The Architecture Technology Corporation Machete Router is a ruggedized, compact, secure and high-performance router that also provides VPN gateway functionality. The functions of Machete are implemented in a software suite called ATCorp Routing and Encryption Suite (ARES).
","evaluation_configuration":"The evaluated configuration consists of the following hardware running ARES v2.0:
\r\n| \r\n Model Identification \r\n | \r\n\r\n Platform \r\n | \r\n\r\n CPU Architecture \r\n | \r\n\r\n CPU Part Number \r\n | \r\n
| \r\n MACHETE-FIT2 \r\n | \r\n\r\n Fitlet2 \r\n | \r\n\r\n Intel Apollo Lake \r\n | \r\n\r\n Atom x7-E3950 \r\n | \r\n
| \r\n MACHETE-OTN4 \r\n | \r\n\r\n OnTime 4000 Series \r\n | \r\n\r\n Intel Apollo Lake \r\n | \r\n\r\n Atom x7-E3950 \r\n | \r\n
| \r\n MACHETE-OTN6 \r\n | \r\n\r\n OnTime 6000 Series \r\n | \r\n\r\n Intel Apollo Lake \r\n | \r\n\r\n Atom x7-E3950 \r\n | \r\n
| \r\n MACHETE-OTN7 \r\n | \r\n\r\n OnTime 7000 Series \r\n | \r\n\r\n Intel Apollo Lake \r\n | \r\n\r\n Atom x7-E3950 \r\n | \r\n
| \r\n MACHETE-DCS2 \r\n | \r\n\r\n DCS003289 \r\n | \r\n\r\n Intel Apollo Lake \r\n | \r\n\r\n Atom x7-E3950 \r\n | \r\n
| \r\n MACHETE-V1 \r\n | \r\n\r\n VMware ESXi v7.0 \r\n | \r\n\r\n AMD Embedded Ryzen 4000 \r\n | \r\n\r\n Ryzen 4600G \r\n | \r\n
| \r\n MACHETE-AMD-R1 \r\n | \r\n\r\n OL-ML100 Series \r\n | \r\n\r\n AMD Ryzen V1000 \r\n | \r\n\r\n V1605B \r\n | \r\n
| \r\n MACHETE-WL1 \r\n | \r\n\r\n BKNUC8V5PNB \r\n | \r\n\r\n Intel Whiskey Lake \r\n | \r\n\r\n Core i5-8365U \r\n | \r\n
| \r\n MACHETE-FIT3 \r\n | \r\n\r\n Fitlet3 \r\n | \r\n\r\n Intel Elkhart Lake \r\n | \r\n\r\n Atom x6425E \r\n | \r\n
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target. The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5, April 2017. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 5, April 2017. The product, when delivered and configured as identified in the Machete Router Common Criteria Operational Guidance, Version 1.6, December 14, 2023, satisfies all of the security functional requirements stated in the Architecture Technology Corporation Machete Router Security Target, Version 0.6, November 29, 2023. The project underwent CCEVS Validator review. The evaluation was completed in January 2024. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID11414-2023) prepared by CCEVS.
","environmental_strengths":"The logical boundaries of the Architecture Technology Corporation Machete Router are realized in the security functions that it implements. Each of these security functions is summarized below.
\r\n\r\n
Security audit:
\r\nThe TOE is capable of auditing all required events and information. Each audit record includes the identity of the user that caused the event (if applicable), date and time of the event, type of event, and the outcome of the event.
\r\nThe TOE protects storage of audit information from modification or deletion. The TOE can transmit audit records to a remote syslog server using either SSH or IPsec.
\r\nCryptographic support:
\r\nThe TOE contains CAVP-tested cryptographic support that provides key management, random bit generation, encryption/decryption, digital signature and secure hashing and key-hashing features in support of higher-level cryptographic protocols including IPsec and SSH.
\r\nIdentification and authentication:
\r\nThe TOE supports passwords consisting of alphanumeric and special characters. The TSF also allows administrators to set a minimum password length of 6 to 100 characters.
\r\nThe TOE requires all administrative users to authenticate before allowing the user to perform any actions other than:
\r\n· Viewing the warning banner.
\r\nAfter an administrator-specified number of failed attempts, the user account is locked out. The TOE also protects, stores and allows authorized administrators to load X.509.v3 certificates for use to support authentication for IPsec connections.
\r\nSecurity management:
\r\nThe TOE provides a custom CLI that allows users with the Security Administrator role to administer the TOE locally and remotely. This interface allows the Security Administrator to initiate manual updates, manage cryptographic keys, manage the TOE configuration, and configure audit data transmission.
\r\nPacket filtering:
\r\nThe TOE provides extensive packet filtering capabilities for IPv4, IPv6, TCP, and UDP. The authorized administrator can define packet filtering rules that apply to most every field within the identified packet types. The authorized administrator can define each rule to permit, deny, and log each decision.
\r\nProtection of the TSF:
\r\nThe TOE prevents the reading of secret keys, private keys, and passwords.
\r\nThe TOE maintains a local real-time clock to provide accurate timestamps. This clock can be periodically updated by synchronizing with an NTP server and/or manually set by a Security Administrator.
\r\nThe TOE performs a suite of power-up self-tests that verify the correct operation of the entropy source, RAM, and cryptographic algorithms as well as the integrity of the firmware.
\r\nThe TOE verifies the authenticity and integrity of all firmware updates using ECDSA signature verification. The TOE shuts down if any of these tests fail.
\r\nTOE access:
\r\nBefore establishing an administrative session, the TOE displays an administrator configurable warning banner. The TOE locks inactive local administrative sessions and terminates inactive remote administrative sessions.
\r\nThe TOE allows the administrator to configure restrictions on the establishment of client IPsec tunnels based on the client IP address, time of day, date, day of week, or day of month. The TOE assigns a private IP address (internal to the trusted network for which the TOE is the headend) to a VPN client upon successful establishment of a session.
\r\nTrusted path/channels:
\r\nThe TOE supports either SSH or IPsec to provide a trusted communication channel between itself and all authorized IT entities that is logically distinct from other communication channels and provides assured identification of its end points and protection of the channel data from disclosure and detection of modification of the channel data. The TOE uses SSH or IPsec to provide the trusted path with remote administrative users as well.
","features":[]}