The Target of Evaluation (TOE) is Trivalent’s Data at Rest (DaR) Service (Inside) Version 1.0.0 (Version Code 2) software application package residing on an evaluated mobile device running Android 4.4. The TOE is a software solution providing the capability to handle file encryption on mobile devices.
\r\nTrivalent’s DaR Service (Inside) provides file level encryption through an APK and a library implementation. DaR Service (Inside) contain Java interfaces in order to support majority of android application storage requirements. The implementation and functionality for java is provided by the TOE.
\r\nDaR’s implementation is a straight Java DaR Service (Inside) APK and a library to be included into one’s mobile application (and then one can use the API). The DaR Service (Inside) runs in the background and uses Bouncy Castle keystores to provide the File Encryption Key Encryption Key (FEKEK) to each of the applications. The DaR Service (Inside) also uses the Android primary keystore to store an RSA key pair used to wrap the AES-wrapped file encryption key encryption key. The management service handles necessary authentication and key management. The file level encryption suite is an API designed to support the use of specialized file level encryption for Android applications. File encryption is provided by the SPX Core (Security First, Secure Parser Library).
","evaluation_configuration":"\r\n\r\nThe evaluated software version for the Inside version is Version 1.0.0 (Version Code 2). The TOE is an application residing on evaluated mobile devices running Android 4.4 on the Snapdragon 800-family processors:
\r\n· Samsung Galaxy S4, Note 3 and NotePRO tablet
\r\n· Samsung Galaxy S5 & Note 10.1 2014 Edition
\r\n· LG G3 Smartphone
\r\n· Samsung Galaxy Note 4, Note Edge, Galaxy Alpha, Galaxy Tab S 8.4 LTE & 10.5 LTE
\r\n· Samsung Galaxy S5 with KNOX 2
\r\n· Samsung Galaxy Note 4, Note Edge, Alpha, Galaxy Tab S 8.4 LTE & 10.5 LTE, Galaxy Tab Active with KNOX 2
\r\n· Samsung Galaxy Note Edge & Galaxy Tab Active
\r\nAny of the above products utilize the Snapdragon 800 family processor and are appropriate for use with the TOE. The TOE is tested on a Samsung Galaxy Note 3.
","security_evaluation_summary":"\r\n\r\nThe evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target. The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 4, September 2012. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 4, July 2012. Gossamer Security Solutions determined that the evaluation assurance level (EAL) for the TOE is EAL 1. The product, when delivered and configured as identified in the Trivalent Operations & Maintenance Manual Data at Rest (DaR), Version 1.0.3, November 23, 2015 document, satisfies all of the security functional requirements stated in the Trivalent Data at Rest (DaR) Service (Inside) (ASPP11/FEEP10) Security Target, Version 0.6, December 21, 2015. The project underwent CCEVS Validator review. The evaluation was completed in December 2015. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID10656-2015) prepared by CCEVS.
","environmental_strengths":"\r\nThe logical boundaries of the Trivalent’s Data at Rest (DaR) Service (Inside) software application package are realized in the security functions that it implements. Each of these security functions is summarized below.
\r\nCryptographic support: The evaluated platform runs Android 4.4 operating system. Android’s APIs allow generation of keys through KeyGenerator, and random numbers are generated using SecureRandom. Keys are used to protect data belonging to the applications that use the TOE.
\r\nThe TOE uses Security First’s SPX Core (Security First, Secure Parser Library) for cryptographic algorithms. The SPX Core supports encryption via AES and random number generation via an SP 800-90 AES-128 CTR DRBG. The TOE uses the platform’s cryptographic API to perform AES key wrapping and keyed hashing via HMAC.
\r\nUser Data Protection: The TOE protects user data by providing encryption services for applications to encrypt their data. The TOE allows encryption of data using AES-128 bit keys
\r\nIdentification and Authentication: The TOE authenticates applications by requiring a PIN/passphrase to unlock the application’s file encryption key. A wrong password results in the unsuccessful loading of the application’s BouncyCastle keystore. Without the correct keystore, the application cannot load the keys necessary for file encryption/decryption.
\r\nSecurity Management: The TOE’s services/options are inaccessible until a configuration has been created. The TOE does not allow invocation of its services without configuration of the TOE’s settings upon first start up. The TOE allows the changing of passwords for management purposes.
\r\nProtection of the TSF: The TOE relies on the physical boundary of the evaluated platform as well as the Android operating system for the protection of the TOE’s application components.
\r\nThe TOE checks for updates by selecting the check current version option on its menu. If an update is needed, Trivalent shall deliver, via email or other agreed upon method, an updated application. The TOE’s software is digitally signed by Trivalent. Each update is accompanied by documentation outlining changes to the overall service, as well as compatible versions of the Trivalent API.
\r\nThe native Android cryptographic library, which provides the TOE’s cryptographic services, have built-in self-tests that are run at power-up to ensure that the algorithms are correct. If any self-tests fail, the TOE will not be able to perform its cryptographic services.
\r\nTrusted path/channels: The TOE does not transmit any data between itself and another product. All of the data managed by the TOE resides on the evaluated platform (Android 4.4).
\r\n","features":[]}