The TOE is the Ciena 6500 Packet Optical Platform running software version 15.6 and is developed by Ciena Corporation. The Ciena 6500 Packet Optical Platform, the Target of Evaluation (TOE), is a family of standalone hardware devices that run VxWorks and provide OSI Layers 1 and 2 network traffic management services. The security functions provided by the TOE include security auditing, cryptographic support, identification and authentication, security management, protection of TSF, TOE access controls, and trusted communications. The appliance provides the TL1 interface to the TOE’s security management functionality. The TOE enables users to direct traffic to designated ports, giving them control of network availability for specific services. The system features an agnostic switch fabric that is capable of switching SONET/SDH, OTN, and Ethernet/MPLS networks. The switching behavior is beyond the scope of the claimed Protection Profile.
\r\nRepresentative TOE Deployment
\r\nThe Physical boundary of the TOE is the Ciena 6500 Packet Optical Platform hardware appliance and the software which runs on it. The TOE runs VxWorks 6.9 for the SP3 and SPAP3 shelf processors. The TOE is managed using the Transaction Language 1 (TL1) interface, used for local or remote administration.
\r\nThe TOE has two physical connections for security management: a local console (RJ-45 Craft ethernet port) for direct connections and a Central Office Local Area Network (COLAN) ethernet port for remote connections. An administrator can access the TL1 interface using either a local workstation connected directly to the TOE’s Craft ethernet port or a remote workstation that can connect to the TOE over the COLAN ethernet via SSH. The TL1 interface is the command line interface for the TOE. The audit server communicates to the TOE via TLS; the update server communicate with the TOE using SFTP via SSH over the COLAN ethernet port. In practice, the TOE will be deployed to perform network switching functions and will be connected to a number of other pieces of network traffic infrastructure equipment. This has not been depicted in detail because this capability is out of scope of the TOE from a security functional perspective.
\r\nThe Ciena 6500 has five shelf variants which range in size from 2RU (Rack Units) to 22RU (Rack Units). Each variant has the same software image loaded onto it and therefore each has the same security functionality across the family.
\r\nThe five variants are:
\r\nThe TOE may consist of any of the following models:
\r\n| \r\n MODEL TYPE \r\n | \r\n\r\n MODEL PART # \r\n | \r\n\r\n SP3 Shelf Processor Card \r\n | \r\n\r\n SPAP3 Shelf Processor Card \r\n | \r\n
| \r\n 2-slot Type 2 \r\n | \r\n\r\n NTK503LA \r\n | \r\n\r\n NO \r\n | \r\n\r\n YES \r\n | \r\n
| \r\n 4-slot Type \r\n | \r\n\r\n NTK503HA \r\n | \r\n\r\n YES \r\n | \r\n\r\n NO \r\n | \r\n
| \r\n 7-slot \r\n | \r\n\r\n NTK503PA \r\n | \r\n\r\n YES \r\n | \r\n\r\n NO \r\n | \r\n
| \r\n 7-slot type 2 \r\n | \r\n\r\n NTK503KA \r\n | \r\n\r\n NO \r\n | \r\n\r\n YES \r\n | \r\n
| \r\n 6500-7 \r\n | \r\n\r\n NTK503RA \r\n | \r\n\r\n YES \r\n | \r\n\r\n NO \r\n | \r\n
| \r\n 14-slot \r\n | \r\n\r\n NTK503BA \r\nNTK503CA \r\nNTK503CC \r\nNTK503GA \r\nNTK503AD \r\nNTK503BD \r\nNTK503CD \r\nNTK503SA \r\n | \r\n\r\n YES \r\n | \r\n\r\n NO \r\n | \r\n
| \r\n 32-slot \r\n | \r\n\r\n NTK603AA \r\nNTK603AB \r\n | \r\n\r\n YES \r\n | \r\n\r\n NO \r\n | \r\n
\r\n
Models using the SP3 service card are running on QorIQ T1042 Quad Core processor, with VxWorks 6.9; models using SPAP3 Service Cards are runniong on QorIQ T1022 Dual Core processors with VxWorks 6.9.
\r\nThe TOE software version is 15.6.
","security_evaluation_summary":"The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Ciena 6500 Packet Optical Platform was evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. The product, when delivered configured as identified in the Ciena 6500 Packet Optical Platform Supplemental Administrative Guidance for Common Criteria Version 1.8 December 2024, satisfies all of the security functional requirements stated in the Ciena 6500 Packet Optical Platform Security Target v1.0. The project underwent CCEVS Validator review. The evaluation was completed in January 2025. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"Security Audit
\r\nThe TOE provides extensive auditing capabilities. The TOE creates audit records for events related to security relevant events including authentication (success and failure, remote and local), cryptographic key management, session establishment (success and failure) and session termination, including for SSH communications. In addition, all actions corresponding to management functions are audited. The TOE records, for each audited event, the date and time of the event, the type of event, the subject’s claimed identity, and the outcome (success or failure) of that event. Depending on the specific type of event, additional data may be included in the audit record. Audit data is stored locally transmitted in real-time to the remote audit server via TLS-protected trusted channel. The local audit data keeps the most recent records by overwriting the oldest records when the maximum size threshold of the file is met. No filesystem access is allowed to ensure protection of local audit data from deletion or modification.
\r\nCryptographic Support
\r\nThe TOE provides cryptography in support of SSH for remote administration, and secure download of TOE updates. The TOE provides a TLS protected channel for remote storage of audit data. The TOE uses CAVP-validated cryptographic algorithms to ensure that appropriately strong cryptographic algorithms are used for these trusted communications. Cryptographic keys are overwritten by zeroes by the TOE when they are no longer needed for their purpose.
\r\nThe TOE collects entropy from a local hardware entropy source contained within the device to ensure sufficient randomness for secure key generation.
\r\nIdentification and Authentication
\r\nAll users must be identified and authenticated by the TOE before being allowed to perform any actions on the TOE, except viewing a banner. The TOE provides complexity rules that ensure that user-defined passwords will meet a minimum-security strength through the set of supported characters and configurable minimum password length. As part of connecting to the TOE locally, using the management workstation, password data is obfuscated as it is inputted. The TOE detects when a configurable number of failed authentication attempts are made by a remote user. Once this configurable threshold of between 2 and 20 attempts has been met the TSF will automatically lock a user’s account. The user’s account can be unlocked after a configurable time period of between 0 and 300 seconds or can be unlocked by a Security Administrator with sufficient User Privilege Code (UPC) level.
\r\nSecurity Management
\r\nThe TSF provides the TL1 interface for performing management functions remotely or locally. Also, the Security Administrator can use the Site Manager to pass commands to the TL1 interface. The functions that a Security Administrator can perform on the TL1 interface are determined by the Security Administrator’s UPC value. The Security Administrator is the only administrative role that has the ability to manage the TSF, so it is the only role that is within the scope of the TOE. Apart from the Security Administrator, other roles that perform network management related functionality are not considered part of the TSF.
\r\nProtection of the TSF
\r\nThe TOE is expected to ensure the security and integrity of all data that is stored locally and accessed remotely. The TSF prevents the unauthorized disclosure of secret cryptographic data, and administrative passwords are hashed using SHA-256. The TOE maintains system time with its local hardware clock, and can synchronize with up to 3 NTPv4 time sources. TOE software updates are acquired using SFTP and initiated using the TL1 interface. Software updates are digitally signed to ensure their integrity. The TSF also validates its correctness through the use of self-tests for both cryptographic functionality and integrity of the system software.
\r\nTOE Access
\r\nThe TOE can terminate inactive sessions after a Security Administrator-configurable time period. The TOE also allows users to terminate their own interactive session. Once a session has been terminated, the TOE requires the user to re-authenticate to establish a new session. The TOE can also display a configurable banner on the TL1 interface that is displayed prior to use of any other security-relevant functionality.
\r\nTrusted Path/Channels
\r\nThe Security Administrator establishes a trusted path to the TOE for remote administration using SSH. The TOE initiates a TLS-protected trusted channel to the remote audit data server. The TOE establishes a trusted channel (SSH) for downloading software updates from the update server using SSH
\r\nTOE Environment
\r\nThe following environmental components are required to operate the TOE in the evaluated configuration:
\r\nRequired Environmental Components
\r\n| \r\n Component \r\n | \r\n\r\n Function \r\n | \r\n
| \r\n Management Workstation \r\n | \r\n\r\n Any general-purpose computer that is used by an administrator to manage the TOE. The TOE can be managed remotely, in which case the management workstation requires an SSH client, or locally, in which case the management workstation must be physically connected to the TOE using the serial port and must use a terminal emulator that is compatible with serial communications. Alternatively, the workstation can physically be connected to the TOE using the craft port, which is an Ethernet port through which the TOE can be managed locally using a SSH Client \r\n | \r\n
| \r\n Audit Server \r\n | \r\n\r\n A properly configured audit data storage server implementing the Syslog over TLS protocol. \r\n | \r\n
| \r\n Update Server \r\n | \r\n\r\n A server that supports SSH/SFTP and that is used as a location for storing product updates that can be transferred to the TOE. \r\n | \r\n
| \r\n Site Manager Software (Optional) \r\n | \r\n\r\n The Site Manager software provides a graphical interface to the TL1 interface for managing the TOE. The Site Manager software is installed on the Management workstation and uses an SSH channel to connect to the TOE. \r\n | \r\n
\r\n
The following product functionality is not included in the CC evaluation:
\r\nHTTP server, FTP service, Telnet and SNMP services – these must be disabled in the evaluated configuration. The TOE also includes a number of strictly unevaluated features and functions, which are outside the scope of the evaluation.
","features":[{"id":722,"feature_name":"Asymmetric Key Generation"},{"id":717,"feature_name":"Auditing"},{"id":735,"feature_name":"Certificate Authentication"},{"id":728,"feature_name":"Certificate Validation"},{"id":726,"feature_name":"Cryptographic Hashing"},{"id":723,"feature_name":"Cryptographic Key Establishment"},{"id":725,"feature_name":"Cryptographic Signature Verification"},{"id":720,"feature_name":"DRBG"},{"id":718,"feature_name":"Key Destruction"},{"id":727,"feature_name":"Keyed-hash message authentication"},{"id":731,"feature_name":"SSH Client"},{"id":733,"feature_name":"SSH Server"},{"id":730,"feature_name":"TLS 1.2"},{"id":729,"feature_name":"TLS Client"}]}