The TOE is a Mobile Device Management product and is comprised of an MDM Server component (GovShield Server) and one or more agent components called GovShield Clients. The GovShield Server component provides a centralized enterprise level management capability for a collection of Android Mobile Devices running GovShield Clients. The GovShield Server is also a Mobile Application Store (MAS) Server that allows managed devices to download apps from a trusted repository that resides within the organization managing the device. The management functionality includes management of Administrators and MD users, mobile device enrollment, mobile device status, mobile device policy management, and application management. Administrators access the GovShield Server through a browser-based web GUI on an Administrative Workstation in order to manage users, policies, and the Android Mobile Devices.
","evaluation_configuration":"The evaluated configuration of the TOE is the GovShield Version 1.60.05 comprising of the GovShield Server and one or more GovShield Clients installed on Android Mobile Devices. The minimum configuration for this evaluation is one GovShield Server, and one GovShield Client installed on an Android Mobile Device. Including additional GovShield Clients installed on multiple Android Mobile Devices as part of an operational configuration will not affect the validity of the functional claims made within this document and the Common Criteria certification.
\r\nIn its evaluated configuration, the TOE is configured to directly communicate with the following environment components:
\r\n\r\n
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) processes and procedures. GovShield Version 1.60.05 was evaluated against the criteria contained in the Common Criteria for Information Technology Security Evaluation, Version 3.1 Revision 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 Revision 5. The product, when installed and configured per the instructions provided in the preparative guidance, satisfies all of the security functional requirements stated in the GovShield Version 1.60.05 Security Target Version 1.0.
","environmental_strengths":"\r\nThe GovShield Server component of the TOE creates audit records for auditable events related to administrative actions, configuration of the GovShield Server itself, and server-initiated management activities that affect one or more managed Android Mobile Devices. The GovShield Server’s MAS Server functionality also generates audit records when it experiences a failure to push or update an application on a managed mobile device. The audit records are stored in a remote Oracle Database and transferred over a TLS encrypted trusted channel. Audit records can be viewed in the web GUI.
\r\n\r\n
The GovShield Server provides Authorized Administrators with the ability to view information about enrolled mobile devices and to review alerts when various events occur. Alerts are generated based on information provided by the GovShield Client during a reachability event. The GovShield Client also generates audit records for the activities it performs as a result of its interactions with the GovShield Server.
\r\n\r\n\r\n
The GovShield Client’s Android Mobile Devices are registered with the GovShield Server for enrollment. This requires an Administrator to enable communications between these TOE components by managing a whitelisted set of Android Mobile Devices that are allowed to enroll with the GovShield Server. The enrollment process occurs over an HTTPS/TLS trusted channel that is handled by each TOE components’ underlying platform. An Administrator can disable the communications between a GovShield Client and the GovShield Server by unenrolling or wiping the enrolled Android Mobile Device.
\r\n\r\n\r\n
Cryptographic services for the GovShield Server and the GovShield Client are provided by their respective underlying platforms. The cryptographic services include encryption/decryption services, credential/key storage, key establishment, key destruction, hashing services, signature services, and hashed message authentication. All cryptographic services use the respective TOE components’ platform provided DRBG functionality to support their cryptographic operations.
\r\n\r\n
The GovShield Server invokes the Java Runtime Environment Platform and its BSafe cryptographic library for cryptographic services to establish TLS and HTTPS/TLS trusted channels and paths to ensure secure communications of data in transit. The MAS Server is integrated with the GovShield Server, so it invokes the same cryptography services. The GovShield Server also invokes its platform to digitally sign policies sent to the GovShield Clients.
\r\n\r\n
The GovShield Client invokes its underlying Android Mobile Device platform’s BoringSSL cryptographic module for cryptographic services to also establish trusted communications. The GovShield Client also invokes its underlying platform to verify the digital signatures of all policies received from the GovShield Server.
\r\n\r\n
Identification and Authentication
\r\nThe GovShield Client registers with the GovShield Server so that the Android Mobile Device can be enrolled into management by the GovShield Server. This is accomplished by MD user or Administrator installing the GovShield Client software using a QR code, and then entering their authentication credentials through the GovShield Client interface. This will initiate the enrollment connection to the GovShield Server. The GovShield Server will authenticate the user as well as verify that the Android Mobile Device is allowed to enroll based upon being included within a whitelisted set of Android Mobile Devices. The GovShield Server will then send the GovShield Client its initial payload to include a unique X.509v3 certificate for trusted communications and the public key to verify the signature of policies. The GovShield Client then downloads its assigned policy from the GovShield Server to complete the enrollment process.
\r\n\r\n
Administrators (through the web GUI and GovShield Client) and MD users (through the GovShield Client) cannot access the GovShield Server without being authenticated. Administrators and MD users can view the configurable consent warning banner prior to authentication via their respective interfaces.
\r\n\r\n
The GovShield Server relies on the underlying platform to provide X.509v3 certificate services for signing policies that are sent to GovShield Client. The GovShield Server also relies on its platform to provide its X.509v3 certificate as part of TLS and HTTPS/TLS session establishment in all cases where the GovShield Server needs to provide an X.509v3 certificate. The GovShield Client relies on the underlying platform’s cryptographic modules to provide X.509v3 certificate services for signature verification for signed policies sent from the GovShield Server, and in support of HTTPS/TLS connections from the GovShield Client to the GovShield Server.
\r\n\r\n\r\n
Authorized Administrators manage the TOE through the GovShield Server’s web GUI which provides the ability to manage users, policies, and the Android Mobile Devices. An Administrator or MD user initiates the installation of the TOE’s GovShield Client on the Android Mobile Device; which will communicate with the GovShield Server to enroll in management. Once enrolled, the TOE will prevent user-directed unenrollment from management.
\r\nThe GovShield Server can be used to transmit specific commands to an Android Mobile Device such as forcibly locking the device or initiating a wipe operation. The GovShield Server can also define policies that specify the configuration settings for an Android Mobile Device. These configuration settings can include functionality such as configuration of the password policy and what settings are applied to Wi-Fi connections. The GovShield Server transmits commands and policies to the GovShield Client for enforcement on the Android Mobile Device. The GovShield Server invokes its underlying platform to sign all policy data and the GovShield Agent invokes its underlying platform to validate the signed policies when they are received.
\r\n\r\n\r\n
The communications between the GovShield Server and GovShield Client is protected using HTTPS/TLS which is provided by the underlying platforms of the TOE components.
\r\n\r\n
The GovShield Server relies on its platform to perform the self-test functionality. This includes the platform performing self-tests to verify the integrity and operation of the operational environment components (operating system, hardware and cryptographic module), and the integrity of stored TSF executable code against known SHA-256 checksums.
\r\n\r\n
The Administrator invokes the GovShield Server’s underlying platform to update the GovShield Server software, and the platform will verify the GovShield Server’s software digital signature as part of the installation process. The Administrator distributes updates to the GovShield Client software through the GovShield Server’s MAS Server functionality, and the GovShield Client will invoke the Android Mobile Device to verify the software update’s digital signature before installing it. The TOE components’ software contains third-party libraries. The TOE components use only documented APIs from their underlying platforms.
\r\n\r\nThe GovShield Server displays a configurable consent warning banner on the web GUI’s login page. The GovShield Client displays a configurable consent warning banner on the GovShield Client’s login page.
\r\n\r\n\r\n
The trusted communication channels between the GovShield Server and the GovShield Client, and the GovShield Client and the Oracle Database, make use of HTTPS/TLS and TLS respectively. The trusted communication channels are provided by the TOE components’ underlying platforms.
\r\n\r\n
The GovShield Server platform uses HTTPS/TLS to provide a trusted path between itself and remote Administrators through the web GUI and mobile device users during the enrollment of a GovShield Client on an Android Mobile Device.
\r\n\r\n
","features":[{"id":5399,"feature_name":"Asymmetric Key Generation"},{"id":5400,"feature_name":"Auditing"},{"id":5401,"feature_name":"Certificate Authentication"},{"id":5402,"feature_name":"Certificate Validation"},{"id":5403,"feature_name":"Cryptograhic Hashing"},{"id":5404,"feature_name":"Cryptographic Key Establishment"},{"id":5405,"feature_name":"Cryptographic Signature Generation"},{"id":5406,"feature_name":"Cryptographic Signature Verification"},{"id":5407,"feature_name":"DRBG"},{"id":5408,"feature_name":"Key Destruction"},{"id":5409,"feature_name":"Keyed-hash message authentication"},{"id":5410,"feature_name":"MDM Agent"},{"id":5411,"feature_name":"Mobile Application Management"},{"id":5412,"feature_name":"Mobile Content Management"},{"id":5413,"feature_name":"Mobile Device Management"}]}