The Target of Evaluation (TOE) is the Apple iOS 9.3.2 operating system that runs on the following iPad and iPhone devices with the underlying hardware platform: iPhone and iPad devices using the A7 processor (iPhone 5s, iPad mini 2, iPad mini 3, iPad Air) or A8/A8X processor (iPhone 6, iPhone 6 Plus, iPad mini 4 (A8), and iPad Air 2 (A8X)).
","evaluation_configuration":"\r\n\r\nThe following table lists the devices that are covered by this evaluation.
\r\n| \r\n Device Name \r\n | \r\n\r\n Model Number \r\n | \r\n\r\n Pro-cessor \r\n | \r\n\r\n WiFi \r\n | \r\n\r\n Cellular \r\n | \r\n\r\n Bluetooth \r\n | \r\n
| \r\n iPhone 5s \r\n | \r\n\r\n A1533 (GSM) \r\nA1533 (CDMA) \r\nA1453 \r\nA1457 \r\nA1530 \r\n | \r\n\r\n A7 \r\n | \r\n\r\n 802.11/a/b/g/n/ac \r\n802.11/a/b/g/n/ac \r\n802.11/a/b/g/n/ac \r\n802.11/a/b/g/n/ac \r\n802.11/a/b/g/n/ac \r\n | \r\n\r\n See table 2 \r\nSee table 2 \r\nSee table 2 \r\nSee table 2 \r\nSee table 2 \r\n | \r\n\r\n 4.0 \r\n4.0 \r\n4.0 \r\n4.0 \r\n4.0 \r\n | \r\n
| \r\n iPhone 6 Plus/ iPhone 6 \r\n | \r\n\r\n A1549/A1522 (GSM) \r\nA1549/A1522 (CDMA) \r\nA1586/A1524 \r\n | \r\n\r\n A8 \r\n | \r\n\r\n 802.11/a/b/g/n/ac \r\n802.11/a/b/g/n/ac \r\n802.11/a/b/g/n/ac \r\n | \r\n\r\n See table 2 \r\nSee table 2 \r\nSee table 2 \r\n | \r\n\r\n 4.0 \r\n4.0 \r\n4.0 \r\n | \r\n
| \r\n iPad mini 2 \r\n | \r\n\r\n A1489 (WiFi only) \r\nA1490 (WiFi + cellular) \r\nA1491 (WiFi + cellular) \r\n | \r\n\r\n A7 \r\n | \r\n\r\n 802.11a/b/g/n \r\n802.11a/b/g/n \r\n802.11a/b/g/n \r\n | \r\n\r\n - \r\nSee table 2 \r\nSee table 2 \r\n | \r\n\r\n 4.0 \r\n4.0 \r\n4.0 \r\n | \r\n
| \r\n iPad mini 3 \r\n | \r\n\r\n A1599 (WiFi only) \r\nA1600 (WiFi + cellular) \r\nA1601 (WiFi + cellular) \r\n | \r\n\r\n A7 \r\n | \r\n\r\n 802.11a/?b/?g/?n \r\n802.11a/?b/?g/?n \r\n802.11a/?b/?g/?n \r\n | \r\n\r\n - \r\nSee table 2 \r\nSee table 2 \r\n | \r\n\r\n 4.0 \r\n4.0 \r\n4.0 \r\n | \r\n
| \r\n iPad mini 4 \r\n | \r\n\r\n A1538 (WiFi only) \r\nA1550 (WiFi + cellular) \r\n | \r\n\r\n A8 \r\n | \r\n\r\n 802.11a/?b/?g/?n \r\n802.11a/?b/?g/?n \r\n | \r\n\r\n - \r\nSee table 2 \r\n | \r\n\r\n 4.2 \r\n4.2 \r\n | \r\n
| \r\n iPad Air \r\n | \r\n\r\n A1474 (WiFi only) \r\nA1475 (WiFi + cellular) \r\nA1476 (WiFi + cellular) \r\n | \r\n\r\n A7 \r\n | \r\n\r\n 802.11a/b/g/n \r\n802.11a/b/g/n \r\n802.11a/b/g/n \r\n | \r\n\r\n - \r\nSee table 2 \r\nSee table 2 \r\n | \r\n\r\n 4.0 \r\n4.0 \r\n4.0 \r\n | \r\n
| \r\n iPad Air 2 \r\n | \r\n\r\n A1566 (WiFi only) \r\nA1567 (WiFi + cellular) \r\n | \r\n\r\n A8X \r\n | \r\n\r\n 802.11a/b/g/n/ac \r\n802.11a/b/g/n/ac \r\n | \r\n\r\n - \r\nSee table 2 \r\n | \r\n\r\n 4.2 \r\n4.2 \r\n | \r\n
Table 1: Devices Covered by the Evaluation
\r\nThe following table lists the cellular protocols supported by each model.
\r\n| \r\n Device Name \r\n | \r\n\r\n Model Number \r\n | \r\n\r\n Cellular \r\n | \r\n
| \r\n iPhone 5s \r\n | \r\n\r\n A1533 (GSM) | \r\n\r\n UMTS/HSPA+/DC-HSDPA (850, 900, 1700/2100, 1900, 2100 MHz); \r\nGSM/EDGE (850, 900, 1800, 1900 MHz); \r\nLTE (Bands 1, 2, 3, 4, 5, 8, 13, 17, 19, 20, 25) \r\n | \r\n
| \r\n A1533 (CDMA) | \r\n\r\n CDMA EV-DO Rev. A and Rev. B (800, 1700/2100, 1900, 2100 MHz); \r\nUMTS/HSPA+/DC-HSDPA (850, 900, 1700/2100, 1900, 2100 MHz); \r\nGSM/EDGE (850, 900, 1800, 1900 MHz); \r\nLTE (Bands 1, 2, 3, 4, 5, 8, 13, 17, 19, 20, 25) \r\n | \r\n|
| \r\n A1453 \r\n | \r\n\r\n CDMA EV-DO Rev. A and Rev. B (800, 1700/2100, 1900, 2100 MHz); \r\nUMTS/HSPA+/DC-HSDPA (850, 900, 1700/2100, 1900, 2100 MHz); \r\nGSM/EDGE (850, 900, 1800, 1900 MHz); \r\nLTE (Bands 1, 2, 3, 4, 5, 8, 13, 17, 18, 19, 20, 25, 26) \r\n | \r\n|
| \r\n A1457 \r\n | \r\n\r\n UMTS/HSPA+/DC-HSDPA (850, 900, 1900, 2100 MHz); \r\nGSM/EDGE (850, 900, 1800, 1900 MHz); \r\nLTE (Bands 1, 2, 3, 5, 7, 8, 20) \r\n | \r\n|
| \r\n A1530 \r\n | \r\n\r\n UMTS/HSPA+/DC-HSDPA (850, 900, 1900, 2100 MHz); \r\nGSM/EDGE (850, 900, 1800, 1900 MHz); \r\nFDD-LTE (Bands 1, 2, 3, 5, 7, 8, 20); \r\nTD-LTE (Bands 38, 39, 40) \r\n | \r\n|
| \r\n iPhone 6 Plus/ iPhone 6 \r\n | \r\n\r\n A1549/A1522 (GSM) \r\n | \r\n\r\n UMTS/HSPA+/DC-HSDPA (850, 900, 1700/2100, 1900, 2100 MHz) \r\nGSM/EDGE (850, 900, 1800, 1900 MHz) \r\nLTE (Bands 1, 2, 3, 4, 5, 7, 8, 13, 17, 18, 19, 20, 25, 26, 28, 29) \r\n | \r\n
| \r\n A1549/A1522 (CDMA) \r\n | \r\n\r\n CDMA EV-DO Rev. A and Rev. B (800, 1700/2100, 1900, 2100 MHz) \r\nUMTS/HSPA+/DC-HSDPA (850, 900, 1700/2100, 1900, 2100 MHz) \r\nGSM/EDGE (850, 900, 1800, 1900 MHz) \r\nLTE (Bands 1, 2, 3, 4, 5, 7, 8, 13, 17, 18, 19, 20, 25, 26, 28, 29) \r\n | \r\n|
| \r\n A1586/A1524 \r\n | \r\n\r\n CDMA EV-DO Rev. A and Rev. B (800, 1700/2100, 1900, 2100 MHz) \r\nUMTS/HSPA+/DC-HSDPA (850, 900, 1700/2100, 1900, 2100 MHz) \r\nTD-SCDMA 1900 (F), 2000 (A) \r\nGSM/EDGE (850, 900, 1800, 1900 MHz) \r\nFDD-LTE (Bands 1, 2, 3, 4, 5, 7, 8, 13, 17, 18, 19, 20, 25, 26, 28, 29) \r\nTD-LTE (Bands 38, 39, 40, 41) \r\n | \r\n|
| \r\n iPad mini 2 \r\n | \r\n\r\n A1490 \r\n | \r\n\r\n UMTS/HSPA/HSPA+/DC-HSDPA (850, 900, 1700/2100, 1900, 2100 MHz); \r\nGSM/EDGE (850, 900, 1800, 1900 MHz) \r\nCDMA EV-DO Rev. A and Rev. B (800, 1900 MHz) \r\nLTE (Bands 1, 2, 3, 4, 5, 7, 8, 13, 17, 18, 19, 20, 25, 26) \r\n | \r\n
| \r\n A1491 \r\n | \r\n\r\n UMTS (WCDMA)/HSPA+/ DC-HSDPA (850, 900, 1900, 2100 MHz), \r\nGSM/EDGE (850, 900, 1800, 1900 MHz), \r\nTD-SCDMA (1900 (F), 2000 (A)) \r\nLTE (Bands 1, 2, 3, 5, 7, 8, 18, 19, 20) \r\nTD-LTE (Bands 38, 39) \r\n | \r\n|
| \r\n iPad mini 3 \r\n | \r\n\r\n A1600 \r\n | \r\n\r\n UMTS/?HSPA/?HSPA+/?DC-HSDPA (850, 900, 1700/2100, 1900, 2100 MHz); \r\nGSM/EDGE (850, 900, 1800, 1900 MHz) \r\nCDMA EV-DO Rev. A and Rev. B (800, 1900 MHz) \r\nLTE (Bands 1, 2, 3, 4, 5, 7, 8, 13, 17, 18, 19, 20, 25, 26) \r\n | \r\n
| \r\n A1601 \r\n | \r\n\r\n UMTS/?HSPA/?HSPA+/?DC-HSDPA (850, 900, 1700/2100, 1900, 2100 MHz); \r\nGSM/EDGE (850, 900, 1800, 1900 MHz) \r\nCDMA EV-DO Rev. A (800, 1900 MHz) \r\nTD-SCDMA (1900 (F), 2000 (A)) \r\nLTE (Bands 1, 2, 3, 4, 5, 7, 8, 18, 19, 20) \r\nTD-LTE (Bands 38, 39, 40) \r\n | \r\n|
| \r\n iPad mini 4 \r\n | \r\n\r\n A 1550 \r\n | \r\n\r\n UMTS/HSPA/HSPA+/DC-HSDPA (850, 900, 1700/2100, 1900, 2100 MHz); \r\nGSM/EDGE (850, 900, 1800, 1900 MHz) \r\nCDMA EV-DO Rev. A and Rev. B (800, 1900 MHz) \r\nLTE (Bands 1, 2, 3, 4, 5, 7, 8, 13, 17, 18, 19, 20, 25, 26, 28, 29, 38, 39, 40, 41) \r\n | \r\n
| \r\n iPad Air \r\n | \r\n\r\n A1475 \r\n | \r\n\r\n UMTS/HSPA/HSPA+/DC-HSDPA (850, 900, 1700/2100, 1900, 2100 MHz); \r\nGSM/EDGE (850, 900, 1800, 1900 MHz) \r\nCDMA EV-DO Rev. A and Rev. B (800, 1900 MHz) \r\nLTE (Bands 1, 2, 3, 4, 5, 7, 8, 13, 17, 18, 19, 20, 25, 26) \r\n | \r\n
| \r\n A1476 \r\n | \r\n\r\n UMTS (WCDMA)/HSPA+/ DC-HSDPA (850, 900, 1900, 2100 MHz), \r\nGSM/EDGE (850, 900, 1800, 1900 MHz), TD-SCDMA (1900 (F), 2000 (A)) \r\nLTE (Bands 1, 2, 3, 4, 5, 7, 8, 13, 17, 18, 19, 20, 25, 26) \r\nTD-LTE (Bands 38, 39) \r\n | \r\n|
| \r\n iPad Air 2 \r\n | \r\n\r\n A1567 \r\n | \r\n\r\n GSM/EDGE (850, 900, 1800, 1900 MHz), \r\nUMTS/HSPA/HSPA+/DC-HSDPA (850, 900, 1700/2100, 1900, 2100 MHz), \r\nCDMA EV-DO Rev. A and Rev. B (800, 1900 MHz), \r\nTD-SCDMA \r\nLTE (Bands 1, 2, 3, 4, 5, 7, 8, 13, 17,18, 19, 20, 25, 26, 28, 29) \r\nTD-LTE (Bands 38, 39, 40,41) \r\n | \r\n
Table 2: Cellular Protocols Supported
","security_evaluation_summary":"\r\n\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process. The criteria against which Apple iOS 9.3.2 with MDM Agent was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1.4. The evaluation methodology used by the evaluation team to conduct the evaluation was the Common Methodology for Information Technology Security Evaluation, Version 3.1.4. The product, when delivered and configured as identified in the iOS 9.3.2 PP MD v2.0 and PP MDM Agent V2.0 Common Criteria Guide document, meets the requirements of the Protection Profile for Mobile Device Fundamentals Version 2.0 and the Extended Package for Mobile Device Management Agents Version 2.0.
The iOS 9.3.2 PP MD v2.0 and PP MDM Agent V2.0 Common Criteria Guide document satisfies all of the security functional requirements stated in the Apple iOS 9.3.2 PP_MD_V2.0 & PP_MDM_AGENT_V2.0 Security Target [ST]. The project underwent CCEVS Validator review. The evaluation was completed in May, 2016. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report number CCEVS-VR-VID10725-2016, prepared by the CCEVS.
Cryptographic Support
\r\nThe TOE provides cryptographic services for the encryption of data-at rest, for secure communication channels, to protect configuration profiles, and for use by applications.
The TOE provides cryptographic services via two cryptographic modules:
· The Apple iOS CoreCrypto Kernel Module v6
· The Apple iOS CoreCrypto Module v6
The iOS CoreCrypto Kernel Module is an iOS kernel extension optimized for library use within the iOS kernel. Once the module is loaded into the iOS kernel its cryptographic functions are made available to iOS Kernel services only.
Identification and Authentication
\r\nUser identification and authentication is provided by a user defined passphrase where the minimum length of the passphrase, passphrase rules, as well as the maximum number of consecutive failed authentication attempts can be configured by an administrator.
Except for making emergency calls, users need to authenticate using a passphrase. This passphrase can be configured for a minimum length, for dedicated passphrase policies and for a maximum life time. When entered, passphrases are obscured and the frequency of entering passphrases is limited as well as the number of consecutive failed attempts of entering the passphrase. The TOE also enters a locked state after a (configurable) time of user inactivity and the user is required to enter his passphrase to unlock the TOE.
External entities connecting to the TOE via a secure protocol (Extensible Authentication Protocol Transport Layer Security (EAP-TLS), TLS, IPsec) can be authenticated using X.509 certificates.
\r\nUser Data Protection
\r\nUser data protection is provided by encrypting the user data, by restricting access by applications and by restricting access until the user has been successfully authenticated.
User data in files is protected using cryptographic functions, ensuring this data remains protected even if the device gets lost or is stolen. Critical data like passphrases used by applications or application defined cryptographic keys can be stored in the key chain, which provides additional protection. Passphrase protection and encryption ensure that data-at-rest remains protected even in the case the device is lost or stolen.
By default, data is protected such that only the application that owns the data can access it.
Security Management
\r\nSecurity functions can be managed either by the user or by an authorized administrator through a Mobile Device Management (MDM) system. Management functions can be performed by the user, by the authorized administrator, or both.
TOE Security Functionality (TSF) Protection
Some of the functions the TOE implements to protect the TSF and TSF data are:
· Protection of cryptographic keys,
· Use of memory protection and processor states to separate applications and protect the TSF from unauthorized access to TSF resources,
· Digital signature protection of the TSF image,
· Software/firmware integrity self-test upon start-up,
· Digital signature verification for applications, and
· Access to defined TSF data and TSF services only when the TOE is unlocked.
TOE Access
\r\nThe TSF provides functions to lock the TOE upon request and after an administrator-configurable time of inactivity.
Access to the TOE via a wireless network is controlled by user/administrator defined policy.
Trusted Path/Channels
\r\nThe TOE supports the use of the following cryptographic protocols that define a trusted channel between itself and another trusted IT product: IEEE 802.11-2012; IEEE 802.1X; EAP-TLS; TLS; and IPsec (addressed in a separate evaluation).
\r\nAudit
\r\nThe TOE provides the ability for responses to be sent from the MDM Device Agent to the MDM Server. These responses are configurable by the organization using a scripting language given in the Over-the-Air Profile Delivery and Configuration document.
","features":[]}