The GoSilent Server acts as the centralized management and external access system for the TOE integrated into one system. The GoSilent Server provides the management GUI for configuration of GoSilent Server as well as the GoSilent Cube user devices. Operationally, it acts as the central peer for all IPsec connections from the GoSilent Cube devices and provides gateway connectivity to external systems located behind a GoSilent Cube.
\r\nThe GoSilent Cube is a portable enterprise-grade firewall and VPN, ideal for sensitive communications, secure remote network access, and Internet of Things (IoT) deployments. GoSilent Cube can be setup within minutes by non-technical users. Physical Ethernet connections are supported on both the user side and VPN side of GoSilent Cube.
\r\nTogether, GoSilent Cube and GoSilent Server provide a secure communications path to one or more systems located “behind” each GoSilent Cube. These systems connect to GoSilent Cube via physical Ethernet. Each GoSilent Cube establishes an IPsec VPN to the GoSilent Server, and all traffic from the user systems is routed over that VPN. Physical Ethernet is supported on the VPN side of GoSilent Cube.
\r\nThe TOE applies policies to restrict the traffic that is permitted to pass between the user systems and external networks.
\r\nManagement of the system is performed via a GUI provided by GoSilent Server, accessed via a browser on remote PCs using TLS/HTTPS. Authorized administrators may configure GoSilent Server as well as the GoSilent Cubes.
\r\nGoSilent Cubes also provide a GUI accessed from a browser on a user system via a TLS/HTTPS connection. This GUI only provides authorized administrators with the ability to configure that specific GoSilent Cube with enough information to connect to GoSilent Server. All additional configuration information is downloaded from GoSilent Server once the IPsec VPN is established.
\r\nBoth GoSilent Server and GoSilent Cube generate audit records that are stored locally as well as sent to a remote syslog server via a TLS connection.
","evaluation_configuration":"The GoSilent Server is a software TOE/virtual network device (vND) while GoSilent Cube is a physical network device (pND). The following platforms apply to these components.
\r\nTable 1: GoSilent Server and Cube v26.01 Platforms
\r\n| \r\n TOE Component \r\n | \r\n\r\n Hardware Model \r\n | \r\n\r\n CPU \r\n | \r\n\r\n CPU Microarchitecture \r\n | \r\n\r\n Virtualization \r\n | \r\n\r\n OS \r\n | \r\n
| \r\n GoSilent Server \r\n | \r\n\r\n Dell PowerEdge R660 Server \r\n | \r\n\r\n Intel Xeon Silver 4514Y \r\n | \r\n\r\n Raptor Cove \r\n | \r\n\r\n VMware ESXi v8.0 \r\n | \r\n\r\n Debian 12 \r\n | \r\n
| \r\n Red Hat RHEL v9.6 KVM \r\n | \r\n|||||
| \r\n GoSilent Cube \r\n | \r\n\r\n CACI idt GSC-100 \r\n | \r\n\r\n AllWinner H5/ Cortex A-53 \r\n | \r\n\r\n ARM v8-A \r\n | \r\n\r\n N/A \r\n | \r\n\r\n Armbian 25.05 \r\n | \r\n
| \r\n CACI idt GSC-120 \r\n | \r\n
The TOE is deployed in a distributed configuration with the GoSilent Server virtual appliance installed on a virtualization platform located at the enterprise destination and the GoSilent Cube at the user device side. The GoSilent Cube can be connected between a specific device and the LAN, or between an access switch with multiple user devices connected and the WAN. Figure 2 below shows the physical TOE deployment and the logical TOE boundary.
\r\nFigure 1: Representative TOE Deployment
\r\nThe TOE management interfaces are depicted in Figure 2.
\r\n\r\nThe TOE interfaces are as follows:
\r\n\r\n
The following items are required for the operational environment.
\r\nTable 2: Hardware and Software Environmental Components
\r\n| \r\n Components \r\n | \r\n\r\n Mandatory/ \r\nOptional \r\n | \r\n\r\n Description \r\n | \r\n
| \r\n Ethernet dongle \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n Provides the WAN USB port of each GoSilent Cube for connection of the Cube to the WAN. \r\n | \r\n
| \r\n TOE Network \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n Provides connectivity between the TOE components. Since IPsec tunnels are layered on top of this network, the network itself is not required to be trusted. \r\n | \r\n
| \r\n External Network \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n GoSilent Server provides user systems with connectivity to systems on an External network, which may be limited to an Enterprise Network or provide much wider access. \r\n | \r\n
| \r\n GoSilent Cube user networks \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n Physical Ethernet networks located on the user side of GoSilent Cube that provide connectivity between user systems and GoSilent Cube. In the simplest case, this is a direct connection using an Ethernet cable interconnecting the GoSilent Cube RJ45 Device port and a user system. To support multiple user systems, an Ethernet switch can be used. \r\n | \r\n
| \r\n Syslog Server \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n The Syslog Server receives audit messages from the TOE over a TLS connections and may be connected to the TOE Network or the External Network. \r\n | \r\n
| \r\n OCSP Server \r\n | \r\n\r\n Optional \r\n | \r\n\r\n Server accessed via OCSP to determine X.509 certificate revocation status for IPsec connections. The OCSP Server is connected to the TOE Network. \r\n | \r\n
| \r\n Certificate Distribution Points (CDP) \r\n | \r\n\r\n Optional \r\n | \r\n\r\n Servers accessed using HTTP to determine X.509 certificate revocation status for syslog connections. The CDPs may be connected to the TOE Network or the External Network. \r\n | \r\n
| \r\n User systems \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n IT systems using GoSilent Cube as a secure path to external systems. \r\n | \r\n
","security_evaluation_summary":"
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the \"CACI idt GoSilent Server and Cube v26.01\" was evaluated is described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. The product, when delivered and configured as identified in the Common Criteria Administrator Guidance, satisfies all of the security functional requirements stated in the CACI idt GoSilent Server and Cube v26.01 Security Target. The project underwent CCEVS Validator review. The evaluation was completed in July 2026. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"The TOE provides the security functions required by the collaborative Protection Profile for Network Devices, Version 3.0e, PP-Module for Stateful Traffic Filter Firewalls, Version 1.4e and PP-Module for Virtual Private Network Gateways, Version 1.3.
\r\nThe TOE generates logs for auditable events. These logs are stored locally in protected storage and are also forwarded to an external audit server. When the maximum storage utilization has been reached, audit records are rotated as described in the ST.
\r\nThe TOE provides mechanisms for configuring, registering, and enabling components in order to establish secure communications with each other.
\r\nThe TOE implements key generation and other cryptographic services to protect TOE communications including data in transit and at rest.
\r\nThe TOE provides mechanisms to protect user data and prevent its persistence by overwriting storage space with zeros when memory is deallocated.
\r\nThe TOE provides firewall functionality for all traffic passed through the TOE by enforcing stateful network traffic filtering based on examination of network packets and the application of information flow rules.
\r\nThe TOE implements mechanisms to identify and authenticate all administrators to ensure only authorized access to TOE functionality or TSF data is granted.
\r\nThe TOE provides a suite of management functionality for each TOE component, which is only configurable and accessible by authorized administrators.
\r\nThe TOE implements a variety of protection mechanisms including authentication, self-tests, and trusted update functions to ensure the integrity of the TOE and that its TSF data is protected from unauthorized access.
\r\nThe TOE provides session monitoring and management functions for local and remote administrative sessions.
\r\nThe TOE provides secure channels between itself and local/remote administrators, including logging channels to ensure data in transit is protected.
","features":[{"id":5650,"feature_name":"Auditing"},{"id":5651,"feature_name":"Cryptograhic Key Generation"},{"id":5655,"feature_name":"Cryptographic Hashing"},{"id":5652,"feature_name":"Cryptographic Key Establishment"},{"id":5653,"feature_name":"Cryptographic Signature Generation"},{"id":5654,"feature_name":"Cryptographic Signature Verification"},{"id":5664,"feature_name":"Firewall"},{"id":5663,"feature_name":"HTTPS Server"},{"id":5667,"feature_name":"IKEv2"},{"id":5666,"feature_name":"IPsec"},{"id":5656,"feature_name":"Key Destruction"},{"id":5657,"feature_name":"Network Device"},{"id":5659,"feature_name":"TLS 1.2"},{"id":5660,"feature_name":"TLS 1.3"},{"id":5661,"feature_name":"TLS Client"},{"id":5662,"feature_name":"TLS Server without Mutual Authentication"},{"id":5658,"feature_name":"Virtual Network Device"},{"id":5665,"feature_name":"VPN Gateway"}]}