administrator function manipulated by administrator the service engineer function manipulated by service engineer and the function operated in the background without user s awareness 1 4 3 1 Basic Function In MFP a series of function for the office work concerning the image such as copy print scan
122. ment that corresponds to the organization that demanded security measures in intra office LAN is assumed Particularly correspond to the secure communication of Protected Assets considering the confidentiality showed in the preceding The security policies applied in the organization that uses TOE are identified and described as follows P COMMUNICATION DATA secure communication of image file Highly confidential image file secure print file and user box file which transmitted or received between IT equipment is communicated via trusted pass to the correct destination or has to be encrypted in the case of the organization or the user expect to be protected Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 23 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 4 Security Objectives In this chapter in relation to the assumptions the threats and the organizational security policy identified in Chapter 3 the required security objectives policy for the TOE and the environment for the usage of the TOE are described by being divided into the categories of the security objectives for the TOE and the security objectives for the environment as follows 4 1 Security Objectives for the TOE In this section the security objectives for the TOE is identified and described O REGISTERED USER Utilization of registered user TOE permits on
123. mposed of one kind of character As described above FIA_SOS 1 4 FMT_MTD 1 11 FMT _SMF1 and FMT _SMR 1I 2 are realized lt Encryption Passphrase Change gt Change the encryption passphrase By using the encryption passphrase currently set when it is re authenticated as an administrator and the new encryption passphrase satisfies the quality F CRYPT is performed Offers the encryption passphrase verification mechanism that verified the encryption passphrase that consists of the character shown in Table 11 for each character as feedback for the entered encryption Return in verification passphrase Verify the encryption passphrase newly set if the following qualities are satisfied gt Itis composed of the characters and by the number of digits shown in Table 11 gt It shall not be composed of one kind of character gt It shall not be matched with the current value As described above FIA_SOS 1 4 FIA_UAU 2 2 FIA_UAU 7 FIA_UAU 6 FMT_MTD 1 3 FMT _ SMF 1 and FMT_SMR 1 2 are realized 7 1 3 18 Change of SNMP password The SNMP password Privacy password and Authentication password is changed Verify that the SNMP password newly set satisfies the following qualities gt Itis composed of the characters and by the number of digits shown in Table 11 As described above FIA_SOS 1 2 FMT_MTD 1 3 FMT SMF1 and FMT_SMR 1 2 are realized 7 1 3 14 Setting of SNMP password authentication function The authen
124. n lt Modification of CF lock password gt Change the CF lock password By using the CF lock password currently set when it is re authenticated as an administrator and the new password satisfies the quality it is changed Offers the CF lock password verification mechanism that verified the CF lock password that consists of the character shown in Table 11 Return in verification for each character as feedback for the entered CF lock password Verify the CF lock password newly set if the following qualities are satisfied gt Itis composed of the characters and by the number of digits shown in Table 11 Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 91 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target gt It shall not be composed of one kind of character gt It shall not be matched with the current value As described above FIA_SOS 1 4 FLA_UAU 2 2 FIA_UAU 7 FIA_UAU 6 FMT_MTD 1 3 FMT _ SMF 1 and FMT_SMR 1 2 are realized 7 1 3 12 Operation setting of encryption function When an optional encryption board is installed to MFP it can be operated lt Operation Setting ON gt When turning it ON from OFF it verifies that the encryption passphrase newly set satisfies the following qualities and F CRYPT is performed It is composed of the characters and by the number of digits shown in Table 11 It shall not be co
125. n The directory named user box can be created as an area to store the image file in HDD Three types of user box exist the first is the personal user box which a user possesses the second is the public user box which the registered user making a group within a certain number uses jointly and the third is the group box which the users belong to same account uses jointly As for the personal user box the operation is limited only for the user who owns it the public user box performs access control by sharing a password set to the user box among users and group box the operation is limited only for the user who the use of the account is permitted TOE processes the following required operation against the user box or the image file in a user box for an operation requests that is transmitted from the panel or the network unit through a network from a client PC Print transmission and download from client PC of image file in a user box gt The encryption of box file is possible in the E mail that is one of the transmission methods Deletion of the image file in the user box and move and copy to other user boxes Storage period setting of image file in user box Delete automatically after the period passes Change of user box name change of the password and deletion of user box etc Attribute setting of user box classification change of a personal user box a public user box and a group box 1 4 3 3 User Authentication Functi
126. n FIA_AFL 1 8 refuses in case of the failure authentication tried from the panel all the input receipts from the panel for five seconds in every failure When the failure authentication Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 78 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target reaches 1 3 times FIA_AFL 1 2 logoffs if it s under authentication and locks all the authentication functions that use the administrator password from then on The release function is executed by starting TOE with turning OFF and ON the power supply so that the lock is released after the administrator authentication lock time passed FMT_MTD 1 3 permits only to the administrator the setting of the threshold of the authentication failure frequency which is the trial frequency of the failure authentication in the administrator authentication lt Management of session of identified and authenticated administrator gt The duration of session of the administrator who is identified and authenticated contributes to reduce the chance of attacking associated with unnecessary session connection by ending the session after the panel automatic logoff time elapses by FTA_SSL 3 if it logs in from the panel The change in the panel auto logoff time is limited to the administrator by FMT_MTD 1 3 lt Management of administrator s authentication information gt FIA_S
127. n and the stop operation management to the administrator lt Necessary requirement to keep the administrator secure gt gt refer to set admin lt Necessary requirement to keep the service engineer secure gt gt refer to set service lt Role and controlling function for each management gt As the role of doing these managements FMT_SMR 1 2 maintains an administrator and FMT_SMR 1 6 maintains a user permitted the use of the group user box FMT_SMF 1 specifies these management functions This security objective is satisfied by the completion of these multiple functional requirements O SECURE PRINT Secure print file These security objectives explain the policy for the secure print file First for secure print file this security objective limits the print of the secure print file only for the user who is permitted the use of the secure print file and requires various requirements that relate to the access control Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 73 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target lt Secure print file access control gt After the user has been identified and authorized the user ID is related to the task of acting a use by FIA_ATD 1 and FIA_USB 1 FDP_ACC 1 2 and FDP_ACF 1 2 permits the list display operation of every secure print user box to the task of acting the user who has user ID
128. n behalf of that user Administrator Hierarchical to FIA_UID 1 Dependencies No dependencies FIA_UID 2 3 User identification before any action FIA_UID 2 1 3 The TSF shall require each user User to identify itself before allowing any other TSF mediated actions on behalf of that user User Hierarchical to FIA_UID 1 Dependencies No dependencies FIA_UID 2 4 User identification before any action FIA_UID 2 1 4 The TSF shall require each user User who is permitted to use secure print file to be successfully identified before allowing any other TSF mediated actions on behalf of that user User who is permitted to use secure print file Hierarchical to FIA_UID 1 Dependencies No dependencies FIA_UID 2 5 User identification before any action FIA_UID 2 1 5 The TSF shall require each user User who is permitted to use the public user box to be successfully identified before allowing any other TSF mediated actions on behalf of that user User who is permitted to use the public user box Hierarchical to FIA_UID 1 Dependencies No dependencies FIA_UID 2 6 User identification before any action FIA_UID 2 1 6 The TSF shall require each user User who is permitted to use the account to be successfully identified before allowing any other TSF mediated actions on behalf of that user User who is permitted to use the account Hierarch
129. n by account information As described above FMT_MOF 1 2 FMT_SMF 1 and FMT_SMR 1 2 are realized Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 89 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 7 1 3 6 Unauthorized access setting Setting of unauthorized access detection threshold The unauthorized access detection threshold in the authentication operation prohibition function is set for 1 3 times Setting of Administrator Authentication Lock Time Set the Administrator Authentication Lock Time between 5 60 minutes As described above FMT_MTD 1 3 FMT _SMF 1 and FMT_SMR 1 2 are realized 7 1 3 7 Setting of auto logoff function The panel auto logoff time which is the setting data of the auto logoff function should be set within the following time range panel auto logoff time 1 9 minutes As described above FMT_MTD 1 3 FMT SMF 1 and FMT_SMR 1 2 are realized 7 1 3 8 Network Settings A setup operation of the following setting data is performed A series of setup data that relates to SMTP server IP address Port Number etc A series of setup data that relates to DNS server IP address Port Number etc A series of setup data that relates to MFP address IP address NetBIOS Name AppleTalk Printer Name etc As described above FDP_ACC 1 3 and FDP_ACF 1 3 are realized 7 1 3 9 Execution of back up and
130. n failure handling FIA_AFL 1 1 7 The TSF shall detect when selection assignment positive integer number an administrator configurable positive integer within assignment range of acceptable values unsuccessful authentication attempts occur related to assignment List of authentication events assignment Jist of authentication events Account authentication Account authentication when the belonging account of the user who accesses in the synchronized method is not registered Account authentication Account authentication of the user who accesses in the method not synchronized selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values assignment range of acceptable values an administrator configurable positive integer within 1 3 FIA_AFL 1 2 7 When the defined number of unsuccessful authentication attempts has been selection met Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 47 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target surpassed the TSF shall assignment List of actions selection met surpassed Surpassed assignment List of actions lt Action when it is detected gt Lock the authentication function for the concerned account and deny the access to the TOE by the user who
131. n for accessing the service mode Re authentication for changing the CE password Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 44 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target selection assignment positive integer number an administrator configurable positive integer within assignment range of acceptable values lassignment range of acceptable values an administrator configurable positive integer within 1 3 FIA_AFL 1 2 1 When the defined number of unsuccessful authentication attempts has been selection met surpassed the TSF shall assignment Jist of actions selection met surpassed Surpassed assignment list of actions lt Action when it is detected gt Log off from the authentication status of the service mode if it is and lock the authentication function which uses the CE password If it s not under the authentication status lock the authentication function which uses the CE password lt Operation for recovering the normal condition gt Perform the lock release function of CE authentication by specific operation When CE authentication lock time passed from specific operation the release process is performed Hierarchical to No other components Dependencies FIA_UAU 1 FIA_UAU 2 1 FIA_AFL 1 2 Authentication failure handling FIA_AFL 1 1 2 The
132. nagement server When the intra office LAN connects to an external network measures such as connecting via a firewall are taken and an appropriate setup to block access requests to the MFP from the external network is carried out The intra office LAN provides a network environment that cannot be intercepted by the office operation including using the switching hub and installing the wiretapping detector The public line connected with MFP is used to communicate with the FAX and the remote support function Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 8 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 1 4 2 2 Operation Environment MFP MFP Contoroller USB lt gt CPU Encryption protection chip Image Controller TOE Encryption Kit TOE Message Data Network RAM Ethernet H Unit cones HDD NVRAM Flash Me ory Flash Memory aT S o RS 232C T eas 1 4 t F it Main Sub Panel e Printer Scanner unit un Power One e Document feeder Public line Operator Operator Paper Figure 2 Hardware composition that relates to TOE Figure2 shows the structure of the hardware environment on the MFP that TOE needs for the operation TOE exists as System Controller on the compact flash memory and as BIOS
133. nction OFF CF lock password is deleted Operation setting of Encryption function OFF Encryption Passphrase is deleted Trusted Channel setting data Trusted Channel setting data is deleted because initialization has no default value lt Object for the initialization CF gt SNMP Password The deletion methods such as the data written in HDD and the written frequency is executed according to the deletion method of all area overwrite deletion function set in FADMIN Table 12 The HDD lock password CF lock password and the encryption passphrase cannot be used for being turned off the operation setting of the HDD lock function CF lock function and the encryption function The setting of the Enhanced Security function becomes invalid in the execution of this function Refer to the description for the operation setting of the Enhanced Security function in FADMIN As described above FAD_RIP 1 is realized Table 12 A type of overwrite deletion of all area and the method of overwriting 7 8 FCRYPT Encryption key generation function F CRYPT is generated the encryption key to encrypt image data written in HDD by using the HDD encryption key generation algorithm SHA 256 that is regulated by the KonicaMinolta encryption specification standard KonicaMinolta HDD encryption key generation algorithm SHA 256 is the algorithm to generate the encryption key by using the SHA 256 regulated by FIPS 180 2 When the encr
134. nction of Belonging Account of user by administrator Modification function of Administrator authentication lock time by administrator Modification function of HDD Lock password by administrator Modification function of CF Lock password by administrator Modification function of Encryption passphrase by administrator Operation setting function of Function to use encryption function realized by encryption kit by administrator Modification function of TST receiving setting data by administrator Modification function of service engineer password by service engineer Modification function of administrator password by service engineer Stop function of Enhanced Security function by service engineer Modification function of SNMP password by administrator Modification function of CE authentication lock time by service engineer Operation function of Maintenance function by service engineer Overwrite function for the default value of the user attribute of the user box by the user Modification function of user password when method of user authentication is machine authentication by user Registration function of user box password by user Modification function of user attribute of user box by user Registration function of Belonging Account of user oneself by user who is permitted the use of the account User box registration function by user Automatic Personal user box registration function by user box stored job that specifies unre
135. necessary to cancel the Encryption Key FDP_ACC 1 1 FDP_ACF1 FDP_ACF1 1 FDP_ACC 1 2 FDP_ACF1 FDP_ACF 1 2 FDP_ACC 1 3 FDP_ACF1 FDP_ACF1 3 FDP_ACC 1 FDP_ACC 1 1 Ber ACE ld FMT_MSA 3 FMT_MSA 3 1 FMT_MSA 3 3 FDP_ACC 1 FDP_ACC 1 2 FMT_MSA 3 FMT_MSA 3 2 FDP_ACC 1 3 lt The reason not to apply FMT_MSA 3 gt There is no necessity for applying this requirement FDP_ACF 1 2 FDP_ACF 1 3 because the object attribute doesn t exist FIA_AFL 1 1 FIA_UAU FIA_UAU 2I1 FIA_AFL 1 2 FIA_UAU FIA_AFL 1 3 FIA_UAU FIA_AFL 1 4 FIA_UAU FIA_AFL 1 5 FIA_UAU FIA_AFL 1 6 FIA_AFL 1 7 FIA_AFL 1 8 FIA_UAU Bele lee m FIA_ATD 1 FIA_SOS 1 1 FIA_SOS 1 2 FIA_SOS 1 3 FIA_SOS 1 4 FIA_SOS 1 5 FIA_SOS 1 6 FIA_SOS 2 one FIA_UAU 2 1 FIA_UID 1 FIA_UAU 2 2 FIA_UID 1 one one one one one one one Z Z Z Z Z Z2IZ 12 FIA_UAU 2 3 FIA_UID 1 FIA_UAU 2 4 FIA_UID 1 FIA_UAU 2 5 FIA_UID 1 FIA_UAU 2 6 FIA_UID 1 FIA_UID 2 6 FIA_UAU 6 FIA_UAU 7 FIA_UAU 1 FIA_UAU 2 1 FIA_UAU 2 2 FIA_UAU 2I 3 FIA_UAU 2I4 FIA_UAU 2I5 FIA_UAU 2 6 FIA_UID 2 1 Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 81 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Functional Requirements Component for this ST FIA_UID 2 2 None FIA_UID 2 3 FIA_UID 2 4 FIA_UID 2 5 Dependencies on CC
136. ned the authentication function to the public user box concerned is locked The administrator specifies the failure frequency threshold by the unauthorized access detection threshold setting function Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 101 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target gt The lock of the authentication function is released by the lock release function to the public user box of FADMIN executed As described above FIA_AFL 1 6 FIA_AFL 1 8 FIA_SOS 1 6 FIA_SOS 2 FIA_UAU 2 5 FDP_UAU 7 and FIA_UID 2 5 are realized The following is a function that the user who is permitted the use of the user box is offered in the user box identification and authentication domain of the user box Access control to a user box file in a public user box The task to act for the user is related the User Box ID of the user box as a user box attribute in addition to the user attribute This task is permitted the user box file which have a corresponding user box attribute to the user box attribute of the subject attribute to do the printing the E mail transmission include the S MIME transmission the FTP transmission the fax transmission the SMB transmission WebDAV transmission download the movement to other user boxes and the copy operations to other user boxes As described above FIA_ATD 1 FIA_USB 1 FDP_ACC 1 1
137. neo 421 ineo 361 Control Software Security Target 7 1 3 19 Function related to Enhanced Security function The function that influences the setting of the Enhanced Security function that the administrator operates is as follows It has explained the influence of the backup and restoration function in 7 1 3 9 Operation setting of Enhanced Security function Function to set valid or invalid of Enhanced Security function HDD logical format function Function to write the default value of management data using the file system of HDD Along with the execution of this logical format the setting of the Enhanced Security function is invalidated All area overwrite deletion function The settings of enhanced security function are invalidated by executing the overwrite deletion of all area As described above FMT MOF 1 1 FMT_SMF1 and FMT_SMR 1 2 are realized 7 1 3 20 Function that relates to password initialization function The function that relates to the initialization of the password that the administrator operates is as follows All area overwrite deletion function The settings of the administrator password and the SNMP password are initialized to the values at factory shipment by executing the overwrite deletion of all area As described above FMT_MTD 1 3 FMT_MTD 1 6 FMT_SMF1 and FMT_SMR 1 2 are realized 7 2 FADMIN SNMP SNMP administrator function F ADMIN SNMP is a security function which identifies and authen
138. neo 501 ineo 421 ineo 361 Control Software Security Target 7 5 FBOX User Box Function F BOX is a series of security function related to the user box to the user who is identified and authenticated that you are the registered user such as the permission of the operation and management of the personal user box of the user the authentication to the user who is permitted the utilization of the user box in the access to the public box and the access control function to permit various operations of the concerned user box and the user box file after the authentication lt Registration of user box by user operation gt To register a personal user box a group user box or public user box by selecting the user attribute to the non registration user box ID selected When it s registered it is possible to select User ID or Account ID in the user attribute of the user box which have been specified Public as a default value In the case of the personal user box the arbitrary user ID registered is specified In the case of the public user box verify that a user box password registered satisfies the following conditions gt It is composed of the characters and by the number of digits shown in the Table 11 gt It shall not be composed of one kind of character In the case of group user box the arbitrary account ID registered is specified As described above FIA_SOS 1 5 FMT_MSA 3 1 FMT_MTD 1 5 FMT_SMF1 and FMT_SMR 1 3 a
139. ng able to give the initial value to change In addition when the job to store the non registered user box into the user box appointed is executed due to the same requirement a user ID of the user who executes a job concerned is appointed automatically lt Necessary requirement to keep the administrator secure gt gt refer to set admin Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 70 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target lt Necessary requirement to keep the service engineer secure gt gt refer to set service lt Role and controlling function for each management gt As the role of doing these managements FMT_SMR 1 2 maintains an administrator and FMT_SMR 1 3 maintains a user permitted the use of the user box FMT_SMF 1 specifies these management functions This security objective is satisfied by the completion of these multiple functional requirements O PUBLIC BOX a public user box access control This security objective permits the inspection of the public user box to all users and limits the setting of the public user box and the operation of the user box file in the public user box only to the user who permitted the utilization of that public user box And it needs the various requirements that related to the access control lt User box access control a public user box gt After the user has been id
140. o a Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 68 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target series of requirement set associated by set admin and set service shown in column 6 2 1 2 Sufficiency The IT security functional requirements for the security objectives are described as follows O REGISTERED USER Usage of a registered user This security objective limits the utilization of MFP installing TOE to only the registered user and needs various requirements that related to the user identification and authentication lt Necessary requirement for identification and authentication of the user gt It identifies and authenticates that the user who accesses is a registered user by FIA_UID 2 3 and FIA_UAU 2 3 FIA_UAU 7 returns for each entered character as feedback protected by the panel and supports the authentication In the case of the failure authentication from the panel FIA_AFL 1 8 refuses all input acceptances from the panel for 5 seconds in every failure When the authentication failure reaches 1 3 times FIA_AFL 1 4 locks the authentication function for that user from then on This lock status is released by the administrator s release operation FMT_MOF 1 2 permits only the administrator the selection of the user authentication methods which are Machine authentication and External server authentication
141. o the user box lt Account Name gt In the method not synchronized with User authentication the account ID of the concerned account associates to the task acting on the behalf of users when authenticated with the access to the account In the method synchronized with User authentication the account ID that is set to the concerned user associates to the task acting on the behalf of users when authenticated with the access to the user lt File attribute gt The secure print internal control ID of the concerned secure print file associates to the task acting on the behalf of users when authenticated with the access to the secure print file lt User attribute gt the user ID of the concerned user associates to the task acting on the behalf of users when authenticated with the access to the user lt Administrator attribute gt the Administrator ID associates to the task acting on the behalf of users when authenticated with the access to the Administrator FIA_USB 1 3 The TSF shall enforce the following rules governing changes to the user security attributes associated with subjects acting on the behalf of users assignment rules for the changing of attributes assignment rules for the changing of attributes None Hierarchical to No other components Dependencies FIA_ATD 1 FIA_ATD 1 6 1 1 4 Security management FMT_MOF 1 1 Management of security functions behavior FMT_MOF 1 1 1 Copyright c 2007 KON
142. object gt The SMTP server group object the DNS server group object and the MFP address group object exists as an MIB object as well so that the restriction is necessary even in the access from the SNMP FIA_UID 2 2 and FIA_UAU 2 2 identifies and authenticates that the user who accesses the MIB object is an administrator FIA_AFL 1 3 locks the authentication function to access the MIB object when the failure authentication reaches 1 3 times This lock is released by the start of TOE or the lock release operation by the administrator FMT_MTD 1 3 restricts the threshold setting of the unauthorized access detection value that is the trial frequency of the failure authentication in the administrator authentication using the SNMP password only to the administrator FMT_MTD 1 3 restricts the change in the SNMP password to the administrator FIA_SOS 1 2 verifies the quality of the SNMP password FMT_MOF 1 2 restricts the method of the SNMP password authentication function only to the administrator lt Operational Limit of Trusted Channel function setting data gt The behavior and the stop setting of Trusted Channel function are permitted only to the administrator by FMT_MOF 1 3 lt Operational Limit for S MIME function gt The registration of the S MIME certificate and the transmission address data is permitted only to the administrator by FMT_MTD 1 11 The modification of the S MIME certificate and the transmission address data is pe
143. od of overwriting 0ccee 105 Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 5 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 1 ST Introduction 1 1 ST Identification ST Title bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software AOR50Y0 0100 G00 11 AOR50Y0 1D00 G00 10 Security Target ST Version lt 1 138 CC Version gt 3 1R2 Created on August 12 2008 Created by KONICA MINOLTA BUSINESS TECHNOLOGIES INC Akihiko Oda 1 2 TOE Identification TOE Name Japanese Name bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software English Name bizhub bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software TOE Version AOR50Y0 0100 G00 11 System Control AOR50Y0 1D00 G00 10 BIOS Control TOE Type Software Created by KONICA MINOLTA BUSINESS TECHNOLOGIES INC 1 3 TOE Overview This paragraph explains the usage of TOE main Security Functions and Operation Environment of the TOE 1 3 1 TOE Type The bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software that is the TOE is an embedded software product that controls the operation of whole MFP overall in the compact flash memory and flash memory on the MFP controller 1 3 2 Usage of TOE and main Security Functions bi
144. on TOE can limit the user who uses MFP When accessing it through the panel or the network TOE performs the identification and authentication that the user is permitted to use the MFP by applying the user password and user ID When the identification and authentication succeeds TOE permits the user the use of the basic function and the user box function etc Several types of the following are supported in the method of the user authentication 1 Machine authentication A method to authenticate on MFP by registering a user ID and a user password into HDD on MFP controller 2 External server authentication A method to authenticate with processing the authentication on MFP by using the user ID and the user password that are registered on the user information management server which is connected by the intra office LAN without managing the user ID and user password on the MFP side Though two or more methods named Active Directory NTLM2 A method of directory service that Windows Server 2000 after it offers to consolidate user information in network environment of Windows platform Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 12 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target and NDS are supported the method of the external server authentication assumed in this ST is applied only the case with Active Directory 1 4 3 4 Accoun
145. on information besides the administrator password after the administrator is authenticated to the access from the network gt According to protocol use the session information of more than 101 or generate and use the session information more than 102 Return for each character as feedback for the entered administrator password Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 85 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Resets the number of authentication failure when succeeding in the authentication In the case of access from a panel it doesn t accept the input from a panel for five seconds when failing in the authentication Locks all the authentication functions to use the administrator password when detecting the authentication failure that becomes 1 3 times at total in each authentication function by using the administrator password Refuse the access to the administrator mode gt The administrator specifies the failure frequency threshold by the unauthorized access detected threshold setting function FRESET works and the lock release function of the administrator authentication function in F SERVICE is carried out and the lock of authentication function is released As described above FIA_AFL 1 2 FIA_AFL 1 8 FIA_SOS 1 6 FIA_SOS 2 FIA_UAU 2 2 FIA_UAU 7 and FIA_UID 2 2 are realized Table 11
146. one kind of character As described above FMT_SOS 1 5 is realized gt Giving of the secure print internal control ID When the verification of the secure print password is completed in a registration request of the secure print file the secure print internal control ID uniquely identified is set to the concerned secure print file As described above FMT_MSA 3 2 is realized 7 7 FOVERWRITE ALL All area overwrite deletion function FOVERWRITE ALL executes the overwrite deletion in the data area of HDD and CF and initializes the setting value of the password that is set to NVRAM and CF as well The object for the deletion or the initialization is as follows lt Object for the deletion HDD gt Secure print file User box file On memory image file Stored image file HDD remaining image file Image related file Transmission address data file User ID User password User box password Secure print password Account ID Account password S MIME certificate Remaining TSF data lt Object for the deletion CF gt CF remaining image file Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 104 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target lt Object for the initialization NVRAM gt Administrator Password Operation setting of HDD lock function OFF HDD lock password is deleted Operation setting of CF lock fu
147. or assignment list of TSF functions lassignment list of TSF functions Administrator authentication Access through the network User authentication Access through the network User box authentication Access through the network Hierarchical to No other components Dependencies No dependencies FIA_UAU 2 1 User authentication before any action FIA_UAU 2 1 1 The TSF shall require each user Service Engineer to be successfully authenticated before allowing any other TSF mediated actions on behalf of that user Service Engineer Hierarchical to FIA_UAU 1 Dependencies FIA_UID 1 FIA_UID 2 1 FIA_UAU 2 2 User authentication before any action FIA_UAU 2 1 2 The TSF shall require each user Administrator to be successfully authenticated before allowing any other TSF mediated actions on behalf of that user Administrator Hierarchical to FIA _UAU 1 Dependencies FIA_UID 1 FIA_UID 2 2 FIA_UAU 2 3 User authentication before any action Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 50 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target FIA_UAU 2 1 3 The TSF shall require each user User to be successfully authenticated before allowing any other TSF mediated actions on behalf of that user User Hierarchical to FIA_UAU 1 Dependen
148. peration inquiry operation of the SNMP password the user password the user box password and the secure print password the account password lt Operational limitation of Enhanced Security function gt FMT_MOF 1 1 permits only the administrator and service engineer to disable the setting for the enhanced security function FMT_MOF 1 4 permits only the service engineer to enable the operation setting activation for the maintenance function lt Management of HDD lock password encryption passphrase and CF lock password gt FMT_MTD 1 3 permits the modification operation to the HDD lock password the encryption passphrase and CF lock password FIA_SOS 1 4 verifies the quality of the HDD lock password the encryption passphrase and CF lock password In order to change the HDD lock password encryption passphrase and CF lock password FIA_UAU 6 re authenticates that a user is an administrator by collating with the registered HDD lock password and encryption Passphrase object When the authentication is succeeded the HDD lock password encryption passphrase and CF lock password are allowed to be changed Moreover FMT_MTD 1 11 permits only to the administrator to register the encryption passphrase Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 75 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target lt Necessary requirement for accessing MIB
149. permitted the use of the account lt Operation for recovering the normal condition gt Perform the delete function of authentication failure frequency offered within the administrator mode Hierarchical to No other components Dependencies FIA UAU 1 FIA_UAU 2I6 FIA_AFL 1 8 Authentication failure handling FIA_AFL 1 1 8 The TSF shall detect when selection assignment positive integer number an administrator configurable positive integer within assignment range of acceptable values unsuccessful authentication attempts occur related to assignment List of authentication events assignment list of authentication events Authentication when it accesses service mode Authentication when it accesses administrator mode from the panel User authentication when user accesses TOE from the panel Account authentication when user accesses TOE from the panel Authentication when it accesses secure print file Authentication when it accesses Public user box from the panel selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values lassignment positive integer number 1 FIA_AFL 1 2 8 When the defined number of unsuccessful authentication attempts has been selection met surpassed the TSF shall assignment List of actions selection met surpassed Surpassed assignment list of actions lt Action when it is detecte
150. pyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 108 108
151. r IT Security Assurance Requirements This TOE is installed and used in an environment where adequate security is maintained in terms of the physical personnel and connectivity Nonetheless adequate effectiveness in the environment where the TOE is used must be assured As a general commercial office product the execution of tests based on function specifications and high level design and analysis of the strength of function and a search for vulnerabilities are required In addition it is desirable that it has a development environment control a configuration management for the TOE and a secure distribution procedure And therefore the selection of EAL8 which provides an adequate Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 83 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target assurance level is reasonable The secure requirement dependency analysis is assumed to be appropriate because the package EAL has been selected therefore details are not discussed Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 84 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 7 TOE Summary Specification The list of the TOE security function led from the TOE security function requirement is shown in the following Table 10 The detailed specification is explaine
152. r components Dependencies FDP_ACC 1 FDP_ACC 1 1 FMT_MSA 3 FMT_MSA 3 1 FMT_MSA 3I 3 FDP_ACF 1 2 Security attribute based access control FDP_ACF 1 1 2 The TSF shall enforce the assignment access control SFP to objects based on the following assignment list of subjects and objects controlled under the indicated SFP and for each the SFP relevant security attributes or named groups of SFP relevant security attributes assignment Jist of subjects and objects controlled under the indicated SFP and for each the SFP relevant security attributes or named groups of SFP relevant security attributes lt Subject gt lt Subject attributes gt task substituted fora user gt File attributes Secure print internal control ID User attributes User ID Administrator attributes lt Object gt lt Object attributes gt Secure print file gt File attributes Secure print internal control ID assignment access control SFP Secure print file access control FDP_ACF 1 2 2 The TSF shall enforce the following rules to determine if an operation among controlled subjects and controlled objects is allowed assignment rules governing access among controlled subjects and controlled objects using controlled operations on controlled objects assignment rules governing access among controlled subjects and controlled objects using controlled operations on controlled objects A task to act for a user who has a user attribute user ID i
153. r uses to store the image file O REGISTERED USER is assumed that only the user to whom TOE was registered is permitted to use MFP installed TOE furthermore the operation of a personal user box and the user box file in a personal user box is restricted only to the user who is the owner by O PRIVATE BOX so that the possibility of the threat is reduced When the user information management server is used the possibility of the threat is reduced because the user identification and authentication function is operated through O AUTH CAPABILITY supporting the operation for the user identification and authentication function by the user information management server of Active Directory and through OE SERVER setting to use the user management by the administrator OE FEED BACK uses the application regulating to return the protected feedback for the entered password in the user s authentication and OE N SESSION also requires the log off Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 30 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target operation after the operation ends so that O REGISTERED USER and O PRIVATE BOX are supported sufficiently Accordingly this threat is countered sufficiently T ACCESS PUBLIC BOX Unauthorized access to public user box using user function This threat assumes the possibility that an unauthorized operation is done by using
154. ration function when the belonging account of user is not registered in the synchronized method gt Require the Account authentication after User identification and authentication Register the successful account ID as account name when succeeding in the account authentication By this FMT_MTD 1 12 FMT_SMS 1 and FMT_SMR 1I6 are realized The detail of the account authentication is the same as processing of the items explained in the following lt Account authentication User identification and authentication in the authentication method not synchronized gt lt Account Authentication User identification and authentication in the authentication method not synchronized gt When the access request for the user box and the request for the registration of the secure print file it is identified and authenticated to be a user The detail of user authentication is the same as account authentication user identification and authentication in the synchronized method In the case of the access from the panel the account authentication is required Account Name is associated with the user ID if succeeding the account authentication and the use of F BOX and F PRINT is permitted to the user who is identified and authenticated Offers account authentication mechanism that is authenticated the account by the account Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 98 108 bizhub 501 bizhub 421 bizhub 36
155. rator modifies the administrator password When the service engineer modifies the CE password When the administrator changes the HDD lock setting When the administrator changes the Encryption function setting When the administrator changes the CF lock setting Hierarchical to No other components Dependencies No dependencies FIA_UAU 7 Protected authentication feedback FIA_UAU 7 1 The TSF shall provide only assignment Jist of feedback to the user while the authentication is in progress assignment list of feedback Display every character data input Hierarchical to No other components Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 51 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Dependencies FIA_UAU 1 FIA_UAU 2 1 FIA_UAU 2 2 FIA_UAU 2 3 FIA_UAU 2 4 FIA_UAU 2 5 FIA_UAU 2I6 FIA_UID 2 1 User identification before any action FIA_UID 2 1 1 The TSF shall require each user Service Engineer to identify itself before allowing any other TSF mediated actions on behalf of that user Service Engineer Hierarchical to FIA _UID 1 Dependencies No dependencies FIA_UID 2 2 User identification before any action FIA_UID 2 1 2 The TSF shall require each user Administrator to identify itself before allowing any other TSF mediated actions o
156. re authentication in the authentication of the user who is permitted the use of the group user box When FIA_ATD 1 and FIA_USB 1 relates to the user box ID under the task to act for user FDP_ACC 1 1 and FDP_ACF 1 1 permits the user box file that has a corresponding object attribute to the account ID and the user box ID of the subject attribute the operation such as print download transmissions movement and copy lt Necessary requirement to manage the group box gt FMT_MAS 1 3 permits the modification operation of the user attribute of the user box that is set account ID to the user who is permitted the access to the group user box For the user box attribute of the user box file the user box attribute value of the selected user box as storage is set by FMT_MSA 3 3 lt Necessary requirement to manage the subject attribute related with the group user box gt FMT_MTD 1 11 restricts the registration of the account ID and account password only to the administrator Also FMT_MTD 11 3 restricts the modification of the account ID and account password only to the administrator FMT_MTD 1 12 restricts the registration of the belonging account assigned to the user to the administrator and to the user who is permitted the use of the account FIA_SOS 1 5 verifies the quality of the account password lt Management of the account authentication method gt FMT_MOF 1 3 restricts the behavior management of the account authentication functio
157. re permitted to use if possible and some excluded characters according to each password are shown Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 86 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target As described above FIA_SSL 38 is realized 7 1 3 Function offered in Administrator mode When a user is identified and authenticated as an administrator by the administrator identification authentication function at the accessing request to the administrator mode the administrator authority is associated with the task substituting the user And the following operations and the use of the functions are permitted As described above FIA_ATD 1 and FIA_USB 1 are realized 7 1 3 1 Change of Administrator password When a user is re authenticated as an administrator by the panel and the new password satisfies the quality the password is changed Offers the administrator authentication mechanism that is authenticated by the administrator password which consists of the character shown in Table 11 Resets the number of authentication failure when succeeding in the re authentication Return for each character as feedback for the entered administrator password in the re authentication by the access from the panel When the authentication failure that becomes 1 3 times at total in each authentication function by using the administrator pas
158. re realized lt Automatic registration of user box gt In the user box operation to store of the copy job and the print job when the specified user box is unregistered the personal user box which is set the user ID of the user who operates the job concerned is automatically registered As described above FMT_MSA 3 1 is realized lt Registration of user box file gt In the new registration operation move or copy operation of user box file the user box ID equivalent to the user box specified as target storage is set to the user box attribute as the user box file As described above FMT_MSA 3 3 is realized 7 5 1 Personal User Box Function 1 Access control function to personal user box The task to act for the identified and authenticated user has User ID of the user who is identified and authenticated for the user attribute This task is permitted the display of the list of the personal user box which has a corresponding user attribute with this user attribute As described above FIA_ATD 1 FIA_USB 1 FDP_ACC 1 1 and FDP_ACF 1 1 are realized 2 Access control function to a user box file in a personal user box When the user box to operate is selected User Box ID of the user box is related to the task as a user box attribute in addition to the user attribute This task is permitted to the user box file with the user box attribute corresponding to the user box attribute of itself the Copyright c 2007 KONICA MINOLTA B
159. release function is executed and the CE authentication lock time goes by so that this lock status is released lt Role and management function for each management gt FMT_SMR 1 1 maintains the role to do these management as a service engineer FMT_SMF 1 specifies these management functions 6 2 1 3 Dependencies of the IT Security Functional Requirements The dependencies of the IT security functional requirements components are shown in the following table When a dependency regulated in CC Part 2 is not satisfied the reason is provided in the section for the dependencies Relation in this ST Table 9 Dependencies of IT Security Functional Requirements Components N A Not Applicable Functional Requirements Component for this ST Dependencies on CC Part 2 Dependencies Relation in this ST FCS_CKM 2 or FCS_COP 1 FCS_COP 1 FCS_CKM 4 lt The reason not to apply FCS_CKM 4 gt FCS _CKM 1 The encryption key is regularly kept for the stored data Moreover an arbitrary access to the storage medium is difficult and there is no necessity of the encryption key cancellation FCS_CKM 1 or FDP_ITC 1 FCS_CKM 1 only a part of the phenomenon or FDP_ITC 2 FCS_CKM 4 The satisfied events The encryption key for enciphering the attached file by the S MIME communication is generated lt The reason not to satisfy a part of the FCS_CKM 1 or FDP_ITC 1 or FDP_ITC 2 gt It seems proper to use FDP_ITC 1 because the public key to encryp
160. rint is limited only to the authorized user by O SECURE PRINT so that the possibility of the threat Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 31 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target is reduced When the user information management server is used the possibility of the threat is reduced because the user identification and authentication function is operated through O AUTH CAPABILITY supporting the operation for the user identification and authentication function by the user information management server of Active Directory and through OE SERVER setting to use the user management by the administrator OE FEED BACK uses the application regulating to return the protected feedback for the entered password in the user s authentication and access authentication to the secure print and OE N SESSION requires the log off operation after the operation ends so that O REGISTERED USER and O SECURE PRINT are supported sufficiently Accordingly this threat is countered sufficiently T UNEXPECTEC TRANSMISSION Transmission to unintended address This threat assumes the possibility of sending the user box file to the address that isn t intended when the network setting that relates to the transmission is illegally changed This is concerned about a possibility that the user box file is transmitted to the specified server illegally without the
161. rmitted only to the administrator by FMT_MTD 1 3 The behavior of the S MIME function is permitted only to the administrator by the FMT_MOF1 2 lt Necessary requirements to keep the administrator secure gt gt refer to set admin lt Necessary requirements to keep the service engineer secure gt gt refer to set service lt Role and controlling function for each management gt As the role of doing these managements FMT_SMR 1 1 maintains a service engineer and FMT_SMR 1 2 maintains an administrator Moreover FMT_SMEF1 specifies these management functions This security objective is satisfied by the completion of these multiple functional requirements O OVERWRITE ALL Complete overwrite deletion This security objective regulates that it deletes all data areas of HDD and initializes the concealed information of NVRAM that is set by the user and requires various requirements that relate to the deletion FAD_RIP 1 guarantees that these objective information not to be able to use the content of Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 76 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target any previous information by the deletion operation This security objective is satisfied by the completion of these multiple functional requirements O CRYPT KEY Encryption key generation This security objective regulates th
162. roperty of FMT_MSA 3 1 User Case 2 identified in assignment other property of FMT_MSA 8 1 None Hierarchical to No other components Dependencies FMT_MSA 1 FMT_MSA 1 1 FMT_MSA 1 2 FMT_SMR 1 FMT_SMR 1 3 FMT_MSA 3 2 Static attribute initialization FMT_MSA 3 1 2 The TSF shall enforce the assignment access control SFP information flow control SFP to provide selection choose one of restrictive permissive assignment other property default values for security attributes Secure print internal control ID that are used to enforce the SFP selection choose one of restrictive permissive lassignment other property assignment other property Identified uniquely assignment access control SFP information flow control SFP Secure print file access control FMT_MSA 3 2 2 The TSF shall allow the assignment the authorized identified roles to specify alternative initial values to override the default values when an object or information is created lassignment the authorized identified roles None Hierarchical to No other components Dependencies FMT_MSA 1 N A FMT_SMR 1 N A FMT_MSA 3 3 Static attribute initialization FMT_MSA 3 1 3 The TSF shall enforce the assignment access control SFP information flow control SFP to provide selection choose one of restrictive permissive assignment other property default values for security attributes User box attributse
163. s Common Criteria for Information Technology Security Evaluation Part 1 Introduction and general model 2006 9 Version 3 1 Revision 1 Translation v1 2 Part 2 Security functional requirements 2007 9 Version 3 1 Revision 2 Translation v2 0 Part 3 Security assurance requirements 2007 9 Version 3 1 Revision 2 Translation v2 0 e Security function requirement Part2 Extended e Security assurance requirement Part3 Conformant 2 2 PP Claim There is no PP that is referenced by this ST 2 3 Package Claim This ST conforms Package EAL3 There is no additional assurance component 2 4 Reference e Common Criteria for Information Technology Security Evaluation Part 1 Introduction and general model September 2006 Version 3 1 Revision 1 CCMB 2006 09 001 e Common Criteria for Information Technology Security Evaluation Part 2 Security functional components September 2007 Version 3 1 Revision 2 CCMB 2007 09 002 e Common Criteria for Information Technology Security Evaluation Part 3 Security assurance components September 2007 Version 3 1 Revision 2 CCMB 2007 09 003 e Common Criteria for Information Technology Security Evaluation Evaluation methodology September 2007 Version 3 1 Revision 2 CCMB 2007 09 004 Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 19 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 3 Security Problem Definition T
164. s a user box attribute in addition to the user attribute This task is permitted to the user box file with the user box attribute corresponding to the user box attribute of subject attribute the printing the E mail transmission include the S MIME transmission the FTP Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 102 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target transmission the FAX transmission the SMB transmission WebDAV transmission download the removing to other user boxes and the copy operations to other user boxes As described above FIA_ATD 1 FIA_USB 1 FDP_ACC 1 1 and FDP_ACF 1 1 are realized 3 User attribute change of a group user box The user attributes can be changed gt If another account ID is specified the user of another Account Name becomes an accessible group user box gt If public is specified it becomes a public user box It is necessary to register the user box password In this case it is verified that the user box password satisfies the following requirements It is composed of the characters and by the number of digits shown in Table 11 It shall not be composed of one kind of character gt Specify a registered user and change to a personal user box for the registered user As described above FIA_ATD 1 FMT_SMF 1 and FMT_SMR 1I 6 are realized 7 6 FPRINT Secure Print Function F PRINT
165. s locked The administrator specifies the failure frequency threshold by the unauthorized access detection threshold setting function gt The lock is released by the lock release function to the secure print file of FADMIN executed 2 Access control function to a secure print file The secure print file access control operates when it is authenticated gt The task to act for the user who is identified and authenticated has the authenticated Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 103 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target secure print internal control ID as the file attribute gt This task is permitted the printing to the secure print file with a corresponding file attribute to the file attribute of this task As described above FIA_ATD 1 FIA_USB 1 FDP_ACC 1 2 and FDP_ACF 1 2 are realized 3 Registration function of a secure print file When it is authenticated as a registered user in the registration request of the secure print file the user is permitted to register the secure print password with the concerned secure print file As described above FMT_MTD 1 8 is realized gt Registration of the secure print password The registered secure print password is verified to meet the following requirements It is composed of the characters and by the number of digits shown in Table 11 It shall not be composed of
166. s permitted to display of the list of all the secure print files A task to act for a user who has the file attribute the secure print internal control ID is permitted the print operation to the secure print file that has matched the file attribute secure print internal control ID with the file attribute secure print internal control ID A task to act for a user is permitted to do the list display and printing operation to the ID amp Print file with the user attribute of the object attribute which corresponds with the user attribute user ID of a subject attribute FDP_ACF 1 3 2 The TSF shall explicitly authorize access of subjects to objects based on the following additional rules assignment rules based on security attributes that explicitly authorize access of subjects to objects assignment rules based on security attributes that explicitly authorize access of subjects to objects A task to act for a user who has a administrator attribute is permitted to back up secure print file FDP_ACF 1 4 2 The TSF shall explicitly deny access of subjects to objects based on the assignment rules based on security attributes that explicitly deny access of subjects to objects assignment rules based on security attributes that explicitly deny access of subjects to objects None Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 43 108 bizhub 501 bizhub 4
167. setting of a user authentication function gt Select the machine authentication the external server authentication or the user authentication stop gt Combination with Account Authentication is set up Method synchronized with User Authentication Method not synchronized with User Authentication User Setting of access by PUBLIC gt Select the permission and prohibition of MFP utilization of the user who is not identified by user ID Setting of a password policy function gt Select ON or OFF for the function to check the several conditions of the password such as the valid number of digits for the various passwords etc Setting of the authentication method of secure print and the prohibit function of authenticating operations gt There are the mode that the authentication operation prohibition function operates for the authentication of the secure print and the mode not done gt The operation mode of the function that the failure authentication in each authentication function detects the failure synchronizes too gt Selecting the above mentioned operational mode Setting of the network setting modification function by SNMPv1 and v2 gt Select the permission or the prohibition of the modification operation function of MIB by SNMPv1 and v2 Operational Setting of Authentication Function when writing using SNMPv3 gt Select Authenticate or Not Authenticate Setting Level gt Select only Authentication password or Authenti
168. ssion or prohibition The format function of HDD gt A logical format and a physical format are executable Installation setting of HDD gt An explicit installation setting is necessary to use HDD as a data storage area Initialization function 4Abbreviation of Customer Service engineer Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 15 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target gt The various setting values that the user or the administrator has set and the data that the user has stored are deleted 1 4 3 7 Other Functions TOE provides the functions that run background without awareness of the user and the updating function of TOE The following explains the major functions 1 2 3 4 5 Encryption key generation function When the encryption protection chip an optional product is installed in MFP controller the encoding and decoding is processed to the reading and writing data in HDD TOE does not process the encryption and description itself The operation setting of this function is performed by the administrator function When it operates TOE generates the encryption key by the encryption passphrase that was entered on the panel Remote diagnostic function Making use of several connected systems such as E mail and a modem connection through a FAX public line mouth or a RS 232C
169. sword is detected it logoffs the administrator mode accessing from the panel and locks all the authentication functions to use the administrator password The access to the administrator mode is refused gt The administrator specifies the failure frequency threshold by the unauthorized access detection threshold setting function FRESET works or the lock release function of the administrator authentication function in F SERVICE is carried out so that the lock of the authentication function is released Verify the new administrator password if the following qualities are satisfied gt Itis composed of the characters and by the number of digits shown in the Table 11 gt It shall not be composed of one kind of character gt It doesn t match with the current value As described above FIA_AFL 1 2 FIA_AFL 1 8 FIA_SOS 1 1 FLA_UAU 2 2 FIA_UAU 6 and FIA_UAU 7 are realized 7 1 3 2 User Settings User Registration Only the user who uses with the machine authentication as User authentication method User is registered by setting the user ID Though user ID is composed of the user name and the authentication server information 3 only user name is registered in case of the machine authentication and registering the user password It verifies whether the user password newly set have been satisfied the following qualities 13 tt associates with the external server authentication setting data that is set in the case of the
170. t As described above FCS_CAP 1 2 is realized Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 107 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 7 16 FKSUPPORT HDD HDD lock operation support function F SUPPORT HDD is the function to operate HDD lock function of HDD from TOE lt Release process of HDD lock state gt At the MFP power ON the release process of HDD lock state of HDD lock function is achieved Release process is requested to HDD by using HDD lock password stored in HDD lt Modification process of HDD lock password gt F ADMIN requests to change the HDD lock password Modification process is requested to HDD by using HDD lock password stored in NVRAM and new HDD lock password As described above FIT_CAP 1 3 is realized 7 17 FKSUPPORT CF CF lock operation support function F SUPPORT CF is the function to operate CF lock function of CF from TOE lt Release process of CF lock state gt At the MFP power ON the release process of CF lock state of CF lock function is achieved Release process is requested to CF by using CF lock password stored in CF lt Modification process of CF lock password gt F ADMIN requests to change the CF lock password Modification process is requested to CF by using CF lock password stored in NVRAM and new CF lock password As described above FIT_CAP 1 4 is realized Co
171. t Authentication Function TOE can manage the MFP users by grouping them into Account unit The methods of Account Authentication are as follows 1 Method synchronized with User Authentication The user is set Account ID which he belongs to beforehand and the user is related to account ID of belonging account when user is certified 2 Method not synchronized with User Authentication When the certification is done by the account password set to each account ID the user is related to the concerned account ID 1 4 3 5 Administrator Function TOE provides the functions such as the management of user boxes management of user information at the time of MPF authentication and management of various settings of the network image quality etc in the administrator mode that only authenticated administrator can manipulate The following shows the function related to the security The user registration management gt Registration or change in user ID and user password and deletion of a user gt Change the association of user with account ID The account registration management gt Registration or change in account ID and account password Management of user box settings gt Registration or change in user box password and management of user attributes Operation setting of automatic system reset gt Setting of the function that logs out automatically when the setting time passed Management of network setting gt Connection sett
172. t the TOE Hierarchical to No other components Dependencies FIA_UAU 1 FIA_UAU 2 4 FIA_AFL 1 6 Authentication failure handling FIA_AFL 1 1 6 The TSF shall detect when selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values unsuccessful authentication attempts occur related to assignment List of authentication events assignment list of authentication events Authentication for accessing the public user box selection assignment positive integer number an administrator configurable positive integer within assignment range of acceptable values assignment range of acceptable values an administrator configurable positive integer within 1 3 FIA_AFL 1 2 6 When the defined number of unsuccessful authentication attempts has been selection met surpassed the TSF shall assignment List of actions selection met surpassed Surpassed assignment List of actions lt Action when it is detected gt Log off from the authentication status of the user box fit is and lock the authentication function for the concerned user box lt Operation for recovering the normal condition gt Perform the delete function of authentication failure frequency offered within the administrator mode Hierarchical to No other components Dependencies FIA_UAU 1 FIA_UAU 2 5 FIA_AFL 1 7 Authenticatio
173. t the encryption key for the data encryption of S MIME is imported outside of FCS_COP 1 TSC but S MIME certificate is registered by the administrator s operation In that case it is unnecessary to consider whether it passes thorough the untrusted channel or not There is not inevitability to apply the security requirement The use under the condition that AANETWORK is realized Also the attribute information of imported encryption key doesn t apply to the security attribute used for the access control etc is not related to the initialization etc and the Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 80 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Functional Requirements Component for this ST Dependencies on CC Part 2 Dependencies Relation in this ST application is difficult In FMT_MTD 1 11 it is expressed as registration of TSF data and the object of import operation is assigned to an appropriate role As a result the event corresponding to the key management is explained by using not the security requirement that is showed in the dependencies but other security requirement so that it s no problem even if this dependencies is not satisfied lt The reason not apply FCS_CKM 4 gt The Encryption Key is stored constantly for the stored data The arbitrary access to the storring media is difficult so it is not
174. ted FIT_CAP 1 Capability of using security service of IT environment entity FIT_CAP 1 TSF shall provide the necessary capability to use the service for lassignment security service provided by IT environment entity assignment necessary capability list for the operation of security servicel Hierarchical to No other components Dependencies No dependencies Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 38 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target 6 IT Security Requirements In this chapter the TOE security requirements are described lt Definition of Label gt The security function requirements required for the TOE are described Those regulated in CC Part 2 will be directly used for the functional requirements components and the same labels will be used as well The new additional requirement which is not described in CC part 2 is newly established and identified with the label that doesn t compete with CC part 2 lt Method of specifying security function requirement Operation gt In the following description when items are indicated in italic and bold it means that they are assigned or selected When items are indicated in italic and bold with parenthesis right after the underlined original sentences it means that the underlined sentences are refined A number in the p
175. ted with the concerned user ID that is set up beforehand besides the user ID for the identified and authenticated user and the use of FBOX and F PRINT is permitted to the identified and authenticated user Offers the user authentication mechanism that authenticates the user that consists of the characters shown in Table 11 gt After the user is authenticated to the access from the network the user authentication mechanism using session information besides the user password is offered gt According to the protocol it uses the session information more than 10 or it generates and uses the session information more than 102 Return for each character as feedback for the entered user password Resets the number of authentication failure when succeeding in the authentication Not accept the access from the panel for five seconds when the authentication failed When the authentication failure that becomes 1 3 times at total for the concerned user is detected it locks all the authentication functions to the user gt The administrator specifies the failure frequency threshold by the unauthorized access detection threshold setting function To release the lock of the authentication function is to perform the lock release function to the user authentication of FADMIN As described above FIA_AFL 1 4 FIA_AFL 1 8 FIA_SOS 1 6 FIA_SOS 2 FIA_UAU 2 3 FIA_UAU 7 and FIA_UID 2 3 are realized lt Account Authentication Account regist
176. ted in the user authentication method the user who is authenticated the identification is permitted from an external server and registered automatically by this requirement This corresponds to the user ID registration of the external server At this registration the external server accessing TOE is identified the external server registered by FIA_UID 2 7 This management behavior is maintained as the role of the external server by FMT_SMR 1 5 In addition the Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 69 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target registration function of user ID is specified for the administration function by FMT_SMEF 1 The setting change operation of an external server is limited to only the administrator by FMT_MTD 1 3 The quality of the user password is verified by FIA_SOS 1 3 When machine authentication is selected in the method of the user authentication a change of the user password is limited to the user itself and the administrator by FMT_MTD 1 2I lt Necessary requirement to keep the administrator secure gt gt refer to set admin lt Necessary requirement to keep the service engineer secure gt gt refer to set service lt Role and management function for each management gt The role to do these managements is maintained as a administrator by FMT_SMR 1 2 and a user by FMT_SMR 1 3
177. tered as the feedback protected in the panel and supports the authentication FIA_AFL 1 8 refuses all the input receipts from the panel for five seconds at each failure and when the failure authentication reaches 1 3 times FIA_AFL 1 1 logoffs it if it s under authentication and locks all the authentication functions to use the CE password The CE authentication lock release function is executed and the CE authentication lock time goes by so that this lock status is released FMT_MTD 1 3 permits only to the administrator the setting of the threshold of the authentication failure frequency that is the trial frequency of the failure authentication in the service engineer authentication FMT_MTD 1 9 permits only to the service engineer the Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 79 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target setting of the CE authentication lock time lt Management of service engineer s authentication information gt FIA_SOS 1 1 verifies the quality of the CE password FMT_MTD 1 9 restricts the change in the CE password to the service engineer Moreover FIA_UAU 6 re authenticates it In this re authentication when the failure authentication reaches 1 3 times FIA_AFL 1 1 releases the authentication status of the service engineer and locks all the authentication functions to use the CE password The secret lock
178. the MFP with the TOE are defined as follows User MFP s user who is registered into MFP In general the employee in the office is assumed Administrator MFP s user who carries out the management of the operation of MFP An administrator performs the operation management of MFP and the management of user In general it is assumed that the person elected from the employees in the office plays this role Service Engineers A user who performs management of maintenance for the MFP Service Engineer performs the repair and adjustment of MFP In general the person in charge at the sales companies that performs the maintenance service of MFP and is in cooperation with Konica Minolta Business Technologies Inc is assumed Person in charge at the Organization that uses the MFP A person in charge at the organization that manages the office where the MFP is installed This person assigns an administrator who carries out the management of the operation of the MFP Person in charge at the Organization that manages the Maintenance of the MFP A person in charge at the organization that carries out management of the maintenance for the MFP This person assigns service engineers who perform the maintenance management for the MFP Besides this though not a user of TOE a person who goes in and out the office are assumed as an accessible person to TOE Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserv
179. threat is reduced because the HDD lock function is activated by O LOCK HDD CAPABILITY operation supporting to use HDD lock function and by OE LOCK HDD operation activating the operation of HDD lock function set bythe administrator and the service engineer Moreover a series of countermeasure for HDD the possibility of the threat is more reduced becaused O CRYPT KEY generates the encryption key for TOE to encrypt data to be written in HDD and O CRYPTO CAPABILITY supports the operation of using encryption function and OE CRYPTO utilize the encryption function of encryption kit set by the administrator and the service engineer The danger of leaking exists by taking out the HDD and replacing another HDD without the HDD lock function but the validity of HDD installed by TOE is verified by O CHECK HDD data is not written in the HDD replaced secretly The possibility of the threat is removed consequently The possibility of the threat for the unauthorized access by the leak of the management information attached image file is removed because the operation conditions achieved through security enhanced function do not permit to select the condition of O CRYPT KEY and OE CRYPT only Accordingly this threat is countered sufficiently T ACCESS PRIVATE BOX Unauthorized access to personal user box using user function This threat assumes the possibility that an unauthorized operation is done by using the user function for the personal user box which each use
180. ticates the administrator in the access through the network by using SNMP from client PC and then permits the operation of a setting function of the network only to the administrator whose identification and authentication was succeeded 7 2 1 Identification and authentication function by SNMP password It identifies and authenticates by the SNMP password that the user who accesses the MIB object through the network with the use of SNMP is an administrator Offers the SNMP authentication mechanism which authenticates by the SNMP password that consists of the character shown in Table 11 gt Only Authentication password or both the Privacy password and the Authentication password is used gt In the case of SNMP the SNMP password is used for every session without requiring the administrator authentication mechanism by the separate session information Reset the authentication failure frequency if it succeeds in authentication gt In the case of both the Privacy password and the Authentication password are used the authentication failure frequency is reset only when both passwords together succeeded in the authentication Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 94 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target When the authentication failure that becomes the 1 3 times at total in each authentication function by using the SNMP pass
181. tication has been selected as the user authentic method the identified and authenticated user is registered as an user ID with the user name and authentication server information that was used with identification and authentication As described above FIA_UID 2I 7 FMT_MTD 1 10 FMT_SMF 1 and FMT_SMR 1I5 are realized 7 4 2 Auto logoff function in user identification and authentication domain While the user who is identified and authenticated is accessing from a panel if it does not accept any operations for more than the panel automatic logoff time it logs off from a user identification and authentication domain automatically As described above FTA_SSL 3 is realized 7 4 3 Modification function of user password When the identification and authentication are succeeded and the access to the user identification and authentication domain is permitted the user is permitted to change its own password When the external server authentication is effective this function cannot be applied When the user password newly set satisfies the following qualities it is changed gt Itis composed of the characters and by the number of digits shown in the Table 11 gt It shall not be composed of one kind of character As described above FIA_SOS 1 3 FMT_MTD 1 2 FMT_SMF1 and FMT_SMR 1 3 are realized Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 99 108 bizhub 501 bizhub 421 bizhub 361 i
182. tication method in the SNMP password authentication function is set to Only Authentication password or the Authentication password and Privacy password As described above FMT _ MOF 1 2 FMT_SMF 1 and FMT_SMR 1 2 are realized 7 1 3 15 Account Settings Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 92 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Account registration Account is registered by setting the account ID and registering the account password It verifies whether the account password newly set have been satisfied the following qualities gt Itis composed of the characters and by the number of digits shown in Table 11 gt It shall not be composed of one kind of character Change of account ID and account password Account ID and account password is changed It verifies whether the account password newly set have been satisfied the following qualities gt Itis composed of the characters and by the number of digits shown in Table 11 gt It shall not be composed of one kind of character Account deletion Account ID and account password are deleted gt When the Group box of the account ID exists that group user box is automatically set to the public user box of user attributes public As described above FIA_SOS 1 5 FMT_MSA 113 FMT_MTD 1 3 FMT_MTD 1 11 FMT _SMF1 and FMT_SMR 1 2 are realized 7 1 3 16
183. tion function being illegally used Moreover this assumes that because of a leak of confidential data such as the password the various setting values are falsified and there is a similar possibility that the user box file or the secure print file may leak O CONFIG regulates that the use of the back up function and the restoration function is permitted only to the administrator so that the possibility of the threat is removed OE FEED BACK uses the application regulating that the protected feedback is returned for the entered password by the administrator authentication and OE N SESSION is also requested the log off operation after the operation ends and so O CONFIG is sufficiently supported Accordingly this threat is countered sufficiently T BRING OUT CF Unauthorized taking out of CF This threat assumes the possibility that the leak of the information data in CF by being taken away or the unauthorized operation by installing the CF with falsified information or TOE For the above the possibility of the threat is reduced because the CF lock function is activated by O LOCK CF CAPABILITY operation supporting to use CF lock function and by OE LOCK CF operation activating the operation of CF lock function set bythe administrator and the service engineer The danger of vulnerable operation for setting values related security exists by taking out the CF and replacing another CF without the CF lock function or another CF disabled CF lock function
184. tion of account password by administrator Modification function of account password by administrator Panel Auto Log otf Time Setting Function by administrator Modification function of administrator password by administrator Modification function of SNMP password by administrator Registration function of user box password by administrator Modification function of user box password by administrator User box registration function by administrator However only when the public is registered for user attribute Modification function of user attribute of the user box by the administrator However only when the user attribute of previous setting is user ID Registration function of user ID by administrator Registration function of user password when method of user authentication by administrator is machine authentication Modification function of user password when method of user authentication by administrator is machine authentication Registration function of S MIME certificate by administrator Registration modification function of S MIME certificate by administrator Operation setting function of S MIME function by administrator Registration function of transmission address data by administrator Modification function of transmission address data by administrator Operation setting function of Trusted Channel function by administrator Registration function of Belonging Account of user by administrator Modification fu
185. to the transmission of a user box file Even an addressee is set precisely a user box file is transmitted the E mail transmission or the FTP transmission to the entity which a user does not intend to so that a user box file is exposed lt The network setting which is related to user box file transmission gt gt Setting related to the SMTP server gt Setting related to the DNS server Malicious person or user changes the network setting which set in MFP to identify MFP itself where TOE installed by setting to the value of the entity such as another illegal MFP from the value of MFP NetBIOS name AppleTalk printer name IP address etc that TOE is 5Abbreviation of Server Message Block Protocol to realize the file sharing or printer sharing on Windows Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 22 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target originally installed so that secure print file is exposed e Malicious person or user changes the TSI recieving settings A user box file is stored to the entity which a user does not intend to so that a user box file is exposed e Malicious person or user changes the PC FAX operation settings By changing the setting of the storing for the public user box to store to common area for all users a user box file is stored to the entity which a user does not intend to so that a user box file is
186. ual Kakutani Deal with typos Deal with expression Correspond to CCv3 1R2 residual Kakutani Add supplemental description for Protected Assets Deal with typos Correspond to CCv3 1R2 residual Fae eae Add condition for SNMP usage eae Deal with typos and expression easel aed Deal with typos and expression pee Deal with typos and expression Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 2 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Contents 0 2 22 2002 nen nnn nnnnn nnn n nn Teo ST TIE OCU CUO 30525 ose eects cee cee nates apra enparar nas tiscatbannnzsiearaseasacente sacs cuessasueceavarseueciascerassess 6 MD STASI CATO A EPE occa iced E E decade cha pets bicee tances A A E Paap beets 6 T2 TOE deni A O A eae aia eae As eis ee ie eee ea ahaa 6 1 3 TOE OVEM OW e a E ara Aa a a a ra oe A EE le sala sed E EE A Aa Eaa EE a 6 Tak TOE TYDE i A ter errr etre u E e a a A A a e 6 1 3 2 Usage of TOE and main Security FUNCTIONS cccccccsceceeceeeneeteneeceneeteeeseneeteaeeseaeeceaeeseaeessaeeseaeeeseaeesaeesineseneeenes 6 14A TOE DESCNPION tari n ttt ee a ee ee a aha ah 7 1 41 Role of the TOE USCN T ried hedged ein diene Ra ee Le ee a a a 7 1 4 2 Phisical Range Of TOE svz ctcaraseshe cates dtalteat ok tea eave deh Seidel Mesh tay hte aden npr aie tants 8 1 4 3 Log
187. uency offered within the administrator mode Hierarchical to No other components Dependencies FIA_UAU 1 FIA_UAU 2 2 FIA_AFL 1 4 Authentication failure handling FIA_AFL 1 1 4 The TSF shall detect when selection assignment positive integer number an administrator configurable positive integer within lassignment range of acceptable values unsuccessful authentication attempts occur related to assignment List of authentication events assignment list of authentication events Authentication for accessing the TOE by user selection assignment positive integer number an administrator configurable positive integer within assignment range of acceptable values assignment range of acceptable values an administrator configurable positive integer within I 3 FIA_AFL 1 2 4 When the defined number of unsuccessful authentication attempts has been selection met surpassed the TSF shall assignment Jist of actions selection met surpassed Surpassed assignment List of actions lt Action when it is detected gt Log off from the authentication status of the user f it is and lock the authentication function for the user lt Operation for recovering the normal condition gt Perform the delete function of authentication failure frequency offered within the administrator mode Hierarchical to No other components Dependencies FIA_UAU 1 FIA_UAU 2 3
188. urity service provided by IT environment entity assignment necessary capability list for the operation of security servicel assignment security service provided by IT environment entity CF lock function achieved by CF assignment necessary capability list for the operation of security service Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 65 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Support function of modifying CF lock password Support function of releasing CF lock function Hierarchical to No other components Dependencies No dependencies 6 1 2 TOE Security Assurance Requirements The TOE is a commercial office product that is used in a general office environment and therefore a TOE security assurance requirement that is required for EAL3 conformance which is a sufficient level as an assurance for commercial office products is applied The following table summarizes the applied TOE security assurance requirements Table 7 TOE Security Assurance Requirements TOE Security Assurance Requirements Security architecture description ADV_ARC 1 Class ADV Functional specification with complete ADV_FSP 3 Class AGD Guidance documents Implementation representation CM ALC_CMS 3 Class ALC coverage Life Cycle Support ALC_DEL1 Identification of security measures
189. user attribute of user box the operation such as a print a download transmissions a movement and a copy FIA_SOS 1 6 secures the quality verification of the session information used in the user box authentication via the network and FIA_SOS 2 secures the quality of the session information which is generated and used lt Management of a public user box gt FMT_MSA 1 2 permits the user who is permitted the use of the user box to operate the change of the user attribute of use box which Public is set FMT_MTD 1 4 permits the change in the user box password only to the administrator and the user who is permitted to the use of the user box FIA_SOS 1 5 verifies the quality of the user box password Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 71 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target As for the user box registration FMT_MSA 3 1 specifies the public to the user attribute of the user box and permits only the user to be given the initial value to change it Moreover when the job that stores an unregistered user box in the box where is specified by this requirement is executed the user ID of the user who executed a job concerned is automatically specified FMT_MTD 1 5 permits the registration of the user box password only to the user or the administrator For the user box attribute of the user box file the user box attribute va
190. word is detected all the authentication functions to use the SNMP password are locked The access to the MIB object is refused gt The administrator specifies the failure frequency threshold by the unauthorized access detection threshold setting function gt In the case of both the Privacy password and the Authentication password are utilized even though both passwords together fails in authentication it is detected as one failure To release the lock the lock release function to the MIB object of FADMIN is performed or the F RESET function operates The lock status is released when the lock release function to the MIB object of F ADMIN is performed As described above FIA_AFL 1 3 FIA_UAU 2 2 and FIA_UID 2 2 are realized 7 2 2 Management function using SNMP When it is identified and authenticated that the user is an administrator by the SNMP password the access to the MIB object is permitted and then the operation of the setting data shown as followings is permitted to be done 1 Network Settings Setting operation of the following setting data is performed gt Setting data that relates to SMTP server IP address port number etc gt Setting data that relates to DNS server IP address port number etc gt Aseries of setting data that relates to MFP address IP address NetBIOS name AppleTalk printer name etc As described above FDP_ACC 1 3 and FDP_ACF 1 3 are realized 2 Change of SNMP password The
191. y modify delete assignment other operations modify modify to User ID or account ID assignment the authorized identified roles User who is permitted to use that public user box Administrator assignment access control SFP information flow control SFP User box access control Hierarchical to No other components Dependencies FDP_ACC 1 or FDP_IFC 1 FDP_ACC 1 1 FMT_SMF 1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 4 FMT_MSA 1 3 Management of security attributes FMT_MSA 1 1 3 The TSF shall enforce the assignment access control SFP information flow control SFP to restrict the ability to selection change_default query modify delete assignment other operations the security attributes assignment ist of security attributes to assignment the authorized identified roles assignment list of security attributes User attributes of user box that is set the Account ID selection change default query modify delete assignment other operations modify modify to luser ID public or other account ID assignment the authorized identified roles User who is permitted to use that account Administrator assignment access control SFP information How control SFP User box access control Hierarchical to No other components Dependencies FDP_ACC 1 or FDP_IFC 1 FDP_ACC 1 1 FMT_SMF 1 FMT_SMF 1 FMT_SMR 1 FMT_SMR 1 2 FMT_SMR 1 6
192. yption passphrase is decided in the encryption functional operation setting to which the access is restricted in F ADMIN the encryption key of 128bit length is generated from the encryption passphrase by applying the SHA 256 algorithm As described above FCS_CKM 1 is realized 7 9 FVALIDATION HDD HDD verification function Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 105 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target F VALIDATION HDD is a check function to permit reading from and writing in the HDD only when it is verified that the illegal HDD is not installed and is confirmed validity when the HDD lock password is set to HDD When the HDD lock password is set to HDD the status of HDD is confirmed in the HDD operation verifying at the time of TOE starting When the HDD lock password certainly being set is returned as the result of status confirmation the access to HDD is permitted If the HDD lock password not being set is returned the access to HDD is refused because of an illegitimate possibility As described above FIA_EID 1 1 is realized 7 10 FVALIDATION CF CF verification function F VALIDATION CF is a check function to permit reading from and writing in the CF only when it is verified that the illegal CF is not installed and is confirmed validity when the CF lock password is set to CF When the CF lock password is set to CF
193. yright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 41 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target Hierarchical to No other components Dependencies FDP_ACF 1 FDP_ACF 1 3 Table 6 Setting Management Access Control Operational List Operational list A task to act for a user SMTP Server Group Object DNS Server Group Object Settings MFP Address Group Object Restore PC FAX operation setting Object FDP_ACF 1 1 Security attribute based access control FDP_ACF 1 1 1 The TSF shall enforce the assignment access control SFP to objects based on the following assignment list of subjects and objects controlled under the indicated SFP and for each the SFP relevant security attributes or named groups of SFP relevant security attributes assignment list of subjects and objects controlled under the indicated SFP and for each the SFP relevant security attributes or named groups of SFP relevant security attributes lt Subject gt lt Sulbject attributes gt A task to act for a user gt User Attribute User ID Account Name Account ID User Box Attribute User Box ID Administrator Attribute lt Object gt lt Object attributes gt User Box gt User Attribute User ID or Public or Account ID User Box File gt User Box Attribute User Box ID assignment access control SFP User Box
194. zational Security POLICIOS ccesccetteeeneeceneeceneeteeeteeeeseetsaeeceaeeseaeeseaeeseaeeseneeseeeteeenenes 33 5 Extended Components Definition c seccccesssececeeeeeeeeeeeeeeeeeeseeeeeeeessseeeeeesseneeeeeseeneneeenees 35 5 1 Extended FUNCtiON COMPONENT aerenca a n a hee 35 51 1 FAD RIPI Def a etic i ates eet aoa os Bee Bee oh oes Mee ed ad een de ee aed a ee eee 36 5 1 2 FIA EID Detinitiones cite tus se ee Acne eles a re en ea edd ees ee eee 36 SA BiFIT CAP E BIOI EAE E E Dee Seatac adage Ste chicas Sb meeige eect aid E AT 37 6 IT Security Requirements nsssssnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnunnnnnnnnnnnnannnnnnnnnnnnnnnnn mnane ennnen nna 39 6 1 TOE Security Requirements s c isc decauscheshdentecctendaedtaeeiecteeadadhttegiedaeseneds Aaaa deeacsindeadsaeied igestesesesle 39 6 1 1 TOE Security Function Requirements ccecceeceeeeceeseeeeteeeeseeessceeeaeeessaeeeaeeesaaeeeaeecsueeseaeecssaeseaeessaeeseneeseaeseneees 39 6 1 2 TOE Security Assurance Requirements cecccccceeeeeeeteeeeeeeeseeeeaeeessaeeeaaeesaaeceaeeeesaeesaaeeseaeeeaeeseaeeeneeseeeseeees 66 6 2 IT Security Requirements Rationale cceeesseceeceseeeceeeeeeeeeeeensceeeeseeaeeceesaneeeessseaeeeeeseaneetenaas 66 6 2 1 Rationale for IT Security Functional Requirements ccccccccecetteeeneeteneeeeeeteneeeaeeseneesaeeseneseneeeseaeeenateeeeteaeees 66 6 2 2 Rationale for IT Security Assurance Requirements cccsc
195. zhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 is Konica Minolta Business Technologies Inc digital MFP in which this TOE is installed comprised by selecting and combining copy print scan and FAX functions Hereinafter referred to as MFP TOE is the 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software that controls the entire operation of MFP including the operation control processing and the image data management that are accepting from the panel of the main body of MFP or through the network TOE offers the protection from exposure of the highly confidential document stored in the MFP Moreover TOE can prevent the unauthorized access to the image data written in HDD for the danger of taking HDD that is the medium that stores the image data in MFP out illegally by using the HDD lock function loaded on the HDD Besides TOE has the deletion method to follow Copyright c 2007 KONICA MINOLTA BUSINESS TECHNOLOGIES INC All Rights Reserved 6 108 bizhub 501 bizhub 421 bizhub 361 ineo 501 ineo 421 ineo 361 Control Software Security Target various overwrite deletion standards It deletes all the data of HDD completely and it contributes to the prevention of the divulging information of the organization that uses MFP by using the method at the time of abandonment or the lease returns 1 4 TOE Description 1 4 1 Role of the TOE User The roles of the personnel that relate to the use of

bizhub 501 / bizhub 421 / bizhub 361 / ineo 501

Contents

Download Pdf Manuals

Related Search

Related Contents