The Logical Partition Architecture for Power6 (LPAR) is a product that facilitates the sharing of hardware resources by disparate applications (e.g., AIX, Linux). The product is based on the concept of a 'hypervisor' that is designed to instantiate 'partitions', each with its own distinct resources, that each appear to their hosted applications as a completely functional underlying platform. These partitions are implemented to prevent interference among partitions and to prevent simultaneous sharing of storage and other device resources
\r\nThe operating systems executing in the available partitions are treated as subjects of the LPAR, where LPAR not only provides the necessary operational support for the hosted operating systems, but also serves to separate them from each other to ensure mutual non-interference.
\r\nWhile not included as part of the evaluation, LPAR is configured using a connected Hardware Management Console (HMC) that provides access to the functions necessary to enable administrative personnel to effectively manage the allocation of resources (i.e., processors, memory, and I/O devices) to the configured partitions. Once the LPAR is configured, the HMC must be disconnected so that it offers no interfaces while LPAR is operating in its evaluated configuration
","evaluation_configuration":null,"security_evaluation_summary":"The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the IBM LPAR TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 2.3 and International Interpretations effective on August 15, 2006. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 2.3. Science Applications International Corporation (SAIC) determined that the evaluation assurance level (EAL) for the product is EAL 4 augmented with ALC_FLR.2. The product, when delivered configured as identified in Common Criteria Installation Instructions for IBM Logical Partitioning Architecture on System i and System p document, satisfies all of the security functional requirements stated in the IBM Logical Partition Architecture for Power6 Security Target (Version 1.0). One validator on behalf of the CCEVS Validation Body monitored the evaluation carried out by SAIC and the project underwent two Validation Oversight Panel (VOR) panel reviews. The evaluation was completed in September 2007. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report, (report number CCEVS-VR-VID10178-2007, dated 7 November 2007) prepared by CCEVS.
","environmental_strengths":"The logical boundaries of LPAR can be characterized as the set of security functions available at its physical interfaces. Each of these security functions is summarized below.
\r\nUser Data Protection: LPAR manages the association of CPUs, memory, and I/O devices, in a relatively static environment, with partitions containing operating system instances. Memory and I/O devices can be assigned to single partitions and when assigned are accessible only by the partition. CPUs can also be assigned a single partition, and only that partition (and occasionally the TOE) can use that CPU. CPUs can also be configured to be shared among a collection of partitions (shared processor partition or also called micro-partitions) and LPAR will save/restore the hardware register state when switching between partitions.
\r\nLPAR also provides a mechanism where users can create LPAR groups (also referred to as eWLM groups) where a list of partitions are allowed to shared the quantity of resources (memory and processors but not I/O) between the partitions. The resource is still owned at any point in time by one and only one partition but the operating system is given the ability to remove the resource from one partition and another partition can add the resource to their partition in the same group. LPAR clears out the state of the resource before it is moved between partitions.
\r\nIdentification and Authentication: Partitions are implicitly identified and authenticated by internal numerical identifiers associated with partitions (using internal data structures) as they are defined. Being implicitly identified by LPAR, partitions have no need, nor means, to identify themselves. Furthermore, the identification of a partition is guaranteed by LPAR and as such each partition is also continuously authenticated.
\r\nSecurity management: All of the LPAR configuration occurs via the interface to the HMC. Since the HMC is disconnected while LPAR is operational, LPAR effectively doesn’t offer any security management functions. However, LPAR serves to restrict the ability to change its own configuration nonetheless.
\r\nProtection of the TOE Security Functions: The components of LPAR protect themselves using the domains provided by the Power6 processors. LPAR operates in the privileged domain and the partitions operate in the unprivileged domain. This allows LPAR to protect itself as well as the resources it makes selectively available to the applicable partitions.
\r\nBeyond protecting itself and its resources, LPAR is also designed such that when the hardware that supports a partition fails, the other partitions will continue uninterrupted.
","features":[]}