The Target of Evaluation (TOE) is Infinera GX G42 Optical Network Platform running Converged OS (COS) version 6.2.10. The GX G42 is an optical network platform delivering Wavelength, High-capacity Electrical OTN, and Packet network device. This next-generation compact modular transport optical network platform is deployed as part of a point-to-point, point-to-multipoint, or in conjunction with a FlexILS™ network for terrestrial and/or subsea applications. The GX G42 consists of one G42 chassis and provides multi-service client access (e.g., Ethernet, Optical Transport Network (OTN), etc.) to the Dense Wavelength Division Multiplexing (DWDM) transport bandwidth.
\r\n\r\n
The GX G42 provides various security features and protocols including RADIUS, TACACS+, SSHv2, NTP authentication, IPsec (IKEv2), RESTCONF, NETCONF, HTTPS and TLSv1.2.
\r\n","evaluation_configuration":"
The TOE is comprised of both software and hardware. The hardware is comprised of the GX G42 chassis. The software is comprised of the Converged OS (COS) version 6.2.10.
\r\nThe Infinera GX G42 is a 3 RU chassis that accommodates the pluggable modules identified in the table below:
\r\n\r\n
| \r\n Hardware Model \r\n | \r\n\r\n Specifications \r\n | \r\n
| \r\n GX G42 3 RU chassis; includes 1 GX-FAN-CTRL, 2 GX-FAN-XMM4s, and 5 GX-FANMODULE-Ds: \r\n\r\n -Power Entry Module (PEM) \r\n-G42 FIPS Input/Output (I/O) Module \r\n-Fan Controller Card (FCC) Module \r\n-Fan Modules (XMM4 and sled fan) \r\n-G42 Management Control Module (XMM4) \r\n-Coherent Module ICE6 (CHM6) Transponder Module \r\n-Blank Circuit Packs \r\n-Tributary Optical Module (TOM); 400G and 100G variants (a field-replaceable, pluggable module that converts the client optical signals to and from a serial electrical signal)[1] \r\n\r\n \r\n \r\n \r\n \r\n | \r\n\r\n Software: \r\nConverged OS (COS) version 6.2.10 \r\n\r\n Multi-Processor System: \r\nXMM4 - Intel Atom C3558 (Denverton) \r\nCHM6 – NXPLS1012ASE7KKB (ARM Cortex A53) \r\n\r\n ASIC: \r\nAtlantic ASIC \r\n\r\n Power Supply: \r\nPower Entry Modules (PEMs)—reside in the PEM module slots (labeled as PEM 1, PEM 2, PEM 3, and PEM 4) located at the rear of the chassis (in the upper 1 RU section); up to four AC or four DC PEMs are installed to provide 12V DC power supply throughout the GX G42 \r\n\r\n Interfaces: \r\n10Gbps data communication network (DCN) Ethernet RJ-45 interface. Supports 100M, 1G, and 10G Ethernet port speeds and provides a port for debug and remote management. \r\n\r\n One 10Gbps auxiliary (AUX) Ethernet interface. Supports 100M, 1G, and 10G port speeds. \r\n\r\n Two 10Gbps nodal control and timing (NCT) Ethernet interfaces supporting 100M, 1G and 10G port speeds (used for multiple chassis and thus not supported or tested in the evaluated configuration) \r\n\r\n One 1000Mbps auxiliary Ethernet interface supporting 10M, 100M and 1G port speeds. \r\n\r\n One 1000MBps craft Ethernet interface supporting 10M, 100M and 1G port speeds \r\n\r\n One console RS-232 serial port interface \r\n\r\n One Universal Serial Bus (USB) port interface[2] \r\n | \r\n
[1] Optical network communication is not in the scope of this evaluation
\r\n[2] USB ports are disabled in FIPS mode
\r\nThe evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5, April 2017. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 5, April 2017. The product, when delivered and configured as identified in the Infinera GX-G42 Optical Network Platform Release 6.2.10 Hardening Guide, Revision V002, January 2025 document, satisfies all of the security functional requirements stated in the Infinera GX G42 Optical Network Platform running Converged OS (COS) 6.2.10 Security Target, Version 1.1, 01/15/2025. The project underwent CCEVS Validator review. The evaluation was completed in January 2025 Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"The logical boundaries of the TOE are realized in the security functions that it implements. Each of these security functions is summarized below.
\r\n\r\n
Security audit:
\r\nThe TOE is designed to be able to generate logs for a wide range of security relevant events including start-up and shutdown of the TOE, all administrator actions, and all events identified in Table 5 Auditable Events in the Security Target. The TOE stores audit logs locally so they can be accessed by an administrator and is also configured to send the logs to a designated syslog server in the operational environment.
\r\nCryptographic support:
\r\nThe TOE includes cryptographic modules that provide key and certificate management, random bit generation, encryption/decryption, digital signature and secure hashing and key-hashing features in support of higher level cryptographic protocols including IPsec, SSH, HTTPS and TLS.
\r\nIdentification and authentication:
\r\nThe TOE requires all administrators to be successfully identified and authenticated before allowing any TSF mediated actions to be performed except for acknowledging the pre-login warning banner. Authentication can be either locally or remotely through an external RADIUS or TACACS+ authentication server. After an administrator-specified number of failed attempts, the user account is locked out for an administrator specified period of time. The TOE’s password mechanism provides configuration for a minimum password length. The TOE also protects, stores and allows authorized administrators to load X.509.v3 certificates for use to support authentication for IPsec/IKE and TLS connections.
\r\nSecurity management:
\r\nThe TOE provides the Security Administrator role the capability to configure and manage all TOE security functions including cryptographic operations, user accounts, passwords, advisory banner, session inactivity and TOE updates. The management functions are restricted to the Security Administrator role in accordance with FMT_SMR.2 (see Section 5.1.4.5). The TOE’s Security Administrator role is further defined in Section 6.4.5. The role must have the appropriate access privileges or access will be denied.
\r\nProtection of the TSF:
\r\nThe TOE provides reliable time stamps using its own internal hardware clock or by synchronizing with an NTP server over a secure IPsec connection. The TOE stores passwords hashed in the database using PBKDF hmac-sha512. The TOE does not provide any interfaces that allow passwords or keys to be read.
\r\nThe TOE runs self-tests during power up and periodically during operation to ensure the correct operation of the cryptographic functions and TSF hardware. There is an option for the administrator to verify the integrity of stored TSF executable code.
\r\nThe TOE includes mechanisms so that the administrator can determine the TOE version and update the TOE securely using digital signatures.
\r\nTOE access:
\r\nThe TOE allows administrators to configure a period of inactivity for local and remote administrator sessions. Once that time period has been reached while the session has no activity, the session is terminated. All users may also terminate their own sessions at any time. An administrator configured login banner is displayed at the management interfaces, local serial console (CLI), SSH CLI and Web UI (HTTPS/TLS), as an advisory and consent warning message regarding use of the TOE.
\r\nTrusted path/channels:
\r\nThe TOE uses IPsec to provide an encrypted channel between itself and the following third-party trusted IT entities in the operating environment: external syslog server, external authentication servers (RADIUS, TACACS+) and NTP server.
\r\nThe TOE secures remote communication with administrators by implementing SSHv2 (CLI, NETCONF) and HTTPS/TLSv1.2 (Web UI, RESTCONF). Both the integrity and disclosure protection are ensured via the secure protocol. If the negotiation of a secure session fails or if the user cannot be authenticated for remote administration, the attempted session will not be established.
","features":[{"id":678,"feature_name":"Asymmetric Key Generation"},{"id":672,"feature_name":"Auditing"},{"id":696,"feature_name":"Certificate Authentication"},{"id":687,"feature_name":"Certificate Validation"},{"id":684,"feature_name":"Cryptographic Hashing"},{"id":679,"feature_name":"Cryptographic Key Establishment"},{"id":683,"feature_name":"Cryptographic Signature Verification"},{"id":675,"feature_name":"DRBG"},{"id":694,"feature_name":"IKEv2"},{"id":693,"feature_name":"IPsec"},{"id":673,"feature_name":"Key Destruction"},{"id":685,"feature_name":"Keyed-hash message authentication"},{"id":690,"feature_name":"SSH Server"}]}