The Nokia 7705 SAR Series with SAR OS 21.10R5, the Target of Evaluation (TOE), is a network device that is composed of hardware and software and offers a scalable solution to the end users. It satisfies all of the criterion to meet the collaborative Protection Profile for Network Devices, Version 2.2e [NDcPP v2.2e]. The TOE is a physical, non-distributed network device implementing networking functions essential for service adaptation, aggregation and routing over Ethernet and Internet Protocol routing infrastructure. The primary scenario of deployment is for mobile backhaul, fixed to mobile convergence, mission-critical applications, and enterprise applications.
\r\n\r\n
The TOE supports secure connectivity with another IT environment device as stated in Table 1.
\r\n\r\n
Table 1 – Required Environmental Components
\r\n| \r\n Components \r\n | \r\n\r\n Required (Y/N) \r\n | \r\n\r\n Usage \r\n | \r\n
| \r\n Local Management Station \r\n | \r\n\r\n Yes \r\n | \r\n\r\n A management station connected to the TOE from the console used for administering the TOE locally. \r\n | \r\n
| \r\n Remote Management Station \r\n | \r\n\r\n Yes \r\n | \r\n\r\n A management station connected to the TOE over a network connection, used for administering the TOE remotely over SSH. \r\n | \r\n
| \r\n SSH Client \r\n | \r\n\r\n Yes \r\n | \r\n\r\n The Remote Management Station must run an SSH client which the remote administrator may use for establishing a secure connection between the Remote Management Station and the TOE. \r\n | \r\n
| \r\n CA/CRL Server \r\n | \r\n\r\n Yes \r\n | \r\n\r\n A server with a certification authority and certificate revocation list used by the TOE for validating the X.509 certificates used for IKE and IPsec connection establishment. \r\n | \r\n
| \r\n AAA Server \r\n | \r\n\r\n Yes \r\n | \r\n\r\n A server implementing RADIUS and TACACS+ which the TOE may be configured to use for external authentication of users. \r\n | \r\n
| \r\n Syslog Server \r\n | \r\n\r\n Yes \r\n | \r\n\r\n A Server to which the TOE may be configured to forward audit log files. \r\n | \r\n
| \r\n Update Server \r\n | \r\n\r\n Yes \r\n | \r\n\r\n A Server hosting the TOE Software Upgrades. The Administrator may connect to the server and download upgrades for the TOE Software. \r\n | \r\n
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Nokia 7705 SAR Series with SAR OS 21.10R5 was evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. The product, when delivered configured as identified in multiple admin guides listed below, satisfies all of the security functional requirements stated in the Nokia 7705 SAR Series with SAR OS 21.10R5 Security Target.
\r\n\r\n
| \r\n Admin Guide Title \r\n | \r\n\r\n Version \r\n | \r\n\r\n Date \r\n | \r\n
| \r\n NOKIA 7705 SERVICE AGGREGATION ROUTER | RELEASE 21.10R5 Common Criteria Admin Guide \r\n | \r\n\r\n 1.0 \r\n | \r\n\r\n May 15, 2023 \r\n | \r\n
| \r\n NOKIA 7705 SERVICE AGGREGATION ROUTER | RELEASE 21.10R1 Basic System Configuration Guide \r\n | \r\n\r\n 01 \r\n | \r\n\r\n October 2021 \r\n | \r\n
| \r\n NOKIA 7705 SERVICE AGGREGATION ROUTER | RELEASE 21.10R1 Interface Configuration Guide \r\n | \r\n\r\n 01 \r\n | \r\n\r\n October 2021 \r\n | \r\n
| \r\n NOKIA 7705 SERVICE AGGREGATION ROUTER | RELEASE 21.10R1 Log Events Guide \r\n | \r\n\r\n 01 \r\n | \r\n\r\n October 2021 \r\n | \r\n
| \r\n NOKIA 7705 SERVICE AGGREGATION ROUTER | RELEASE 21.10R1 Router Configuration Guide \r\n | \r\n\r\n 01 \r\n | \r\n\r\n October 2021 \r\n | \r\n
| \r\n NOKIA 7705 SERVICE AGGREGATION ROUTER | RELEASE 21.10R1 Services Guide \r\n | \r\n\r\n 01 \r\n | \r\n\r\n October 2021 \r\n | \r\n
| \r\n NOKIA 7705 SERVICE AGGREGATION ROUTER | RELEASE 21.10R1 System Management Guide \r\n | \r\n\r\n 01 \r\n | \r\n\r\n October 2021 \r\n | \r\n
_________________________________________________________________________________________________
\r\nThe project underwent CCEVS Validator review. The evaluation was completed in September 2023. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"The TOE implements the following security functional requirements:
\r\n· Security Audit
\r\n· Cryptographic Support
\r\n· Identification and Authentication
\r\n· Security Management
\r\n· TOE Access
\r\n· Protection of the TSF
\r\n· Trusted Path/Channels
\r\nEach of these security functionalities are listed in more detail in the sections below.
\r\nThe TOE generates audit events for all start-up and shut-down functions and all auditable events as specified in Table 15. Audit events are also generated for management actions specified in FAU_GEN.1. The TOE is capable of storing audit events locally and exporting them to an external audit server over IPsec protocol. Each audit record contains the date and time of event, type of event, subject identity, and the relevant data of the event. The audit server supports the following severity levels: indeterminate (info), major, and minor.
\r\nThe TOE provides cryptography in support of SSH and IPSEC trusted communications. The following table identifies the cryptographic services per cryptographic library.
\r\n\r\n
| \r\n SFR \r\n | \r\n\r\n Algorithm in ST \r\n | \r\n\r\n Implementation name \r\n | \r\n\r\n CAVP Alg. \r\n | \r\n\r\n CAVP Cert # \r\n | \r\n
| \r\n FCS_CKM.1 \r\n | \r\n\r\n RSA schemes using cryptographic key sizes of 2048-bit or greater that meet the following: FIPS PUB 186-4, “Digital Signature Standard (DSS)”, Appendix B.3 \r\n | \r\n\r\n Nokia 7705 SAR OS Cryptographic library \r\n | \r\n\r\n RSA KeyGen (FIPS186-4) \r\n | \r\n\r\n C2023 \r\n\r\n | \r\n
| \r\n Nokia 7705 SAR OS Cryptographic library \r\n | \r\n\r\n C2024 \r\n | \r\n|||
| \r\n FFC Schemes using ‘safe-prime’ groups that meet the following: “NIST Special Publication 800-56A Revision 3, Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography” and [RFC 3526] \r\n | \r\n\r\n Nokia 7705 SAR OS Cryptographic library \r\n | \r\n\r\n Safe Primes Key Generation \r\nSafe Primes Key Verification \r\n | \r\n\r\n A3133 \r\n | \r\n|
| \r\n Nokia 7705 SAR OS Cryptographic library \r\n | \r\n\r\n Safe Primes Key Generation \r\nSafe Primes Key Verification \r\n | \r\n\r\n A3134 \r\n | \r\n||
| \r\n FCS_CKM.2 \r\n | \r\n\r\n RSA-based key establishment schemes that meet the following: RSAES-PKCS1-v1_5 as specified in Section 7.2 of RFC 3447, “Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1” \r\n | \r\n\r\n Nokia 7705 SAR OS Cryptographic library \r\n | \r\n\r\n None \r\n | \r\n\r\n CCTL tested as per the PP/SD Evaluation Activities \r\n | \r\n
| \r\n FFC Schemes using “safe-prime” groups that meet the following: ‘NIST Special Publication 800- 56A Revision 3, “Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography” and [RFC 3526] \r\n | \r\n\r\n Nokia 7705 SAR OS Cryptographic library \r\n | \r\n\r\n KAS-FFC-SSC Sp800-56Ar3 \r\n | \r\n\r\n A3133 \r\n | \r\n|
| \r\n Nokia 7705 SAR OS Cryptographic library \r\n | \r\n\r\n KAS-FFC-SSC Sp800-56Ar3 \r\n | \r\n\r\n A3134 \r\n | \r\n||
| \r\n FCS_COP.1/ DataEncryption \r\n | \r\n\r\n AES used in [CBC, CTR] mode and cryptographic key sizes [128 bits, 192 bits, 256 bits] \r\n | \r\n\r\n Nokia 7705 SAR OS Cryptographic library \r\n | \r\n\r\n AES-CBC \r\nAES-CTR \r\n | \r\n\r\n C2023 \r\n | \r\n
| \r\n Nokia 7705 SAR OS Cryptographic library \r\n | \r\n\r\n C2024 \r\n | \r\n|||
| \r\n FCS_COP.1/ SigGen \r\n | \r\n\r\n For RSA schemes: FIPS PUB 186-4, “Digital Signature Standard (DSS)”, Section 5.5, using PKCS #1 v2.1 Signature Schemes RSASSA-PSS and/or RSASSA-PKCS1v1_5; ISO/IEC 9796-2, Digital signature scheme 2 or Digital Signature scheme 3 \r\n | \r\n\r\n Nokia 7705 SAR OS Cryptographic library \r\n | \r\n\r\n RSA SigGen (FIPS186-4) \r\nRSA SigVer (FIPS186-4) \r\n | \r\n\r\n C2023 \r\n | \r\n
| \r\n Nokia 7705 SAR OS Cryptographic library \r\n | \r\n\r\n C2024 \r\n | \r\n|||
| \r\n FCS_COP.1/ Hash \r\n | \r\n\r\n [SHA-1, SHA-256, SHA-384, SHA-512] and message digest sizes [160, 256, 384, 512] bits \r\n | \r\n\r\n Nokia 7705 SAR OS Cryptographic library \r\n | \r\n\r\n SHS \r\n | \r\n\r\n C2023 \r\n | \r\n
| \r\n Nokia 7705 SAR OS Cryptographic library \r\n | \r\n\r\n C2024 \r\n | \r\n|||
| \r\n FCS_COP.1/ KeyedHash \r\n | \r\n\r\n [HMAC-SHA-1, HMAC-SHA- 256, HMAC-SHA-384, HMAC-SHA-512] and cryptographic key sizes [160-bits, 256-bits, 384-bits, 512-bits] and message digest sizes [160, 256, 384, 512] bits \r\n | \r\n\r\n Nokia 7705 SAR OS Cryptographic library \r\n | \r\n\r\n HMAC-SHA-1 \r\nHMAC-SHA-256 \r\nHMAC-SHA-384 \r\nHMAC-SHA-512 \r\n | \r\n\r\n C2023 \r\n | \r\n
| \r\n Nokia 7705 SAR OS Cryptographic library \r\n | \r\n\r\n C2024 \r\n | \r\n|||
| \r\n FCS_RBG_EXT.1 \r\n | \r\n\r\n CTR_DRBG (AES) \r\n | \r\n\r\n Nokia 7705 SAR OS Cryptographic library \r\n | \r\n\r\n Counter DRBG \r\n | \r\n\r\n C2023 \r\n | \r\n
| \r\n Nokia 7705 SAR OS Cryptographic library \r\n | \r\n\r\n C2024 \r\n | \r\n
The TOE supports Role Based Access Control. All users must be authenticated to the TOE prior to carrying out any management actions. The TOE supports password-based authentication and public key-based authentication. Based on the assigned role, a user is granted a set of privileges to access the system.
\r\nThe TOE supports local and remote management of its security functions including:
\r\nPrior to establishing an administration session with the TOE, a banner is displayed to the user. The banner messaging is customizable. The TOE will terminate an interactive session after configurable number of minutes of session inactivity. A user can terminate their local CLI session and remote CLI session by entering the appropriate command at the prompt.
\r\nThe TOE protects all passwords, pre-shared keys, symmetric keys, and private keys from unauthorized disclosure. Pre-shared keys, symmetric keys, and private keys are stored in encrypted format. Passwords are stored as a non-reversible hash value as per standard Linux approach. The TOE executes self-tests during initial start-up to ensure correct operation and enforcement of its security functions. An administrator can install software updates to the TOE. The TOE internally maintains the date and time.
\r\nThe TOE supports IPsec for secure communication to the audit server and with the authentication server. The termination points of the IPsec are the TOE and another IPsec implementation. The TOE supports local CLI and uses SSH v2 for secure remote administration.
","features":[]}