The Target of Evaluation (TOE) is the Samsung Electronics Co., Ltd. Samsung Galaxy VPN Client on Android 6.
The TOE is a VPN client that runs on a mobile operating system based on Android 6.0.1 with modifications made to increase the level of security provided to end users and enterprises. The TOE is intended to be used as part of an enterprise messaging solution providing mobile staff with enterprise connectivity.
The TOE platform includes a Common Criteria mode (or “CC mode”) that an administrator can invoke through the use of an MDM or through the installation and use of the administrative application, CCMode.apk (see the Guidance for instructions to obtain the application). The TOE must be configured as follows in order for an administrator to transition the TOE to CC mode.
· Require a screen lock password (swipe, PIN, pattern, or facial recognition screen locks are not allowed).
· The maximum password failure retry policy should be less than or equal to ten.
· Device encryption must be enabled.
· SDCard encryption must be enabled (if the device supports SD cards).
· Revocation checking must be enabled.
When CC mode has been enabled, the TOE behaves as follows.
· The TOE restricts the available VPN configurations to those evaluated as part of this evaluation.
· The TOE restricts the use of IKEv1 and IKEv2 IPsec cipher suites to only those conformant with the requirements of the IVPNCPP14.
· The TOE verifies the VPN Gateway’s Subject Alternative Name (either IP or DNS) matches the expected.
The evaluated configuration consists of the following devices:
\r\n| \r\n Device Name \r\n | \r\n\r\n Base Model | \r\n\r\n Android | \r\n\r\n Kernel Version \r\n | \r\n\r\n Build Number \r\n | \r\n\r\n Carrier Models \r\n | \r\n
| \r\n Galaxy S7 (Qualcomm) \r\n | \r\n\r\n SM-G930 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.18.20 \r\n | \r\n\r\n MMB29M \r\n | \r\n\r\n T, P, R4, V, A \r\n | \r\n
| \r\n Galaxy S7 (System LSI) \r\n | \r\n\r\n SM-G930 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.18.14 \r\n | \r\n\r\n MMB29K \r\n | \r\n\r\n F, S, K, L \r\n | \r\n
| \r\n Galaxy S7 Edge (Qualcomm) \r\n | \r\n\r\n GM-G935 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.18.20 \r\n | \r\n\r\n MMB29M \r\n | \r\n\r\n A, T, P, R4, V \r\n | \r\n
| \r\n Galaxy S7 Edge (System LSI) \r\n | \r\n\r\n GM-G935 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.18.14 \r\n | \r\n\r\n MMB29K \r\n | \r\n\r\n F, S, K, L \r\n | \r\n
| \r\n Galaxy S7 Active \r\n | \r\n\r\n SM-G891 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.18.20 \r\n | \r\n\r\n MMB29M \r\n | \r\n\r\n A, None \r\n | \r\n
| \r\n Galaxy S6 Edge+ \r\n | \r\n\r\n SM-G928 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.10.61 \r\n | \r\n\r\n MMB29K \r\n | \r\n\r\n F, I, A, T, P, R4, V, S, K, L \r\n | \r\n
| \r\n Galaxy Note 5 \r\n | \r\n\r\n SM-N920 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.10.61 \r\n | \r\n\r\n MMB29K \r\n | \r\n\r\n I, A, T, P, R4, V, S, K, L \r\n | \r\n
| \r\n Galaxy S6 \r\n | \r\n\r\n SM-G920 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.10.61 \r\n | \r\n\r\n MMB29K \r\n | \r\n\r\n F, I, A, T, P, R4, V, S, K, L \r\n | \r\n
| \r\n Galaxy S6 Edge \r\n | \r\n\r\n SM-G925 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.10.61 \r\n | \r\n\r\n MMB29K \r\n | \r\n\r\n F, I, A, T, P, R4, V, S, K, L \r\n | \r\n
| \r\n Galaxy S6 Active \r\n | \r\n\r\n SM-G890 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.10.61 \r\n | \r\n\r\n MMB29K \r\n | \r\n\r\n A, None \r\n | \r\n
| \r\n Galaxy Tab S2 8” Wi-Fi \r\n | \r\n\r\n SM-T710 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.10.9 \r\n | \r\n\r\n MMB29K \r\n | \r\n\r\n None \r\n | \r\n
| \r\n Galaxy Tab S2 8” LTE (EU Open) \r\n | \r\n\r\n SM-T715 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.10.9 \r\n | \r\n\r\n MMB29K \r\n | \r\n\r\n None \r\n | \r\n
| \r\n Galaxy Tab S2 10” Wi-Fi \r\n | \r\n\r\n SM-T810 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.10.9 \r\n | \r\n\r\n MMB29K \r\n | \r\n\r\n None \r\n | \r\n
| \r\n Galaxy Tab S2 10” LTE (EU/AU Open) \r\n | \r\n\r\n SM-T815 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.10.9 \r\n | \r\n\r\n MMB29K \r\n | \r\n\r\n None \r\n | \r\n
| \r\n Galaxy Tab S2 10” LTE (US Models) \r\n | \r\n\r\n SM-T817 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.10.9 \r\n | \r\n\r\n MMB29K \r\n | \r\n\r\n A, T, V \r\n | \r\n
| \r\n Galaxy Note 4 (Qualcomm) \r\n | \r\n\r\n SM-N910 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.10.40 \r\n | \r\n\r\n MMB29M \r\n | \r\n\r\n F, A, T, P, R4, V \r\n | \r\n
| \r\n Galaxy Note 4 (System LSI) \r\n | \r\n\r\n SM-N910 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.10.9 \r\n | \r\n\r\n MMB29K \r\n | \r\n\r\n C, S, K, L \r\n | \r\n
| \r\n Galaxy Note Edge (Qualcomm) \r\n | \r\n\r\n SM-N915 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.10.40 \r\n | \r\n\r\n MMB29M \r\n | \r\n\r\n F, A, T, P, R4, V \r\n | \r\n
| \r\n Galaxy Note Edge (System LSI) \r\n | \r\n\r\n SM-N915 \r\n | \r\n\r\n 6.0.1 \r\n | \r\n\r\n 3.10.9 \r\n | \r\n\r\n MMB29K \r\n | \r\n\r\n S, K, L \r\n | \r\n
The following table shows the Security software versions for all the devices.
\r\n| \r\n Device Name \r\n | \r\n\r\n MDF Version \r\n | \r\n\r\n MDF Release \r\n | \r\n\r\n VPN v1.4 Release \r\n | \r\n\r\n KNOX Release \r\n | \r\n
| \r\n Galaxy Note 4 \r\n | \r\n\r\n 2.0 \r\n | \r\n\r\n 6 \r\n | \r\n\r\n 6.0 \r\n | \r\n\r\n 2.6 \r\n | \r\n
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Samsung Galaxy Devices VPN Client was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 4. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 4. The product, when delivered and configured as identified in the Samsung VPN Client on Galaxy Devices Guidance documentation, Version 2.3, April 19, 2016 document, satisfies all of the security functional requirements stated in the Samsung Electronics Co., Ltd. Samsung Galaxy VPN Client on Android 6 (IVPNCPP14) Security Target, Version 0.2, April 21, 2016. The project underwent CCEVS Validator review. The evaluation was completed in June 2016. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID10727-2016) prepared by CCEVS.
","environmental_strengths":"\r\n\r\nThe logical boundaries of the Samsung Galaxy VPN Client on Android 6 TOE are realized in the security functions that it implements. Each of these security functions is summarized below.
\r\nCryptographic Support - The IPsec implementation is the primary function of the TOE. IPSec is used by the TOE to protect communication between itself and a VPN Gateway over an unprotected network. With the exception of the IPsec implementation, the TOE relies upon its underlying platform (evaluated against the Protection Profile For Mobile Device Fundamentals) for the cryptographic services.
\r\nUser Data Protection - The TOE ensures that residual information is protected from potential reuse in accessible objects such as network packets.
\r\nIdentification and Authentication - The TOE provides the ability to use, store, and protect X.509 certificates and pre-shared keys that are used for IPsec Virtual Private Network (VPN) connections.
\r\nSecurity Management - The TOE provides all the interfaces necessary to manage the security functions identified throughout the Samsung Galaxy VPN Client on Android 6 (IVPNCPP14) Security Target. In particular, the IPsec VPN is fully configurable by a combination of functions provided directly by The TOE and those available to the associated VPN gateway.
\r\nTSF Protection - The TOE relies upon its underlying platform to perform self-tests that cover the TOE as well as the functions necessary to securely update the TOE.
\r\nTrusted Path/Channels - The TOE acts as a VPN client using IPsec to established secure channels to corresponding VPN gateways.
","features":[]}