CC Certificate 

Security Target 

Validation Report 

Assurance Activity 

Administrative Guide 

The Ciena Waveserver 5 is a purpose-built network device, data center interconnect (DCI) platform designed to facilitate high-speed, high-capacity connections between data centers. This platform has been designed to meet the collaborative Protection Profile for Network Devices, Version 2.2e [NDcPP 2.2e]. The Waveserver 5 incorporates a range of advanced security features to ensure the integrity and confidentiality of network communications. The TOE uses a Marvell CN9130 processor. While not an exhaustive list, some the main security mechanisms being leveraged include the following.

1.   Encrypted SSH Administration: The device supports encrypted SSH connections for secure remote administration, protecting the communication channel between administrators and the device from unauthorized access and eavesdropping.

2.   RADIUS via TLS: The Waveserver 5 is capable of using RADIUS authentication with TLS encryption, ensuring the secure transmission of login credentials and providing an added layer of protection for user authentication.

3.   Encrypted Syslog Traffic: The platform can encrypt syslog traffic via TLS to a syslog server, safeguarding the privacy and confidentiality of logs and preventing unauthorized access to sensitive log data.

4.   NTP with SHA Authentication: The Waveserver 5 supports the use of NTP with SHA authentication, providing a secure method for time synchronization across network devices and reducing the risk of time-based attacks.

These highlighted security mechanisms, along with other measures, contribute to the Ciena Waveserver 5’s ability to not only meet the collaborative Protection Profile for Network Devices, Version 2.2e, but also deliver a comprehensive and secure networking solution for end users.

The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Ciena Waveserver 5 was evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 Rev 5.The evaluation methodology used by the Evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 Rev 5.The product, when delivered configured as identified in the Ciena Waveserver 5 Rel 2.3.12 Common Criteria Guidance Document, satisfies all of the security functional requirements stated in the Ciena Waveserver 5 OS R2.3.12 Security Target. The project underwent CCEVS Validator review.The evaluation was completed in December 2023.Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.

The TOE is comprised of several security features. Each of the security features identified above consists of several security functionalities, as identified below.

Security Audit

The TOE generates audit events for all start-up and shut-down functions, and all auditable events as specified in Table 11 of the ST. Audit events are also generated for management actions specified in FAU_GEN.1. The TOE is capable of storing audit events locally and exporting them to an external syslog server using TLS v1.1 or TLS v1.2 protocol. Each audit record contains the date and time of event, type of event, subject identity, and the relevant data of the event. The syslog server supports the following severity levels: emergency, alert, error, warning, notice, info and debug. In order to enable the logging to syslog server, a user must be logged in with an administrative access privilege and provision the settings to use a syslog server.

Cryptographic Support

The TOE leverages Waveserver 5 Cryptographic Library for all cryptographic services. The related CAVP validation details are provided in Security Target document Table 13. All algorithms claimed have CAVP certificates. The operating system is Linux Kernel v4.14. The TOE leverages the Waveserver 5 Cryptographic Library for its cryptographic functionality.

Identification and Authentication

The TOE supports Role Based Access Control. All users must be authenticated to the TOE prior to carrying out any management actions. The TOE supports password-based authentication and public key-based authentication. Based on the assigned role, a user is granted a set of privileges to access the system.

Security Management

The TOE supports local and remote management of its security functions including:

•         Local console CLI administration.

•         Remote CLI administration via SSHv2 and HTTPS/TLS.

•         Timed user lockout after multiple failed authentication attempts.

•         Password configurations.

•         Role Based Access Control – Superuser (Security Administrator), Admin and limited user.

•         Configurable banners to be displayed at login.

•         Timeouts to terminate administrative sessions after a set period of inactivity.

•         Protection of secret keys and passwords.

TOE Access

Prior to establishing an administration session with the TOE, a banner is displayed to the user. The banner messaging is customizable. The TOE will terminate an interactive session after 10 minutes of session inactivity. An administrator can terminate their GUI session by clicking on the logout button. A user can terminate their local CLI session and remote CLI session by entering exit at the prompt.

Protection of the TSF

The TOE protects all passwords, pre-shared keys, symmetric keys, and private keys from unauthorized disclosure. Passwords are stored in encrypted format. Passwords are stored as SHA-512 salted hash value as per standard Linux approach. The TOE executes self-tests during initial start-up to ensure correct operation and enforcement of its security functions. An administrator can install software updates to the TOE. The TOE maintains the date and time by the setting of the time manually by a security administrator or by synchronizing with an NTP server configured by a security administrator.

Trusted Path/ Channel

The TOE supports TLS v1.1 or TLS v 1.2 for secure communication to the following IT entities:

Syslog server and Radius server. The TOE supports HTTPS/TLS (WebUI) and SSH v2 (remote CLI) for secure remote administration.

Vendor Information