Specifications

CRP-C0239-01

1.5.2 EAL

Evaluation Assurance Level of TOE defined by this ST is EAL3 conformance.

1.5.3 SOF

This ST claims "SOF-basic" as its minimum strength of function.

This TOE is assumed to be placed on the premises for organizations such as offices in

which the risk of its assumed threats is low, and to be operated with it connected to the

Internal Networks of the organization. Therefore SOF-basic is selected.

1.5.4 Security Functions

The TOE counters the threats with its functions as described below, and satisfies the

organizational security policy.

1.5.4.1

Countermeasure to T.ILLEGAL_USE, T.UNAUTH_ACCESS, T.ABUSE_SEC_MNG

These threats are countered with a sequence of countermeasure,

identification/authentication and the access control.

For users (operators) who attempt to use the TOE, the TOE requires them to enter

their user ID and the authentication information (password). Then it verifies the

integrity of the entered user ID and authentication information.

The TOE has the following functions to counter the impersonation when entering the

user ID and authentication information.

- According to the Lockout Policy, if the number of consecutive unsuccessful attempts

to identify and authenticate a particular user ID meets the Number of Attempts

before Lockout, the TOE lockouts this user ID (prevents this user ID from using the

TOE).

- When allowing users to set or change their passwords, the TOE allows them to

conditions of Minimum Password Length and Complexity Setting for Password.

After the TOE verifies the user ID and authentication information, it selects either (1)

or (2).

(1) If the user ID and authentication information cannot be verified, the TOE does not

allow the operator to use the TOE functions.

Since the users who are not allowed to use the TOE do not have the valid user ID

and authentication information, (1) indicates the unauthorized TOE users cannot

use the TOE functions. This is the countermeasure to T.ILLEGAL_USE.

(2) If the user ID and authentication information are verified, the TOE identifies the

operator by the user ID, and then identifies the user's User Role by the user ID.

After the TOE identifies these, the TOE allows the user to use the TOE functions.

The following are the roles that are identified by the TOE.

- General User

- Administrator

- Supervisor

For Administrators, the user can also be identified by the any of the following

roles. The following roles are not exclusive. More than one role can be assigned to

one Administrator user ID.

- User Administration

- Machine Administration