Compliant Product - Cisco 8000 Series Routers running on IOS-XR 7.3
Certificate Date: 2022.11.10CC Certificate Security Target Validation Report
Validation Report Number: CCEVS-VR-VID11274-2022
Product Type: Network Device
Conformance Claim: Protection Profile Compliant
PP Identifier: collaborative Protection Profile for Network Devices Version 2.2e
Extended Package for MACsec Ethernet Encryption Version 1.2
CC Testing Lab: Acumen Security
Administrative Guide: C8000 7.3 Cisco 8000 Series Routers running IOS-XR Version 7.3 Common Criteria Operational User Guidance
Administrative Guide: Hardware Installation Guide for Cisco 8800 Series Routers
Administrative Guide: Software Installation Guide for Cisco 8000 Series Routers, IOS XR Release 7.3.x
Administrative Guide: System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Release 7.3.x
Administrative Guide: System Setup Guide for Cisco 8000 Series Routers, IOS XR Release 7.3.x
The TOE consists of one or more physical devices as specified in section 1.7 of the ST along with MACsec-supporting hardware (8800-LC-48H) and includes the Cisco IOS-XR software. The TOE has two or more network interfaces and is connected to at least one internal and one external network. The Cisco IOS-XR configuration determines how packets are handled to and from the TOE’s network interfaces. The router configuration will determine how traffic flows received on an interface will be handled. Typically, packet flows are passed through the internetworking device and forwarded to their configured destination.
An external syslog server must be used to store audit records. The TOE authenticates those devices with X.509v3 certificates and protects communication channels with the TLS protocol. Secure remote administration is protected with SSH which is implemented with authentication failure handling.
For remote administration, a secure session using SSHv2 must be established.
The following figure provides a visual depiction of an example TOE deployment:
The previous figure includes the following:
· The following are considered to be in the IT Environment:
o MACsec Peer
o Management Workstation
o Audit (Syslog) Server
o Local Console
o Certificate Authority
NOTE: While the previous figure includes several non-TOE IT environment devices, the TOE is only the C8000 device. Only one TOE device is required for deployment in an evaluated configuration.
Security Evaluation Summary
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Cisco 8000 Series Routers running IOS-XR Version 7.3 was evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. The product, when delivered configured as identified in the Cisco 8000 Series Routers running IOS-XR Version 7.3 Common Criteria Operational User Guidance, satisfies all of the security functional requirements stated in the Cisco 8000 Series Routers running IOS-XR Version 7.3 Security Target. The project underwent CCEVS Validator review. The evaluation was completed in November 2022. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
The TOE is comprised of several security features. Each of the security features identified above consists of several security functionalities, as identified below.
· Security Audit
· Cryptographic Support
· Identification and Authentication
· Security Management
· Protection of the TSF
· TOE Access
· Trusted Path/Channels
These features are described in more detail in the subsections below. In addition, the TOE implements all SFRs of the NDcPP v2.2e and MACsec EP v1.2 as necessary to satisfy testing/assurance measures prescribed therein.
The TOE provides extensive auditing capabilities. The TOE can audit events related to cryptographic functionality, identification and authentication, and administrative actions. The TOE generates an audit record for each auditable event. Each security relevant audit event has the date, timestamp, event description, and subject identity. The administrator configures auditable events, performs back-up operations and manages audit data storage. The TOE provides the administrator with a circular audit trail. The TOE is configured to transmit its audit messages to an external syslog server over an encrypted channel using TLS.
The TOE provides cryptography in support of other TOE security functionality. All the algorithms claimed have CAVP certificates (Operational Environment – Intel Xeon D-1530 (Broadwell)). In addition, the TOE supports MACsec using the CoMIRA Mentor Questa Sim 10.7 processor (see Table 1 for certificate references).
The TOE provides cryptography in support of remote administrative management via SSHv2 and secures the session between the C8000 and remote syslog server using TLS.
The TOE authenticates and encrypts packets between itself and a MACsec peer. The MACsec Key Agreement (MKA) Protocol provides the required session keys and manages the required encryption keys to protect data exchanged by the peers.
The cryptographic services provided by the TOE are described in Table 2 below:
The TOE provides authentication services for administrative users wishing to connect to the TOEs secure CLI administrator interface. The TOE requires Authorized Administrators to authenticate prior to being granted access to any of the management functionality. The TOE can be configured to require a minimum password length of 15 characters as well as mandatory password complexity rules.
After a configurable number of incorrect login attempts, C8000 will lockout the account until a configured amount of time for lockout expires.
The TOE provides administrator authentication against a local user database. Password-based authentication can be performed on the serial console or SSH interfaces. The SSHv2 interface also supports authentication using SSH keys.
The TOE uses X.509v3 certificates as defined by RFC 5280 to support authentication for TLS connections.
The TOE provides secure administrative services for management of general TOE configuration and the security functionality provided by the TOE. All TOE administration occurs either through a secure SSHv2 session or via a local console connection. The TOE provides the ability to securely manage all TOE administrative users, all identification and authentication, all audit functionality of the TOE, all TOE cryptographic functionality, the timestamps maintained by the TOE, and updates to the TOE. The TOE supports a privileged administrator role. Only the privileged administrator can perform the above security relevant management functions.
Administrators can create configurable login banners to be displayed at time of login and can also define an inactivity timeout for each admin interface to terminate sessions after a set period of inactivity.
The TOE protects against interference and tampering by untrusted subjects by implementing identification, authentication, and access controls to limit configuration to Authorized Administrators. The TOE prevents reading of cryptographic keys and passwords. Additionally, Cisco IOS-XR is not a general-purpose operating system and access to Cisco IOS-XR memory space is restricted to only Cisco IOS-XR functions.
The TOE is also able to detect replay of information received via secure channels (MACsec). The detection applied to network packets that terminate at the TOE, such as trusted communications between the TOE and an IT entity (e.g., MACsec peer). If replay is detected, the packets are discarded.
The TOE internally maintains the date and time. This date and time is used as the timestamp that is applied to audit records generated by the TOE. Administrators can update the TOE’s clock manually. Finally, the TOE performs testing to verify correct operation of the router itself and that of the cryptographic module.
The TOE is able to verify any software updates prior to the software updates being installed on the TOE to avoid the installation of unauthorized software.
The TOE can terminate inactive sessions after an Authorized Administrator configurable time-period. Once a session has been terminated the TOE requires the user to re-authenticate to establish a new session.
The TOE can also display a Security Administrator specified banner on the CLI management interface prior to allowing any administrative access to the TOE.
The TOE establishes a trusted path between the appliance and the CLI using SSHv2 and the syslog server using TLS. MACsec is used to secure communication channels between MACsec peers at Layer 2.
Cisco Systems, Inc.