The Ampex iECDL is an intelligent ground download station that provides the tools for managing the removable storage media utilized by a military on board vessel’s network file server (NFS). As a data loader, the iECDL provides the capability to store and retrieve digital data from a classified nonvolatile solid-state transportable Removable Storage media (RSM) or an intelligent Removable Storage Media (iRSM). The data includes preflight loading of Operation Flight Program (OFP), intelligence data, maps, tactical programs, and other mission related data via a workstation using a 5Gb Ethernet.
\r\nThe iECDL implements a Key Transfer Device (KTD) for secure storage of cryptographic keys as well as a secure mechanism to assign and distribute cryptographic keys for the removable media distributed across the fleet. The iECDL supports multiple protocols which may be used concurrently, including File Network File System (NFS), Secure Copy Protocol (SCP), Trivial File Transfer Protocol (TFTP), and Secure Shell (SSH).
","evaluation_configuration":"The following figure illustrates a typical iECDL with a KTD and an RSM.
\r\n\r\n
Figure: iECDL TOE Components
\r\nThe following section provides a description of the iECDL components and identifies which items are included in the TOE’s physical boundary. Items included in the TOE physical boundary are identified in blue font. Items in the Operational Environment are identified with italicized text. Refer to Figure above for additional information.
\r\niECDL
\r\n| \r\n Hardware enclosure \r\n | \r\n\r\n The commercial grade casing hosting the TOE and other components of the iECDL. An iECDL includes two cards: a Host System card and the TSEM (TuffServ® Encryption Engine) card. Both are described in detail below. \r\n | \r\n
Host System Card
\r\n| \r\n Purpose \r\n | \r\n\r\n The Host System provides the Authorization Acquisition (AA) FDE functionality of the TOE. It is responsible for providing the interface to the TSEM and the Key Transfer Device (KTD) or compact Removable Storage Media (cRSM). The KTD and cRSM hold the authentication factors. Both provide the same functionality so, throughout the documentation for this evaluation, the documents refer to the KTD only. However, the description or functionality applies to both devices and both devices are included in the evaluated configuration. The iECDL requires a KTD or a cRSM to receive the authentication factor. The iECDL also support both inserted simultaneously. The iECDL will always select the authentication factor found on the KTD first. Additionally, the Host System provides the administrative interfaces that support management, control, and monitoring of the iECDL. \r\n | \r\n
| \r\n TOE Boundary \r\n | \r\n\r\n The TOE boundary on the Host System Card is the Ampex iECDL application, (the ACCE (Ampex Common Computing Environment)) and the AMPEX OpenSSL Cryptographic Module (the cryptographic library). \r\n | \r\n
| \r\n Processor/Microarchitecture \r\n | \r\n\r\n Intel® Atom® C3558 (Goldmont microarchitecture) \r\n | \r\n
| \r\n TPM \r\n | \r\n\r\n Infineon SLB9665XT2.0 Trusted Platform Module \r\nThe TPM provides the Host System’s non-volatile memory. \r\nThe contents of the TPM is TSF data and therefore included in the TOE’s physical boundary. \r\n | \r\n
| \r\n Ampex Software Build: \r\n | \r\n\r\n Ampex Common Computing Environment (ACCE), Version 2.74.1. \r\nThe ACCE provides the AA (Authorization Acquisition) functionality. The ACCE is the interface between the KTD and the TSEM (TuffServ® Encryption Module) card. The ACCE provides two administrative interfaces: a GUI (Graphical User Interface) and a CLI (Command Line Interface) for iECDL management and control and includes the TSEM Library that provides the interface to the TSEM. \r\n | \r\n
| \r\n Cryptographic Library: \r\n | \r\n\r\n AMPEX OpenSSL Cryptographic Module, version 1.1.1, CAVP Cert #A7741 \r\nThe iECDL uses the AMPEX OpenSSL Cryptographic Module (cryptographic library) to validate the signature of Host System software updates. There are no other cryptographic algorithms required by the ACCE. \r\n | \r\n
| \r\n Operating System \r\n | \r\n\r\n RHEL 8.6 \r\nThe Operating System is included in the Operational Environment. iECDL Administrators interface to RHEL using the RHEL CLI in order to update the Host System software. Updating the ACCE software is done using RPM (Red Hat Package Manager). RPM calls the AMPEX OpenSSL Cryptographic Module (cryptographic library), version 1.1.1 to validate the upgrade digital signature. \r\n | \r\n
| \r\n \r\n | \r\n\r\n OS Kernel: Version 4.18-372 \r\n | \r\n
| \r\n \r\n | \r\n\r\n \r\n | \r\n
TuffServ® Encryption Module (TSEM)
\r\n| \r\n Purpose \r\n\r\n | \r\n\r\n The TSEM provides the Encryption Engine (EE) FDE functionality. The TSEM provides the interface between the Host System card and the storage devices, the RSMs/iRSMS The TSEM provides cryptographic key management services for the TuffServ® secure storage device. \r\n | \r\n
| \r\n TOE Boundary \r\n | \r\n\r\n The complete TSEM card is included in the TOE boundary. This includes all of the hardware and software identified below. \r\n | \r\n
| \r\n TSEM Hardware \r\n | \r\n\r\n Version v1320249-010 Rev A \r\n | \r\n
| \r\n Processor/Microarchitecture: \r\n | \r\n\r\n NXP Kinetis K81 32-bit Security Microcontroller (Secure MCU) (with microarchitecture ARM Cortex M4) \r\n | \r\n
| \r\n FPGA (Field Programmable Gate Array) \r\n | \r\n\r\n The SATA (Serial Advanced Technology Attachment) Controllers are the IntelliProp Lycan FPGAs which implement all data plane security functions of the TOE. Data plane security functions include AES-XTS encryption and decryption of all data to and from the storage media (RSM/iRSM). The SATA Controller registers store Data Encryption Key (DEK) that encrypts and decrypts the data stored in the RSMs. \r\n | \r\n
| \r\n TSEM Firmware \r\n | \r\n\r\n Version iECDL_FW_1.1.16 \r\nThe SoC implements control plane functionality, such as module initialization, configuration, and provisioning. The TSEM communicates with the Host System over a USB interface. The TSEM FW includes a Host System Library that provides the routines to interface to the Host System Card. \r\nCryptographic Libraries \r\nThe TSEM firmware includes the following two cryptographic libraries. \r\nTSEM Cryptographic Library v1.1.16.0, CAVP (Cryptographic Algorithm Verification Program) Cert #A2921 \r\nThe TSEM Cryptographic Library provides the cryptographic primitives required for the TSEM EE firmware. \r\nIPC-BL120B-ZM Library version EP2AGX65 (SATA Crypto Library), CAVP Cert #A2914 \r\nThe IntelliProp Lycan FPGA’s AES-XTS Encryption IP core. Used in the IntelliProp Lycan FPGA SATA controllers to encrypt and decrypt data stored on the RSM. \r\n | \r\n
Key Transfer Device (KTD)
\r\nThe KTD is in the Operational Environment. However, the authentication factors stored on the KTD are included in the TOE boundary (identified as KTD Storage in Figure 2). The KTD store the AA authorization factors used to determine if the encrypted/decrypted RSM data can be accessed.
\r\nRemovable Storage Media (RSM)
\r\nThe RSM/iRSM is in the Operational Environment (described in Section 1.5). However, the encrypted User data (identified as RSM Storage in Figure 2) stored on the RSM and the data stored in EEPROM (Electrically Erasable Programmable Random Access Memory) (identified as RSM EEPROM in Figure 2) are included in the TOE boundary.
\r\n\r\n
The TOE’s environmental components identified in the previous section in italicized text are required to operate the TOE in the evaluated configuration.
\r\nAdditionally, a workstation is required to manage the iECDL. The workstation must be connected on the same LAN as the iECDL. The workstation must have the latest versions of Chrome or Edge browser installed.
","security_evaluation_summary":"The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the TuffServ® Intelligent E-2 Common Data Loader (iECDL) 2.74.1 Target of Evaluation (TOE) was evaluated is described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. The product, when delivered and configured as identified in the \"TuffServ® Intelligent E-2 Common Data Loader (iECDL) v2.74.1 Common Criteria User Guide\", satisfies all of the security functional requirements stated in the TuffServ® Intelligent E-2 Common Data Loader (iECDL) 2.74.1 Security Target. The project underwent CCEVS Validator review. The evaluation was completed in January 2026. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"The TOE provides the security functions required by the FDE_AA cPP and FDE_EE cPP.
\r\nThe TOE includes NIST CAVP-validated cryptographic algorithms supporting cryptographic functions. The TOE provides Key Derivation, BEV Validation, and data encryption.
\r\nThe TOE performs Full Drive Encryption such that the drive contains no plaintext user data. The TOE performs user data encryption by default in the out-of-the-box configuration using AES-XTS-256 mode.
\r\nThe TOE supports management functions for changing and erasing the DEK using the iECDL GUI (Graphical User Interface) and initiating the TOE updates using the iECDL command line interface (CLI).
\r\nThe TOE provides trusted firmware updates, protects Key and Key Material; and supports power saving states. The TOE runs a suite of self-tests during initial start-up (on power on.
","features":[{"id":1893,"feature_name":"Cryptographic Hashing"},{"id":1892,"feature_name":"Cryptographic Signature Verification"},{"id":1890,"feature_name":"DRBG"},{"id":1881,"feature_name":"Full Drive Encryption"},{"id":1889,"feature_name":"Key Destruction"},{"id":1894,"feature_name":"Keyed-hash message authentication"},{"id":1891,"feature_name":"Symmetric Key Generation"}]}