The Target of Evaluation (TOE) is CyberReliant Corporation’s (CRC) Data at Rest (DaR) Service (Native) Version 1.0.0 (Version Code 2) software application package residing on an evaluated mobile device running Android 4.4. The TOE is a software solution providing the capability to handle file encryption on mobile devices.
\r\nCRC’s DaR Service (Native) provides file level encryption through an APK and a library implementation. DaR Service (Native) contain Java interfaces in order to support majority of android application storage requirements. The implementation and functionality for java is provided by the TOE.
\r\nThe DaR’s Management Service implementation is a straight Java DaR Service (Native) APK and a library to be included into one’s mobile application (and then one can use the API). The Management Service (Native) runs in the background and uses both Android and BouncyCastle keystores to provide the File Encryption Key Encryption Key (FEKEK) to each of the applications. The DaR Service (Native) also uses the Android keystore to store an RSA key pair used by the Management service, and a per application android keystore to store each application’s RSA keypair to wrap the AES-wrapped file encryption key encryption key. The Management Service handles necessary user authentication and key management. The file level encryption suite is an API designed to support the use of specialized file level encryption for Android applications. Encryption is provided by the native Android cryptographic API.
","evaluation_configuration":"\r\n\r\nThe evaluated software version is Version 1.0.0 (Version Code 2). The TOE is an application installed on one of the following evaluated mobile devices running Android 4.4:
\r\n· Samsung Galaxy S4, Note 3 and NotePRO tablet
\r\n· Samsung Galaxy S5 & Note 10.1 2014 Edition
\r\n· LG G3 Smartphone
\r\n· Samsung Galaxy Note 4, Note Edge, Galaxy Alpha, Galaxy Tab S 8.4 LTE & 10.5 LTE
\r\n· Samsung Galaxy S5 with KNOX 2
\r\n· Samsung Galaxy Note 4, Note Edge, Alpha, Galaxy Tab S 8.4 LTE & 10.5 LTE, Galaxy Tab Active with KNOX 2
\r\n· Samsung Galaxy Note Edge & Galaxy Tab Active
\r\nThe application provides other applications with an interface library, which is compiled into another application’s package and allows that application to invoke the TOE’s services. This library allows the application to call the TOE’s file encryption services. The TOE relies on the evaluated platform’s Android API for generating keys as well as handling encryption. The TOE invokes Android’s cryptographic API to generate AES-256 bit keys through Android’s KeyGenerator API.
","security_evaluation_summary":"\r\n\r\nThe evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target. The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 4, September 2012. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 4, July 2012. Gossamer Security Solutions determined that the evaluation assurance level (EAL) for the TOE is EAL 1. The product, when delivered and configured as identified in the CyberReliant Operations & Maintenance Manual Data at Rest (DaR), Version 1.0.2, October 27, 2015 document, satisfies all of the security functional requirements stated in the CyberReliant Corp. Data at Rest (DaR) Service (Native) (ASPP11/FEEP10) Security Target, Version 0.6, October 21, 2015. The project underwent CCEVS Validator review. The evaluation was completed in October 2015. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID10651-2015) prepared by CCEVS.
","environmental_strengths":"The logical boundaries of the CyberReliant Corporation’s Data at Rest (DaR) Service (Native) software application package are realized in the security functions that it implements. Each of these security functions is summarized below.
Cryptographic support: The TOE uses the cryptographic services from the evaluated platform. The evaluated platform runs Android 4.4 operating system. Android’s APIs allow generation of keys through KeyGenerator, and random numbers are generated using SecureRandom. Keys are used to protect data belonging to the applications that use the TOE.
User data protection: The TOE protects user data by providing encryption services for applications to encrypt their data. The TOE allows encryption of data using AES-256 bit keys.
\r\nIdentification and authentication: The TOE authenticates applications by requiring a PIN/passphrase to unlock the application’s file encryption key. A wrong password results in the unsuccessful loading of the application’s BouncyCastle keystore. Without the correct keystore, the application cannot load the keys necessary for file encryption/decryption.
\r\nSecurity management: The TOE’s services/options are inaccessible until a configuration has been created. The TOE does not allow invocation of its services without configuration of the TOE’s settings upon first start up. The TOE allows the changing of passwords for management purposes.
\r\nProtection of the TSF: The TOE relies on the physical boundary of the evaluated platform as well as the Android operating system for the protection of the TOE’s application components.
The TOE checks for updates by selecting the check current version option on its menu. If an update is needed, CRC shall deliver, via email or other agreed upon method, an updated application. The TOE’s software is digitally signed by CyberReliant. Each update is accompanied by documentation outlining changes to the overall service, as well as compatible versions of the CRC API.
The native Android cryptographic library, which provides the TOE’s cryptographic services, have built-in self-tests that are run at power-up to ensure that the algorithms are correct. If any of the self-tests fail, the TOE will not be able to perform its cryptographic services.
Trusted path/channels: The TOE does not transmit any data between itself and another product. All of the data managed by the TOE resides on the evaluated platform (Android 4.4).
","features":[]}