CC Certificate 

Security Target 

Validation Report 

Assurance Activity 

Administrative Guide 

The Cyber Reliant Mobile Data Defender for Android SDK Version 4.0 provides file level encryption through an Android Package Kit (APK) and a library implementation. The library contains both Java and native (C/C++) interfaces in order to support the majority of Android application storage requirements. The same implementation and functionality for both java and C/C++ are provided by the TOE. The library offers two groups of Application Programming Interface (API): one set to manipulate files and one set to manipulate SQLite databases.

While the API groups provide different abstractions for the read and write operations, they are ultimately simply reading and writing a single file. The library is providing file level encryption.

The Management Service application is a straight Java Data Protection SDK APK, while the Library is intended to be included into a mobile application (and then the mobile application can use the API libraries). The Management Service Application runs in the background and uses WolfCrypt keystores to provide the File Encryption Key Encryption Key (FEKEK) to each of the applications. The Data Protection SDK uses the Android keystore to generate and store an RSA key pair used by the Management Service. On a per application basis the Android keystore is leveraged to store each application’s RSA keypair to double wrap the AES-wrapped FEKEK. The single and double wrapped FEKEKs are then stored in WolfCrypt secure keystores. The Management Service application handles necessary authentication and key management. The file level encryption suite is an API designed to support the use of specialized file level encryption for Android applications. Encryption is provided by the Cyber Reliant Mobile Data Defender for Android SDK with WolfCrypt.

The evaluated configuration consists of the Cyber Reliant Mobile Data Defender for Android SDK Version 4.0 software application package residing on evaluated mobile devices running Android 11. The TOE is a software solution providing the capability to handle file encryption on mobile devices. The TOE is capable of running on Android 11 devices under VID11160, VID11211, or VID11315 with the same application supporting any of the devices.  The TOE was tested on the following mobile devices representing one device from each VID.

The same application runs on all Android devices.  Since the TOE is the same for the remaining devices under these evaluations and their behavior was evaluated to be equivalent from a security function standpoint, all other devices from these evaluations are claimed as equivalent.

VID11160

·       Samsung S21 (S21 5G / S21+ 5G / S21 Ultra 5G)

·       Samsung S21 (S21 5G / S21+ 5G / S21 Ultra 5G / S21 5G FE / Z Fold3 5G / Z Flip3 5G)

·       Samsung S20 (S20 5G / S20+ 5G / S20 Ultra 5G / S20 LTE 5G / S20 5G FE / Note20 5G / Note20 LTE / Note20 Ultra LTE / Note20 Ultra 5G)

·       Samsung S20 (S20+ 5G / S20 FE / S20 Ultra 5G / Z Flip 5G / Tab S7 / Tab S7+ / Note20 5G / Note20 Ultra 5G / Z Fold2 5G)

·       Samsung XCover Pro / Samsung A51

·       Samsung Note10 (Note10+ 5G / Note10+ / Note 10 5G / Note 10)

·       Samsung S10e (S10+ / S10 5G / S10)

·       Samsung S10+_(Note10+ 5G / Note10+ / Note 10 / Tab S6 / S10 5G / S10 / S10e / Fold 5G / Fold / Z Flip)

VID11211

·       Samsung A52 5G (A52 5G / A42 5G)

·       Samsung A71 5G (A71 5G / A51 5G)

·       Samsung Tab Active 3

VID11315

·       Panasonic ToughBook FZN1 (FZN1 / FZS1 / FZA3)

The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance.  The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target.  The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5, April 2017. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 5, April 2017.  The product, when delivered and configured as identified in the Cyber Reliant Defender Installation and Use, March 2023 document, satisfies all of the security functional requirements stated in the Cyber Reliant Mobile Data Defender for Android SDK Version 4.0 Security Target, Version 0.6, March 16, 2023.  The project underwent CCEVS Validator review.  The evaluation was completed in March 2023.  Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID11283-2023) prepared by CCEVS.

The logical boundaries of the Cyber Reliant Mobile Data Defender for Android SDK Version 4.0 are realized in the security functions that it implements. Each of these security functions is summarized below.

Cryptographic support:

The evaluated platform runs on Android 11 operating system. Android APIs allow generation of keys through Key Generator, and random numbers are generated using Java SecureRandom (256 bits). Keys are used to protect data belonging to the applications that use the TOE.

The TOE uses the Cyber Reliant Mobile Data Defender for Android SDK with the WolfCrypt Module for cryptographic algorithms. The module supports encryption via AES and random number generation via an SP 800-90 AES-256 DRBG. The TOE also performs AES key wrapping and keyed hashing via HMAC.

User data protection:

The TOE protects user data by providing encryption services for applications to encrypt their data. The TOE allows encryption of data using AES-256 bit keys.

Identification and authentication:

The TOE authenticates applications by requiring a PIN/passphrase to unlock the application’s file encryption key. A wrong password results in the unsuccessful loading of the application’s WolfCrypt keystore. Without the correct keystore, the application cannot load the keys necessary for file encryption/decryption.

Security management:

The TOE’s services/options are inaccessible until a configuration has been created. The TOE does not allow invocation of its services without configuration of the TOE’s settings upon first start up. The TOE allows password changes for management purposes.

Privacy:

The TOE does not transmit Personally Identifiable Information (PII) over any network.

Protection of the TSF:

The TOE uses the physical boundary of the evaluated platform as well as the Android operating system for the protection of the TOE’s application components.

The TOE checks for updates by selecting the check current version option on its menu.  If an update is needed, Cyber Reliant shall deliver, via email or other agreed upon method, an updated application. The TOE’s software is digitally signed by Cyber Reliant. Each update is accompanied by documentation outlining changes to the overall service, as well as compatible versions of the Cyber Reliant API.

Trusted path/channels:

The TOE does not transmit any data between itself and another product. All TOE-managed data resides on the evaluated platform.

Vendor Information