PRODUCT DESCRIPTION

The Target of Evaluation (TOE) is AquaLogic® Interaction Collaboration 4.2 MP1, henceforth referred to as Collaboration. Collaboration is part of the AquaLogic User Interaction (ALUI) suite of products and is designed to work with AquaLogic Interaction 6.1 with AquaLogic Interaction Development Kit 6.0[1], hereafter referred to as ALI.

Collaboration is not a stand-alone product; rather it integrates directly with ALI and depends on ALI portal pages and security functions. Collaboration functions as a remote server of ALI by providing Collaboration data and application functions in portlets and application views to ALI users. A collection of Collaboration web services provide the communication mechanism for this exchange of portlet data between ALI and Collaboration.

Collaboration is a web application featuring a collection of collaboration tools that help users organize, share, and manage information. Collaboration facilitates teamwork among members of a project team by providing a unified online workspace for project members to share information. Collaboration can have many projects and project information can be accessed from any ALI community page or My Page that contains a Collaboration portlet.

SECURITY EVALUATION SUMMARY

The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process. The criteria against which the AquaLogic^® Interaction Collaboration 4.2 MP1 TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 2.3.  The evaluation methodology used by the Evaluation Team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 2.3.  Science Applications International Corporation (SAIC) determined that the evaluation assurance level (EAL) for the product is the EAL2 family of assurance requirements, augmented with ALC_FLR.2 (Flaw reporting procedures).  The product satisfies all of the security functional requirements stated in the AquaLogic Interaction Collaboration 4.2 MP1 Security Target, when configured as specified in the following guidance documents:

• Release Notes
• Installation and Upgrade Guide
• Installation Worksheet for Windows Installations
• Installation Worksheet for UNIX Installations
• Deployment Guide for AquaLogic User Interaction.

These documents are available for download from http://edocs.bea.com/alui/collaboration/docs42/index.html.

One validator on behalf of the CCEVS Validation Body monitored the evaluation carried out by SAIC.  The evaluation was completed in January 2009. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number to be assigned), prepared by CCEVS.

ENVIRONMENTAL STRENGTHS

AquaLogic^® Interaction Collaboration 4.2 MP1 provides a low to moderate level of independently assured security in a conventional TOE and is suitable for a cooperative non-hostile environment with good physical access security and competent administrators.

AquaLogic^® Interaction Collaboration 4.2 MP1 supports the following security functions:

• User Data Protection

  The TOE defines an access control mechanism to control the users that can access the TOE defined objects. The users of the TOE are defined, managed and maintained by ALI.

• Security Management

  The TOE provides the ability for an authorized administrator to manage and define access control attributes and TOE security functions data.

• Protection of the TSF

  The TOE enforces the access control mechanisms to ensure that the security functions can not be by-passed. The TOE depends on its operating environment to store, protect, and ensure that the TOE functions are not tampered with or bypassed.

  The TOE leverages the security functions offered by ALI to ensure that users of the TOE are identified and authenticated before access to the TOE is granted. The TOE depends upon ALI to define, maintain, and manage the administrator groups of the TOE, and the users, user groups, and community groups that can be assigned to the roles in the TOE. The TOE also depends upon ALI to define, maintain, and manage administrative objects that implement the Collaboration integration with ALI.

Vendor Information

Oracle Corporation UK Limited
Shaun Lee
+44 (0) 188 924 3860
+44 (0) 188 924 3171 (Fax)
seceval_us@oracle.com

http://www.oracle.com/index.html