The TOE implements the general functionality of a router/switch consistent with the collaborative Protection Profile for Network Devices v2.2E with MACsec module v1.0. The TOE implements controlled connectivity between two subnetworks and a management interface. All network traffic between the connected subnetworks is controlled by the TOE and the authorized administrators may manage the TOE using the management interface.
\r\nThe management interface is a Command Line Interface (CLI) which may be accessed locally or remotely. Local access is via a console port which is a Serial EIA-561 (RJ-45) or a USB-C port. It allows management of the TOE from a workstation physically connected to the TOE. Remote management is over Secure Shell (SSH). SSH implements a secure remote login over a network connection and allows protected CLI and Network Configuration Protocol (NETCONF) access to the TOE.
\r\nAll administrators are identified and authenticated using a username and password or based on SSH public key authentication. Access is only granted, and the user assigned to the role administrator upon successful authentication. Authentication is implemented locally. Authentication of TLS peers is done using X.509 Public Key Certificates. The validity of the X.509 public key certificates is verified using the Online Certificate Status Protocol (OCSP). TLS and Hypertext Transfer Protocol Security (HTTPS) may also be used for forwarding audit records to an external audit server. MACsec is used for protected communication among MACsec peers.
","evaluation_configuration":"The TOE is composed of the following components:
\r\nThe TOE is deployed in an environment that includes the IT components illustrated in the following figure. The TOE itself is delivered as an appliance or an FRU with the software installed. The administrator of the TOE may verify the TOE software and, if necessary, download and install the correct version.
\r\nThe physical boundary of the TOE is illustrated below. Non-TOE components are summarized in Table 1 IT Environment Components. The TOE implements a TLS Client and SSH Server for secure connectivity to the components of the environment. Each component of the environment is required to implement the corresponding client and/or server. The remote management workstation is required to implement a SSH Client for accessing the TOE.
\r\n
The environmental components described in the following table are required to operate the TOE in the evaluated configuration.
\r\n| \r\n Component \r\n | \r\n\r\n Description \r\n | \r\n
| \r\n MACsec Peer \r\n | \r\n\r\n A peer server that supports MACsec to communicate with the TOE. \r\n | \r\n
| \r\n Audit (syslog) server (Mandatory) \r\n | \r\n\r\n The audit server supports syslog messages over TLS v1.2 to receive the audit files from the TOE. The audit data is stored in the remote audit server for redundancy purposes. \r\n | \r\n
| \r\n OCSP Server (Mandatory) \r\n | \r\n\r\n Validity of the certificates the TOE uses for asserting the authenticity of the TLS peers is verified using OCSP. \r\n | \r\n
| \r\n Admin Workstation (Mandatory) \r\n | \r\n\r\n A workstation used by an administrator to manage the TOE locally or remotely. The remote management station must include a SSH client. \r\n | \r\n
Table 1 IT Environment Components
","security_evaluation_summary":"The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target. The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5, April 2017. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 5, April 2017. The product, when delivered and configured as identified in the Ciena SAOS R10.9.1 on the 3926 with Large NFV Compute Server Service Aggregation Platform CC Guidance Supplement, Version 1.1, February 17, 2025 document, satisfies all of the security functional requirements stated in the Ciena SAOS R10.9.1 on the 3926 with Large NFV Compute Server Service Aggregation Platform Security Target, Version 1.1, February 17, 2025. The project underwent CCEVS Validator review. The evaluation was completed in February 2025. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID11467-2025) prepared by CCEVS.
","environmental_strengths":"The logical boundaries of the Ciena SAOS R10.9.1 on the 3926 with Large NFV Compute Server Service Aggregation Platform are realized in the security functions that it implements. Each of these security functions is summarized below.
\r\n\r\n
Security audit:
\r\nThe TOE is able to generate logs for a wide range of security relevant events. The TOE can be configured to store the logs locally so they can be accessed by an administrator and also to send the logs to a designated log server using TLS to protect the logs while in transit on the network. Each audit record contains the date and time of event, type of event, subject identity, and any other event-related relevant data.
\r\nCryptographic support:
\r\nThe TOE contains a CAVP-tested cryptographic module that provides key management, random bit generation, encryption/decryption, digital signature and secure hashing and key-hashing features in support of higher-level cryptographic protocols including MACsec, SSH and TLS. The TOE supports SHA1 message digest authentication for NTP servers.
\r\nIdentification and authentication:
\r\nThe TOE authenticates all users connecting to the management interfaces of the TOE. Authentication may take place over the console for local access or over SSH for remote access. Only upon successful authentication, given that the user is authorized for the role, is a user assigned to the role administrator and granted access to the management functions of the TOE. Local users authenticate to the TOE using a username and password. Remote users may also use SSH public-key authentication. A customizable warning banner is displayed at each authentication window.
\r\nThe TOE uses X.509v3 certificates for peer entity authentication of TLS peers. The TSF determines the validity of the certificates by confirming the validity of the certificate chain and verifying that the certificate chain ends in a trusted Certificate Authority (CA). The TOE connects to an Online Certificate Status Protocol (OCSP) server to confirm the revocation status of the certificates.
\r\nSecurity management:
\r\nThe TOE allows local and remote management of its security functions. Local management is from a management workstation connected to the console or USB port of the TOE and the remote management is from a workstation connected to the TOE over SSHv2.
\r\nAll management functions are implemented using the CLI and are only made available to authorized administrators upon successful identification and authentication. The TOE also supports a NETCONF interface which is also protected with SSH. The administrator can use the NETCONF interface to perform the same functions as the CLI.
\r\nProtection of the TSF:
\r\nThe TOE protects all passwords, pre-shared keys, symmetric keys, and private keys from unauthorized disclosure. Pre-shared keys, symmetric keys, and private keys are stored encrypted. An exception is the SSH host keys which are required by the SSH Daemon when the SSH starts. The SSH Daemon is executed at the root privileges and the SSH host keys are only accessible with root privileges. No user of the TOE is granted root privileges. Passwords are stored as non-reversible hash values computed using either SHA-256 or SHA-512 using the shadow utility functions. The TOE maintains system time via its local hardware clock which is manually set by an administrator. The administrator may also configure the TOE to connect to a NTP server for time synchronization.
\r\nThe TOE executes self-tests during initial start-up to ensure correct operation and enforcement of its security functions. An administrator can install software updates to the TOE and verify the authenticity of all updates prior to the installation.
\r\nTOE access:
\r\nPrior to establishing an administration session with the TOE, an access banner is displayed to the user. The banner messaging is customizable but is typically used to warn the users of the consequences of attempted unauthorized access. The TOE will terminate an interactive session after a configurable time of session inactivity. A user may terminate his/her local and remote administrative sessions on will. Users may change their own passwords, but the TOE enforces minimum quality criteria for the passwords. The TOE also maintains a counter for consecutive, failed authentication attempts for each user. If the counter value reaches an administrator-defined threshold, the TOE triggers protective measures to prevent password guessing attacks.
\r\nTrusted path/channels:
\r\nThe TOE implements trusted paths and trusted channels. The trusted path is a SSH connection between the TOE and the remote management workstation. The SSH client of the remote management workstation connects to the SSH Server implemented by the TOE. Upon successful connection establishment and authentication of the user, the remote administrator uses the CLI or NETCONF over SSH to manage the TOE.
\r\nFor trusted channels, the TOE implements a TLS client used by the TOE to connect to the peer entities. The peer entity is the syslog server. The TOE uses MACsec to protect communications with MACsec peers.
","features":[{"id":633,"feature_name":"Asymmetric Key Generation"},{"id":630,"feature_name":"Auditing"},{"id":665,"feature_name":"Certificate Authentication"},{"id":662,"feature_name":"Certificate Validation"},{"id":638,"feature_name":"Cryptographic Hashing"},{"id":634,"feature_name":"Cryptographic Key Establishment"},{"id":636,"feature_name":"Cryptographic Signature Verification"},{"id":632,"feature_name":"DRBG"},{"id":631,"feature_name":"Key Destruction"},{"id":660,"feature_name":"Keyed-hash message authentication"},{"id":667,"feature_name":"MACsec"},{"id":664,"feature_name":"SSH Server"},{"id":663,"feature_name":"TLS Client"}]}