The Target of Evaluation (TOE) is VMware NSX-T Data Center 3.1, a VMware network device software product that provides and manages virtual networking components. The TOE is designed as a network virtualization platform, providing the ability to implement and virtualize networks across multiple ESXi nodes and virtual machines (VMs).
\r\nFor the purpose of testing of the identified TOE, the evaluated TOE configuration is as followings: VMware NSX-T Data Center 3.1 on hypervisor VMware ESXi 6.7 running Ubuntu 18.04 on Dell Power Edge R740 with Intel Xeon Gold 6230R (Cascade Lake).
\r\nThe TOE provides functionality to enforce and support auditing, cryptographic operations, network separation, encrypted channels, identification/authentication, security management, and protection of the TSF. Administrators can configure virtual network.
\r\nIn VMware’s network virtualization solution, the following components are the essential building blocks that make up the virtualized computing environment:
\r\n· NSX-T Unified Appliance is a virtual appliance configured to run NSX-T application roles (Manager, Policy, and Controller).
\r\n· The NSX-T Edge is a virtual appliance that provides routing services and connectivity to networks that are external to the NSX-T deployment.
\r\nThe components described above make a basic virtualized environment ready for virtualized networking. The NSX-T Unified Appliance provides a single API entry point to the system, persists user configuration, handles user queries, and performs operational tasks. The TOE is configured for a single instance of ESXi 6.7 Hypervisor which includes a single NSX-T Unified Appliance instance, single instance of the NSX-T Edge appliance, and does not contain non-TOE functionality.
\r\nCustomers with a higher scale environment may use vCenter Server, but that is optional and is not included within the TOE.
","evaluation_configuration":"","security_evaluation_summary":"\r\n
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the VMware NSX-T Data Center 3.1 was evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. The product, when delivered configured as identified in the VMware NSX-T Data Center 3.1 Common Criteria Guidance Addendum, satisfies all of the security functional requirements stated in the VMware NSX-T Data Center 3.1 Common Criteria Security Target. The project underwent CCEVS Validator review. The evaluation was completed in July 2022. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
\r\n","environmental_strengths":"
Logical Boundary Rationale for Security Audit (FAU)
\r\n| \r\n Security Function \r\n | \r\n\r\n Description \r\n | \r\n
| \r\n Security Audit (FAU) \r\n | \r\n\r\n The TOE generates audit records for all security-relevant events. For each audited events, the TOE records the date and time, the type of event, the subject identity, and the outcome of the event. The resulting records are stored on Unified Appliance and can be sent securely to a designated log server for archiving. Security Administrators, using the appropriate REST API commands, can also view audit records locally. The TOE provides a reliable timestamp relying on the appliance’s to built-in clock. \r\n | \r\n
Logical Boundary Rationale for Cryptographic Support (FCS)
\r\n| \r\n Security Function \r\n | \r\n\r\n Description \r\n | \r\n
| \r\n Cryptographic Support (FCS) \r\n | \r\n\r\n The TOE provides cryptography support for secure communications and protection of information. The cryptographic services provided by the TOE are listed in Table 3 - TOE Provided Cryptography below. The TOE implements the secure protocols - TLS/HTTPS on the server side and TLS on the client side. The TOE implements deletion procedures to mitigate the possibility of disclosure or modification of CSPs. \r\nThe TOE uses two types of dedicated cryptographic modules to manage CSPs: VMware BC-FJA (Bouncy Castle FIPS Java API) module for Java based implementations of TLS/HTTPS, key stores, and trust stores; and VMware’s OpenSSL FIPS Object module for TLS/HTTPS, key stores, and trust stores. The algorithm certificate references are listed in the tables below (Table 4 – VMware’s OpenSSL FIPS Object Module Algorithm and Table 5 – VMware BC-FJA (Bouncy Castle FIPS Java API) Module Algorithm) described in the ST. \r\n | \r\n
\r\n
The following table lists all cryptography provided within TOE:
\r\n| \r\n Cryptographic Method \r\n | \r\n\r\n Usage within the TOE \r\n | \r\n
| \r\n TLS Establishment \r\n | \r\n\r\n Used to establish initial TLS session \r\n | \r\n
| \r\n ECDH Key Agreement \r\n | \r\n\r\n Used in TLS session establishment \r\n | \r\n
| \r\n RSA Key Generation \r\n | \r\n\r\n Used to create key-pairs and X.509 certificates for use in TLS protocols \r\n | \r\n
| \r\n RSA Signature Services \r\n | \r\n\r\n Used in TLS session establishment. \r\nUsed in secure software update \r\n | \r\n
| \r\n SP 800-90 DRBG \r\n | \r\n\r\n Used in TLS session establishment \r\n | \r\n
| \r\n SHS \r\n | \r\n\r\n Used in secure software update \r\n | \r\n
| \r\n HMAC-SHS \r\n | \r\n\r\n Used to provide TLS traffic integrity verification \r\n | \r\n
| \r\n AES \r\n | \r\n\r\n Used to encrypt TLS traffic \r\n | \r\n
Table 3 – TOE Provided Cryptography
\r\n\r\n
Algorithms under VMware’s OpenSSL FIPS Object Module cryptography module are listed in the table:
\r\n| \r\n Algorithm \r\n | \r\n\r\n Description \r\n | \r\n\r\n Mode Supported \r\n | \r\n\r\n CAVP Cert. # \r\n | \r\n\r\n Standards \r\n | \r\n
| \r\n AES \r\n | \r\n\r\n Used for symmetric encryption/decryption \r\n | \r\n\r\n GCM (128 and 256 bits) | \r\n\r\n A1292 \r\n | \r\n\r\n SP 800-38D \r\nSP 800-38A \r\n | \r\n
| \r\n SHS (SHA) | \r\n\r\n Cryptographic hashing services \r\n | \r\n\r\n Byte Oriented | \r\n\r\n A1292 \r\n | \r\n\r\n FIPS 180-4 \r\n | \r\n
| \r\n HMAC | \r\n\r\n Keyed hashing services and software integrity test \r\n | \r\n\r\n Byte Oriented | \r\n\r\n A1292 \r\n | \r\n\r\n FIPS 198 \r\n | \r\n
| \r\n DRBG \r\n | \r\n\r\n Deterministic random bit generation services in accordance with ISO/IEC 18031:2011 \r\n | \r\n\r\n Hash_DRBG (512) | \r\n\r\n A1292 \r\n | \r\n\r\n SP 800-90A \r\n | \r\n
| \r\n RSA \r\n | \r\n\r\n Signature Generation and Verification \r\n | \r\n\r\n FIPS PUB 186-4 Key Generation | \r\n\r\n A1292 \r\n | \r\n\r\n FIPS 186-4 \r\n | \r\n
| \r\n CVL – KAS-ECC \r\n | \r\n\r\n Key Agreement \r\n | \r\n\r\n NIST Special PUB 800-56A \r\n | \r\n\r\n A1292 \r\n\r\n | \r\n\r\n SP 800-56Ar3 \r\n | \r\n
Table 4 – VMware’s OpenSSL FIPS Object Module Algorithm
\r\n\r\n
| \r\n Algorithm \r\n | \r\n\r\n Description \r\n | \r\n\r\n Mode Supported \r\n | \r\n\r\n CAVP Cert. # \r\n | \r\n\r\n Standards \r\n | \r\n
| \r\n AES \r\n | \r\n\r\n Used for symmetric encryption/decryption \r\n | \r\n\r\n GCM (128 and 256 bits) | \r\n\r\n C2174 \r\n | \r\n\r\n SP 800-38D \r\nSP 800-38A \r\n | \r\n
| \r\n SHS (SHA) | \r\n\r\n Cryptographic hashing services \r\n | \r\n\r\n Byte Oriented | \r\n\r\n C2174 \r\n | \r\n\r\n FIPS 180-4 \r\n | \r\n
| \r\n HMAC | \r\n\r\n Keyed hashing services and software integrity test \r\n | \r\n\r\n Byte Oriented | \r\n\r\n C2174 \r\n | \r\n\r\n FIPS 198 \r\n | \r\n
| \r\n DRBG \r\n | \r\n\r\n Deterministic random bit generation services in accordance with ISO/IEC 18031:2011 \r\n | \r\n\r\n Hash_DRBG (512) | \r\n\r\n C2174 \r\n | \r\n\r\n SP 800-90A \r\n | \r\n
| \r\n RSA \r\n | \r\n\r\n Signature Generation and Verification \r\n | \r\n\r\n FIPS PUB 186-4 Key Generation (2048-bit, 3072 bit key) \r\n | \r\n\r\n C2174 \r\n | \r\n\r\n FIPS 186-4 \r\n | \r\n
| \r\n CVL – KAS-ECC \r\n | \r\n\r\n Key Agreement \r\n | \r\n\r\n NIST Special Publication 800-56A \r\n | \r\n\r\n C2174 \r\n | \r\n\r\n SP 800-56Ar3 \r\n | \r\n
Table 5 – VMware BC-FJA (Bouncy Castle FIPS Java API) Module Algorithm
\r\n\r\n
Logical Boundary Rationale for Identification and Authentication (FIA)
\r\n| \r\n Security Function \r\n | \r\n\r\n Description \r\n | \r\n
| \r\n Identification and Authentication (FIA) \r\n | \r\n\r\n Security Administrators are identified and authenticated prior to being allowed access to any of the services other than the display of the warning banner. The REST API requires user name and password for authentication. The identification and authentication credentials are confirmed against a local user database. The TOE uses X.509v3 certificates as defined by RFC 5280 to support authentication for TLS/HTTPS connections. \r\nThe TOE provides the capability to set password minimum length rules to ensure the use of strong passwords in attempts to protect against brute force attacks. The TOE also accepts passwords composed of a variety of characters to support complex password composition. During authentication, no indication is given of the characters composing the password. \r\n | \r\n
\r\n
Logical Boundary Rationale for Security Management (FMT)
\r\n| \r\n Security Function \r\n | \r\n\r\n Description \r\n | \r\n
| \r\n Security Management (FMT) \r\n | \r\n\r\n The TOE provides secure administrative services for management of general TOE configuration and TOE security functionality. There are two types of administrative users within the system: Security Administrator and Auditor (read only). All of the management functions are restricted to Security Administrators. The TOE administration occurs through REST API. The TOE provides the ability to perform the following actions: \r\n· Administer the TOE locally and remotely \r\n· Configure the access banner \r\n· Configure the cryptographic services \r\n· Update the TOE and verify the updates using digital signature capability prior to installing those updates \r\n· Specify the time limits of session inactivity \r\n\r\n | \r\n
\r\n
Logical Boundary Rationale for Protection of the TSF (FPT)
\r\n| \r\n Security Function \r\n | \r\n\r\n Description \r\n | \r\n
| \r\n Protection of the TSF (FPT) \r\n | \r\n\r\n The TOE implements a number of measures to protect the integrity of its security features: \r\n· The TOE protects CSPs, including stored passwords and cryptographic keys, so they are not directly viewable or accessible in plaintext. \r\n· The TOE ensures that reliable time information is available for log accountability. The time can be configured through the REST API. \r\nThe TOE performs self-tests to detect internal failures and protect itself from malicious updates. \r\n | \r\n
\r\n
Logical Boundary Rationale for TOE Access (FTA)
\r\n| \r\n Security Function \r\n | \r\n\r\n Description \r\n | \r\n
| \r\n TOE Access (FTA) \r\n | \r\n\r\n The TOE will display a customizable banner when an administrator initiates a session. The TOE also enforces an administrator-defined inactivity timeout after which any inactive session is automatically terminated. Once a session has been terminated, the TOE requires the user to re-authenticate. \r\n | \r\n
\r\n
Logical Boundary Rationale for Trusted Path/Channels (FTP)
\r\n| \r\n Security Function \r\n | \r\n\r\n Description \r\n | \r\n
| \r\n Trusted Path/Channels (FTP) \r\n | \r\n\r\n The TOE establishes a trusted path between the Unified Appliance and the administrative REST API using TLS/HTTPS. The TOE establishes a secure connection using TLS for: \r\n· Sending syslog data to a log server. \r\n | \r\n