{"product_id":11183,"v_id":11183,"product_name":"Nokia 7x50 SR OS 20.10.R4 for 7750 SR-1, 7750 SR-1s, 7750 SR- 2s, 7750 SR-7s, 7750 SR-14s, 7950 XRS-20, 7950 XRS-16c, 7450 ESS, and 7750 SR-1e","certification_status":"Certified","certification_date":"2021-10-21T00:00:00Z","tech_type":"Network Device","vendor_id":{"name":"Nokia Corporation","website":"https://www.nokia.com"},"vendor_poc":"Hooman Bidgoli","vendor_phone":"8665823688","vendor_email":"hooman.bidgoli@nokia.com","assigned_lab":{"cctl_name":"Acumen Security"},"product_description":"

The TOE portfolio delivers high-performance, scaling and flexibility to support a full array of IP and MPLS services and functions for service provider, web scale and enterprise networks. The 7750 SR family includes a wide range of physical platforms that share a mutual architecture and feature set. This allows Nokia customers to select the platform that best addresses their unique business goals and fulfills their scale, density, space, power, and value-added service requirements without compromising on quality or features. The 7750 series are chassis-based routers. The TOE supports a full array of network functions and services, achieving scale and efficiency without compromising versatility. It provides highly available service delivery mechanisms that maximize network stability and minimize service interruptions. Every Nokia 7750 series routing appliance is a whole routing system that provides a variety of high-speed interfaces (only Ethernet is within scope of this evaluation) for various scale of networks and various network applications. The TOE utilizes a common Nokia SR OS firmware, features, and technology for compatibility across all platforms.

\r\n

Nokia SR OS firmware is mainly responsible for all the functionalities and services provided by the routers. The routers can be accessed either via a local console or via a network connection that is protected using the SSH protocol. Each time a user accesses the routers, either via local console terminal connection or from the network remotely using SSH, the user must successfully authenticate with the correct credentials.

","evaluation_configuration":"

The TOE is comprised of the following models:

\r\n

Table 2 –TOE Physical Boundary Components

\r\n
\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
\r\n

Platform Description

\r\n		\r\n

Processors

\r\n
\r\n

7950 XRS-16c

\r\n

\"\"
# of Cores: 10 Core
Frequency: 1.5Ghz
OS: Nokia SR OS
Image Version: 20.10.R4
Part number: 3HE08121AA

\r\n		\r\n

Cavium OCTEON II CN6645

\r\n
\r\n

7450 ESS 

\r\n

\"\"
# of Cores: 10 Core
Frequency: 1.5Ghz
OS: Nokia SR OS
Image Version: 20.10.R4
Part number: 3HE08432AA

\r\n		\r\n

Cavium OCTEON II CN6645

\r\n
\r\n

7750 SR-1

\r\n

\"\"
# of Cores: 16 Core
Frequency: 1.8Ghz
OS: Nokia SR OS
Image Version: 20.10.R4

\r\n

Part Number: 3HE12298AA

\r\n		\r\n

Cavium OCTEON III CN7360

\r\n
\r\n

7750 SR-1s

\r\n

\"\"

\r\n

# of Cores: 16 Core
Frequency: 1.8Ghz
OS: Nokia SR OS
Image Version: 20.10.R4
Part number: 3HE13809xx

\r\n		\r\n

Cavium OCTEON III CN7360

\r\n
\r\n

7750 SR-2s

\r\n

\"\"

\r\n

# of Cores: 16 Core
Frequency: 1.8Ghz
OS: Nokia SR OS
Image Version: 20.10.R4
Part number: 3HE12379AA

\r\n		\r\n

Cavium OCTEON III CN7360

\r\n
\r\n

7750 SR-1e

\r\n

\"\"

\r\n

# of Cores: 10 Core
Frequency: 1.3 Ghz
OS: Nokia SR OS
Image Version: 20.10.R4
Part number: 3HE10301AA

\r\n		\r\n

Cavium OCTEON II CN6645

\r\n
\r\n

7750 SR -7s

\r\n

\"\"

\r\n

# of Cores: 10 Core
Frequency: 1.5 Ghz
OS: Nokia SR OS
Image Version: 20.10.R4
Part number: 3HE10301AA

\r\n		\r\n

Cavium OCTEON II CN6645

\r\n
\r\n

7750 SR -14s

\r\n

\"\"

\r\n

# of Cores: 10 Core
Frequency: 1.5 Ghz
OS: Nokia SR OS
Image Version: 20.10.R4
Part number: 3HE10301AA

\r\n		\r\n

Cavium OCTEON II CN6645

\r\n
\r\n

7950 XRS-20

\r\n

\"\"

\r\n

# of Cores: CPM: 20 cores, CPM2: 48 cores
Frequency: CPM:1.5GHz, CPM2: 1.8GHz
OS: Nokia SR OS
Part number: 3HE07113AA

\r\n

 

\r\n		\r\n

Cavium OCTEON II CN6645

\r\n
\r\n
\r\n

Figure 1 depicts the TOE boundary:

\r\n

\"\"

\r\n

Figure 1 – TOE Boundary Diagram

\r\n

TOE Evaluated Configuration

\r\n

In the evaluated configuration, the TOE consists of one of the platforms identified above. The TOE supports secure connectivity with another IT environment device as stated in Table 3:

\r\n

Table 3 – IT Environment Components

\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
\r\n

Components

\r\n		\r\n

Required (Y/N)

\r\n		\r\n

Usage

\r\n
\r\n

Audit server

\r\n		\r\n

Yes

\r\n		\r\n

The audit server supports HTTP PUT requests over TLS v1.2 to receive audit files securely from the TOE.

\r\n
\r\n

LDAP server

\r\n		\r\n

Yes

\r\n		\r\n

This server will provide the authentication mechanism to authenticate users.

\r\n
\r\n

Management workstation with Web Browser/SSH client

\r\n		\r\n

Yes

\r\n		\r\n

This includes any IT

\r\n

Environment Management workstation with a Web Browser and an SSH client.

\r\n
\r\n

Certificate Authority server

\r\n		\r\n

Yes

\r\n		\r\n

The Certificate Authority server is used for creation and management of X509 certificates to be used with the TOE.

\r\n
\r\n

Physical Scope of the TOE

\r\n

The TOE boundary is the hardware appliance, which is comprised of hardware and software components. It is deployed in an environment that contains the various IT components as depicted in Figure 1 above. The TOE guidance documentation is included on this website.

","security_evaluation_summary":"

The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the NOKIA 7X50 SR OS 20.10.R4 FOR 7750 SR-1, 7750 SR-1S, 7750 SR- 2S, 7750 SR-7S, 7750 SR-14S, 7950 XRS-20, 7950 XRS-16C, 7450 ESS, AND 7750 SR-1E were evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5.  The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5.  Acumen Security determined that the evaluation assurance level (EAL) for the product is EAL 1.  The product, when delivered configured as identified in the Nokia 7x50 SR OS 20.10.R1 Guidance Document, satisfies all of the security functional requirements stated in the NOKIA 7X50 SR OS 20.10.R4 FOR 7750 SR-1, 7750 SR-1S, 7750 SR- 2S, 7750 SR-7S, 7750 SR-14S, 7950 XRS-20, 7950 XRS-16C, 7450 ESS, AND 7750 SR-1E Security Target.

\r\n

The project underwent CCEVS Validator review.  The evaluation was completed in October 2021.  Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.

","environmental_strengths":"

The TOE implements the following security functional requirements:

\r\n

•                Security Audit

\r\n

•                Cryptographic Support

\r\n

•                Identification and Authentication

\r\n

•                Security Management

\r\n

•                Protection of the TSF

\r\n

•                TOE Access

\r\n

•                Trusted Path/Channels

\r\n

 

\r\n

Each of these security functionalities are listed in more detail in the sections below.

\r\n

Security Audit

\r\n

The TOE generates audit events for all start-up and shut-down functions and all auditable events as specified in Table 15 of the Security Target. Audit events are also generated for management actions specified in FAU_GEN.1. The TOE is capable of storing audit events locally and exporting them to an external audit server using HTTP PUT requests over TLS v1.2 protocol. Each audit record contains the date and time of event, type of event, subject identity, and the relevant data of the event. The audit server supports the following severity levels: indeterminate (info), major, and minor.

\r\n

Cryptographic Support

\r\n

The TOE provides cryptographic support for the services described in Table 3 below.The related CAVP validation details are provided in Table 4. The operating system is SR OS 20.10.R4. The TOE leverages OpenSSL v1.1.1g for its cryptographic functionality.

\r\n

Table 3 – TOE Cryptography Implementation

\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
\r\n

Cryptographic Method

\r\n		\r\n

Usage

\r\n
\r\n

FCS_CKM.1 Cryptographic Key Generation

\r\n		\r\n

Cryptographic key generation conforming to FIPS PUB 186-4 Digital Signature Standard (DSS), Appendix B.3 and FFC Schemes using ‘safe-prime’ groups that meet the following: “NIST Special Publication 800-56A Revision 3, Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography” and RFC 3526.

\r\n

 

\r\n

RSA Key sizes supported are 2048 bits

\r\n
\r\n

FCS_CKM.2 Cryptographic Key Establishment

\r\n		\r\n

RSA-based key establishment schemes that meet the following: RSAES-PKCS1-v1_5 as specified in Section 7.2 of RFC 3447, “Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1” and FFC Schemes using “safe-prime” groups that meet the following: ‘NIST Special Publication 800-56A Revision 3, “Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography” and [groups listed in RFC 3526].

\r\n
\r\n

FCS_CKM.4 Cryptographic Key Destruction

\r\n		\r\n

Refer to Table 17 of the Security Target for Key Zeroization details.

\r\n
\r\n

FCS_COP.1/DataEncryption

\r\n		\r\n

AES encryption and decryption conforming to CBC as specified in ISO 10116, CTR as specified in ISO 10116 and GCM as specified in ISO 19772.

\r\n

AES key size supported is 128 bits and 256 bits

\r\n

AES modes supported are: CBC, CTR and GCM.

\r\n
\r\n

FCS_COP.1/SigGen

\r\n		\r\n

RSA digital signature algorithm conforming to FIPS PUB 186-4, “Digital Signature Standard (DSS)”, Section 5.5, using PKCS #1 v2.1 Signature Schemes RSASSA-PSS and/or RSASSA-PKCS1v1_5; ISO/IEC 9796-2, Digital signature scheme 2 or Digital Signature scheme 3.

\r\n

RSA key size of 2048 bits.

\r\n
\r\n

FCS_COP.1/Hash

\r\n		\r\n

Cryptographic hashing services conforming to ISO/IEC 10118-3:2004.

\r\n

Hashing algorithms supported are SHA-1, SHA-256, SHA-384, and SHA-512.

\r\n

Message digest sizes supported are: 160, 256, 384 and 512 bits.

\r\n
\r\n

FCS_COP.1/KeyedHash

\r\n		\r\n

Keyed-hash message authentication conforming to ISO/IEC 9797-2:2011, Section 7 “MAC Algorithm 2.

\r\n

Keyed-hash algorithm supported are HMAC-SHA1, HMAC-SHA-256, HMAC-SHA-384 and HMAC-SHA-512.

\r\n

Key sizes supported are: 160, 256, 384, and 512 bits.

\r\n

Message digest sizes supported are: 160, 256, 384 and 512 bits.

\r\n
\r\n

FCS_RBG_EXT.1 Random Bit Generation

\r\n		\r\n

Random number generation conforming to ISO/IEC 18031:2011.The TOE leverages CTR_DRBG(AES) CTR_DRBG seeded with a minimum of 256 bits of entropy.

\r\n
\r\n

FCS_HTTPS_EXT.1 HTTPS Protocol

\r\n		\r\n

The TOE supports HTTPS protocol that complies with RFC 2818.

\r\n

The TOE implements HTTPS protocol using TLS v1.2 in support of the audit server.

\r\n
\r\n

FCS_TLSC_EXT.1 TLS Client Protocol

\r\n		\r\n

The TOE supports TLS v1.2 protocol for use with X. 509v3 based authentication.

\r\n

The following ciphersuites in the evaluated configuration:

\r\n

TLS_RSA_WITH_AES_128_CBC_SHA as defined in RFC 3268

\r\n

TLS_RSA_WITH_AES_256_CBC_SHA as defined in RFC 3268

\r\n

TLS_RSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5246

\r\n

TLS_RSA_WITH_AES_256_CBC_ SHA256 as defined in RFC 5246

\r\n
\r\n

FCS_SSHS_EXT.1 SSH Client Protocol

\r\n		\r\n

The TOE supports SSH v2 protocol complaint to the following RFCs: 4251, 4252, 4253, 4254, 4344, 5647, 8268, 6668.

\r\n

The TOE supports public key and password-based authentication.

\r\n

SSH public-key authentication uses ssh-rsa.

\r\n

SSH transport uses the following encryption algorithms: aes128-ctr, aes128-cbc, aes256-cbc and aes256-ctr.

\r\n

Packets greater than 256K bytes in an SSH transport connection are dropped.

\r\n

SSH transport uses the following data integrity MAC algorithms: hmac-sha1, hmac-sha256, and hmac-sha2-512.

\r\n

Key exchange algorithms supported are diffie-hellman-group14-sha256, diffie-hellman-group14- sha1 and diffie-hellman-group16-sha512.

\r\n

The TOE ensures that within SSH connections the same session keys are used for a threshold of no longer than one hour and no more than one gigabyte of transmitted data.

\r\n
\r\n

 

\r\n

Table 4 – CAVP Algorithm Testing References

\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
\r\n

Cryptographic Algorithms

\r\n		\r\n

CAVPS

\r\n		\r\n

Implementation Library

\r\n		\r\n

Operational Environment (OE)

\r\n
\r\n

AES

\r\n		\r\n

C2074

\r\n		\r\n

Nokia 7x50 SR OS Cryptographic Library

\r\n		\r\n

Cavium OCTEON III CN7360

\r\n
\r\n

C2075

\r\n		\r\n

Nokia 7x50 SR OS Cryptographic Library

\r\n		\r\n

Cavium OCTEON II CN6645

\r\n

 

\r\n
\r\n

RSA

\r\n		\r\n

C2074

\r\n		\r\n

Nokia 7x50 SR OS Cryptographic Library

\r\n		\r\n

Cavium OCTEON III CN7360

\r\n
\r\n

C2075

\r\n		\r\n

Nokia 7x50 SR OS Cryptographic Library

\r\n		\r\n

Cavium OCTEON II CN6645

\r\n
\r\n

HMAC

\r\n		\r\n

C2074

\r\n		\r\n

Nokia 7x50 SR OS Cryptographic Library

\r\n		\r\n

Cavium OCTEON III CN7360

\r\n
\r\n

C2075

\r\n		\r\n

Nokia 7x50 SR OS Cryptographic Library

\r\n		\r\n

Cavium OCTEON II CN6645

\r\n
\r\n

SHS

\r\n		\r\n

C2074

\r\n		\r\n

Nokia 7x50 SR OS Cryptographic Library

\r\n		\r\n

Cavium OCTEON III CN7360

\r\n
\r\n

C2075

\r\n		\r\n

Nokia 7x50 SR OS Cryptographic Library

\r\n		\r\n

Cavium OCTEON II CN6645

\r\n
\r\n

DRBG

\r\n		\r\n

C2074

\r\n		\r\n

Nokia 7x50 SR OS Cryptographic Library

\r\n		\r\n

Cavium OCTEON III CN7360

\r\n
\r\n

C2075

\r\n		\r\n

Nokia 7x50 SR OS Cryptographic Library

\r\n		\r\n

Cavium OCTEON II CN6645

\r\n
\r\n

Identification and Authentication

\r\n

All users must be authenticated to the TOE prior to carrying out any management actions. The TOE supports password-based authentication and public key-based authentication. Based on the assigned role, a user is granted a set of privileges to access the system.

\r\n

Security Management

\r\n

The TOE supports local and remote management of its security functions including:

\r\n\r\n

TOE Access

\r\n

Prior to establishing an administration session with the TOE, a banner is displayed to the user. The banner messaging is customizable. The TOE will terminate an interactive session after configurable number of minutes of session inactivity. A user can terminate their local CLI session and remote CLI session by entering the appropriate command at the prompt.

\r\n

Protection of the TSF

\r\n

The TOE protects all passwords, pre-shared keys, symmetric keys, and private keys from unauthorized disclosure. Pre-shared keys, symmetric keys, and private keys are stored in encrypted format. Passwords are stored as a non-reversible hash value as per standard Linux approach. The TOE executes self-tests during initial start-up to ensure correct operation and enforcement of its security functions. An administrator can install software updates to the TOE. The TOE internally maintains the date and time.

\r\n

Trusted Path/Channels

\r\n

The TOE supports HTTPS PUT requests over TLS v1.2 for secure communication to the audit server. The TOE supports TLS v1.2 for secure communication to LDAP server. The TOE supports local CLI and uses SSH v2 for secure remote administration.

","features":[]}