The Target of Evaluation (TOE) is Samsung Z with Tizen 2.3, specifically the VPN Client system service (i.e., Native App) built into Tizen. This ST focuses on the IPsec VPN capabilities of the TOE. The IPSec VPN allows users the ability to have confidentiality, integrity, and protection of data in transit over a public or private network.
\r\nThe TOE is a mobile operating system based on Linux 3.4 with modifications made to increase the level of security provided to end users and enterprises. The TOE is intended to be used as part of an enterprise data solution providing mobile staff with enterprise connectivity.
\r\nThe TOE includes a Common Criteria mode (or “CC mode”) that an administrator can invoke through the use of a Mobile Device Management (MDM) Server or through the installation and use of the administrative application. The TOE must be configured as follows in order for an administrator to transition the TOE to CC mode:
\r\n· Require a screen lock password (swipe, PIN, pattern, or facial recognition screen locks are not allowed).
\r\n· The maximum password failure retry policy should be less than or equal to ten.
\r\n· Device encryption must be enabled.
\r\n· SDCard encryption must be enabled.
\r\n· Revocation checking must be enabled.
\r\nWhen CC mode has been enabled, the TOE behaves as follows:
\r\n· The TOE restricts the available VPN configurations to those evaluated as part of this evaluation.
\r\n· The TOE restricts the use of IKEv2/IPsec cipher suites to only those conformant with the requirements of the Protection Profile for IPsec Virtual Private Network (VPN) Clients.
","evaluation_configuration":"\r\n\r\nThe TOE is a VPN Client running on the Tizen version 2.3 operating system (based on Linux 3.4) and is being evaluated on the Samsung Z (SM-Z910) hardware platform containing the MSM8974 model processor of the Snapdragon 800 chipset that has the following specifications:
\r\n| \r\n Component \r\n | \r\n\r\n Details \r\n | \r\n
| \r\n CPU \r\n | \r\n\r\n Quad-core Krait 400 CPU at up to 2.3 GHz per core \r\n | \r\n
| \r\n GPU \r\n | \r\n\r\n Qualcomm® Adreno™ 330 GPU \r\n | \r\n
| \r\n Modem \r\n | \r\n\r\n · Integrated 4G LTE Advanced World Mode, supporting LTE FDD, LTE TDD, WCDMA (DC-HSPA+, DC-HSUPA), CDMA1x, EV-DO Rev. B, TD-SCDMA and GSM/EDGE \r\n· 3rd generation integrated LTE modem, with support for LTE-Broadcast \r\n | \r\n
| \r\n RF \r\n | \r\n\r\n 4th generation LTE multimode transceiver with Qualcomm RF360™ Front End solution for world mode bands, lower power and PCB reduction \r\n | \r\n
| \r\n USB \r\n | \r\n\r\n USB 2.0 \r\n | \r\n
| \r\n Bluetooth \r\n | \r\n\r\n BT4.0 integrated digital core \r\n | \r\n
| \r\n WiFi \r\n | \r\n\r\n 1-stream 802.11n/ac Integrated digital core \r\n | \r\n
| \r\n Memory/Storage \r\n | \r\n\r\n LPDDR3 800MHz Dual-channel 32-bit (12.8GBps)/eMMC 5.0 SATA3 SD 3.0 (UHS-I) \r\n | \r\n
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) processes and procedures. Samsung Z VPN on Tizen v2.3 was evaluated against the criteria contained in the Common Criteria for Information Technology Security Evaluation, Version 3.1 Revision 4. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 Revision 4. The product, when installed and configured per the instructions provided in the preparative guidance, satisfies all of the security functional requirements stated in the Samsung Z VPN on Tizen v2.3 with Qualcomm Processors Security Target Version 1.0. The evaluation underwent CCEVS Validator review. The evaluation was completed in August 2015. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report, (report number CCEVS-VR-VID10613-2015) prepared by CCEVS.
","environmental_strengths":"\r\n\r\nCryptographic Support
\r\nThe IPsec implementation is the primary function of the TOE. IPSec is used by the TOE to protect communication between itself and a VPN Gateway over an unprotected network. With the exception of the IPsec implementation, the TOE relies upon the underlying TOE platform (evaluated against the Protection Profile For Mobile Device Fundamentals, Version 1.1 12 February 2014) for the cryptographic services specified in the Security Target.
\r\nUser Data Protection
\r\nThe TOE ensures that residual information is protected from potential reuse in accessible objects such as network packets by overwriting residual information in the buffer and padding packet payloads.
\r\nIdentification and Authentication
\r\nThe TOE provides the ability to use, store, and protect X.509v3 certificates as defined by RFC 5280 and pre-shared keys that are used for IPsec Virtual Private Network (VPN) connections. The TOE also supports certificate revocation handling.
\r\nSecurity Management
\r\nThe TOE, TOE platform, and VPN Gateway provide all functionality to manage the security functions identified throughout this Security Target. In particular, the IPsec VPN is fully configurable by a combination of functions provided directly by the TOE and those available to the associated VPN Gateway.
\r\nProtection of the TSF
\r\nThe TOE relies upon its underlying platform to perform self-tests that cover the TOE as well as the functions necessary to securely update the TOE. It performs known answer power on self-tests (POST) on its cryptographic algorithms to ensure that they are functioning correctly. The Samsung Security Manager service invokes the self-test of the OpenSSL module at startup to ensure that those cryptographic algorithms are working correctly. If the TOE platform fails its power-up tests, the TOE platform will not boot into a mode where the VPN client is accessible. Additionally, the Tizen OS on the TOE platform requires that all applications bear a valid signature before Tizen will install the application.
\r\nTrusted Path/Channels
\r\nThe TOE acts as a VPN Client using IPsec to established secure channels to corresponding VPN Gateways.
","features":[]}