Installation guide

Motorola WS5100 Wireless Switch and RFS7000 RF Switch Security Target
Page 42 of 85
the external authentication server is protected using IPSec/IKE security protocol with pre-shared
keys. EAP-TLS uses a client certificate for user authentication, the username is embedded in the
certificate. EAP-TTLS and PEAP use a password for user authentication.
No services are provided by the TOE until the user is successfully identified and authenticated.
6.1.5 Security Management
The TOE provides remote management using SSH protocol, as well as local management utilizing
a serial console connection.
The management interfaces provide capabilities to add, view and remove IPSec/IKE and RADIUS
cryptographic keys and key lifetime, create/delete administrator users and set administrator
passwords, set maximum number of unsuccessful administrator authentication attempts, re-enable
administrators, set maximum session idle time for administrators and wireless users, enable/disable
wireless encryption, enable/disable the use of an authentication server, set IP addresses of remote
authentication, audit and time servers, execute self-tests, set cryptographic algorithms used by
IPSec/IKE, zeroize cryptographic keys and CSPs, start and stop audit functions, execute self-tests,
select events which trigger an audit record, enable/disable verification of cryptographic key testing,
as well as view the corresponding settings.
All management functions require assumption of the administrator role upon successful
authentication of the administrator.
6.1.6 Protection of the TSF
The TOE provides for non-bypassability of the TOE Security Policy, and TSF domain separation.
The TSP enforcement functions are invoked and succeed before security functions in the TSC are
allowed to proceed. Each wireless user is authenticated before access is provided, and for
authenticated wireless users, each wireless user network packet is authenticated as a part of
802.11i security protocol before the packet is processed by the TOE. Each administrator is
authenticated before management access is provided and each network message coming from an
authenticated administrator is authenticated as a part of the SSH protocol.
For each authenticated wireless user and remote administrator the TOE associates the user with a
session object. The session object is then used to enforce domain separation for authenticated
wireless users and administrators. All enforcement operations are performed within the physical
boundary of the TOE. Connection to the remote authentication server is protected using an
IPSec/IKE-based trusted channel, which authenticates each incoming and outgoing network packet.
The TOE maintains an IPSec/IKE trusted channel to a remote network time protocol server, which
provides time used in reliable time stamps.
The TOE implements a set of FIPS 140-2 self-tests, which are executed during initial start-up and
upon administrator request. The TOE provides an option to run self-tests immediately after a key is
generated.
The TOE implements a set of critical self-tests, which are executed during initial start-up and upon
administrator request. The tests include an integrity check for TSF data and executable code.
If the self-tests fail, the TOE security functionalities and data output are disabled.