The Security Target (ST) defines the Information Technology (IT) security requirements for the Ciena Carrier Ethernet Solutions Service Delivery and Aggregation Switches, Release 6.9 and 7.1. The TOE receives data from an external source and forwards that data to one or many ports. Carrier Ethernet Solutions (CES) provides a way to deliver Ethernet services across many networks while providing bandwidth management. CES operates on QoS capabilities and virtual switching functions to deliver different amounts of data to various ports. CES also contains next-generation Ethernet features that transport different Ethernet services through fiber or copper connections.
","evaluation_configuration":"The TOE was evaluated on the following platforms:
\r\n| \r\n Platform \r\n | \r\n\r\n Definition \r\n | \r\n
| \r\n SAOS 7.1.0.566 \r\n | \r\n\r\n The system software on CES 5410 and 5305 Service Aggregation Switches. This system software cannot be installed on Service Delivery Switches, Service Concentration Switches, or other Service Aggregation Switches, and 4.x or 6.x system software cannot be installed on the CES 5410 or 5305. Service Delivery Switches are intended to be deployed at the edge of a network, while Service Aggregation Switches are intended to be deployed in the network’s core. This system software is based on a common Service Aware Operating System (SAOS) code base designed to deliver consistent benefits across all Ethernet delivery, aggregation, and distribution configurations. \r\n\r\n For SAOS 7.1, the following licenses are included in the evaluated configuration: \r\n
| \r\n
| \r\n SAOS 6.9.1.148 \r\n | \r\n\r\n The system software on CES 3900 and 5100 Series Service Delivery Switches. Service Delivery Switches are intended to be deployed at the edge of a network, while Service Aggregation Switches are intended to be deployed in the network’s core. This system software is based on a common Service Aware Operating System (SAOS) code base designed to deliver consistent benefits across all Ethernet delivery, aggregation, and distribution configurations. \r\n\r\n For SAOS 6.9, the following licenses are included in the evaluated configuration: \r\n
| \r\n
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) processes and procedures. The TOE was evaluated against the criteria contained in the Common Criteria for Information Technology Security Evaluation, Version 3.1 Revision 3. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 Revision 3. It has been determined that the product meets the security criteria in the Security Target, which specifies an assurance level of EAL2. Validators, on behalf of the CCEVS Validation Body, monitored the evaluation. The evaluation was completed in November 2012.
","environmental_strengths":"User Data Protection and Resource Utilization
\r\nThe TOE’s core functionality is to perform traffic forwarding across multiple layer 2 networks. The TOE is capable of both information flow control (all traffic of a certain type is forwarded to a certain port or dropped) and QoS (a percentage of traffic is forwarded based on resource constraints) policy enforcement. Information flow control is performed based on MAC address, IP address, port, VLAN tag, and PBB/PBB-TE encapsulation. QoS is based on VLAN priority tagging.
\r\nSecurity Audit
\r\nThe TOE contains mechanisms to generate audit data based upon successful and unsuccessful management actions initiated by all authorized users of the TOE. The TOE contains mechanisms to perform remote logging via syslog in order to facilitate external audit trail storage. In addition, the TOE monitors for potential security violations or error conditions and can be configured to send SNMP traps when these activities are observed.
\r\nCryptographic Support
\r\nThe TOE provides mechanisms to generate and destroy cryptographic keys to set up the SSH connection. The evaluated configuration requires the use of 2048-bit RSA keys. Cryptography has not been validated by a third party and its effectiveness is self-asserted by the vendor.
\r\nIdentification and Authentication
\r\nAll TOE users must be identified and authenticated before performing any TSF-relevant actions. In addition to basic username/password authentication, the TOE is able to integrate with external RADIUS and/or TACACS+ servers to facilitate enterprise authentication.
\r\nSecurity Management
\r\nThe TOE maintains three distinct roles for user accounts: Limited, Super, and Diag. Version 7.1 of SAOS also includes an Admin role between Limited and Super. These roles determine the scope of management functions available to the user. The Super role assumes all TOE management functionality. The Limited role has read-only access exclusively. The Admin role has the ability to modify the TOE configuration with the exception of TOE users and authentication policies.
\r\nProtection of the TSF
\r\nThe TOE maintains accurate system time to provide accurate timestamps on audit and system records. It is also capable of NTP synchronization to facilitate this. The TOE is also demonstrates fault tolerance, both in the form of maintaining information flow control when a control card fails on a chassis-based appliance and in the form of ensuring that data flow continues when a redundant physical link is terminated.
","features":[]}