7th International Common Criteria Conference
Lanzarote, Spain
September 19-21, 200

Harkins, Richard M.

Irvine, Cynthia E.

Nguyen, Thuy D.

Calhoun, Institutional Archive of the Naval Postgraduate School

Calhoun: The NPS Institutional ArchiveFaculty and Researcher Publications Faculty and Researcher Publications Collection2006-09An Experiment with CC Version 3.0 MigrationNguyen, Thuy D.http://hdl.handle.net/10945/491557th International Common Criteria ConferenceLanzarote, Spain September 19-21, 2006An Experiment with CC Version 3.0 MigrationThuy D. Nguyen, Cynthia E. IrvineDepartment of Computer Science, Naval Postgraduate SchoolRichard M. HarkinsDepartment of Physics, Naval Postgraduate School ICCC 2006 1Discussion Topics• Motivations• Project background– Draft Multilevel Print Server (MPS) PP• CC Version 2.2 Æ CC Version 3.0– Objectives and Approach– Before and After• Observations and ConclusionICCC 2006 2MotivationsWhy we did it …• Stay current on latest CC developments• Prepare for a new course on security requirements engineering• Determine effectiveness of learning-by-doing as applied to the CC• Meet sponsored program requirementsICCC 2006 3Project BackgroundICCC 2006 4Multilevel Print Server• Sponsor needs shared printing capability in multilevel environment• Use CC framework to establish security requirements for dedicated MPS– Draft PP based on CC Version 2.2 – Masters thesis• TOE description• Threats (16), assumptions (8), OSPs (6)• Security objectives – TOE (24), IT environment (9)• SFRs – TOE (9 Classes),  IT environment (1 Class)• SARs – EAL4 with augmentation– Draft PP lacks• Traceability analysis & rationale description ICCC 2006 5TOE DescriptionDedicated Printer Networked PrinterMultilevel print serverSecurity EnvironmentSingle-level clients MLS Print Server    Handle print jobs of different sensitivity levelsUtilize Separation Kernel technology Single-level clients Sensitivity levels determined by attached interface  Printers Located on system high network, physically protectedICCC 2006 6TOE  Components Trusted base Hardware, Separation Kernel Trusted partitions Runtime (TSF) MLS Services, System High ServicesInitialization Single-level partitions Print spoolers, one per input portPrint SpoolerPrint SpoolerSeparation KernelMLS ServicesSystem High ServicesInitHardware BaseMPS Config.DataS.K.Config.DataICCC 2006 7CC Version 2.2 Æ CC Version 3.0ICCC 2006 8Objectives, Approach & ProgressObjectives• Complete translation of SFRs• Partial translation of SARs• Provide hands-on experience for team member unfamiliar with CCApproach• “Rote port” -- Focus only on requirements• Supervised practice• Weekly assessmentProgress• First pass only – translated requirements still sketchy• Stopped early due to CC V3.1 newsICCC 2006 9Security Functional RequirementsCC Version 2.2ICCC 2006 10Translation of FAUSummaryV2.2 V3.0FAU_ARP Æ FAU_ARPFAU_GEN Æ FAU_GENFAU_SAA Æ FAU_SAAFAU_SAR Æ FDP_ACC, FAU_SAR_EXPFAU_SEL Æ FDP_ACC, FAU_SEL_EXPFAU_STG Æ FDP_ACC, FAU_STG_EXP FAU_ARP, FAU_GEN, FAU_SAA– Translation was straightforward  FAU_SAR, FAU_SEL, FAU_STG– Required more work– Used FDP_ACC to control ability to review data, select auditable events, protect audit trail– Defined extended components for specific security functionsICCC 2006 11Translation of FAUSample ComponentsFAU_SAR.1.1:  The TSF shall provide the security administrator with the capability to read all audit information from the audit recordsFAU_SAR.1.2:  Refinement:  The TSF shall provide the audit records in a manner suitable for the security administrator to interpret the information using a tool to access the audit trail.FDP_ACC.1.1:  Access control for audit reviewThe TSF shall allow an operation of a subject on an object if and only if all of the following hold:a)  The role attribute of the subject is security. b)  The type of the object is audit record in the audit trail.c)  The subject has read access to the object.FAU_SAR_EXP.1.1:  Security audit review supportThe TSF shall provide the audit records in a form suitable for the subject with the role attribute of security administrator to interpret the information.ICCC 2006 12Translation of FDPSummaryV2.2 V3.0FDP_ETC Æ FCO_ETCFDP_ITC Æ FCO_ITCFDP_IFC Æ FDP_ACCFDP_IFF Æ FDP_ISAFDP_RIP Æ FPT_RIPChallenges with FDP_IFC and FDP_IFF translation Separation Kernel enforces both information flow and MAC policies– Kernel configuration data defines policies MLS Services enforces MAC supporting policy for print job labeling– Map sensitivity level of jobs based on level of spooler partition– Label jobs with human readable markingsICCC 2006 13Translation of FIASummaryV2.2 V3.0FIA_AFL Æ FIA_AFL, FIA_UREFIA_ATD Æ FDP_ISAFIA_SOS Æ FIA_QADFIA_UID Æ FIA_UIDFIA_UAU Æ FIA_UAUFIA_USB Æ FIA_USB Mostly straight forward translation A lesson on indirect dependencies – E.g., FIA_AFL indirectly depends on FIA_URE because of FIA_UAU Dependency tables in Annex A were utilized– Per-class tables in V3.0 are easier to useICCC 2006 14Translation of FMTSummaryV2.2 V3.0FMT_MOF Æ FDP_ACCFMT_MSA Æ FDP_MSAFMT_MTD Æ FDP_ACC, FDP_MSA, FPT_RSAFMT_SAE Æ FDP_ACC, FDP_MSAFMT_SMF Æ FDP_ACC, FDP_MSAFMT_SMR Æ FDP_ACC, FDP_MSA, FIA_USB No FMT in V3.0 -- Most dreaded part of the exercise General mapping rules– Use FDP_ACC for restricting ability to perform certain function– Use FDP_MSA for managing functions related to security attributes FMT_MTD, FMT_SMR require other familiesICCC 2006 15Translation of FMTSample Components (1)FMT_MTD.2.1:  The TSF shall restrict the specification of the limits for print jobs sent to the printer to the security administrator.FDP_ACC.1.3:  Management of print job limitsThe TSF shall allow an operation of a subject on an object if and only if all of the following hold:a) The role attribute of the subject is security administrator.b) The type of the object is print job.c) The operation is to specify the limits for print jobs sent to the printer.FDP_MSA.1.3:  Management of print job limitsThe TSF shall determine if a subject is allowed to change the limits of print jobs sent to the printer or not, as follows:a) The role attribute of the subject is security administrator.b) The values of the new print job limits are valid.  ICCC 2006 16Translation of FMTSample Components (2)FMT_MTD.2.2:  The TSF shall take the following actions, if the TSF data are at or exceed, the indicated limits:  <list of actions>FPT_RSA.1:  Resource allocation (print job limits)FTP_RSA.1.1:   The TSF shall enforce maximum quotas for print jobs that a subject can use over a specified period of time.FPT_RSA.1.2:   The TSF shall take the following actions when a maximum quotum for  print jobs is surpassed:  <list of actions>ICCC 2006 17Assurance RequirementsICCC 2006 18Security Assurance RequirementsCC Version 2.2• Base requirements for EAL 4• Extended requirements include– Flaw remediation procedures– Assurance maintenance plan– Administrative guidance regarding proper setting of configuration data• MAC enforcement:  SK configuration data• MAC supporting:  MPS configuration data– Administrative guidance regarding proper handling of printed materialICCC 2006 19SARs for V3.0• No specific translation– Project stopped before getting to SARs• V3.0 ADV requirements were reviewed for a different project (SKPP)– Provided comments to US scheme• TOE relies on evaluated separation kernel– Composition challenge: Allocation of mandatory and supporting policies among TOE components• US Precedent PD-0117 facilitated several decisions in original PP• Class ACO is not as expected– Only address composition of evaluated TOEsICCC 2006 20Observations and ConclusionICCC 2006 21Observations• Validated general assessments of CC V3.0 – New functional paradigm not ready for general use– Difficult to express TOE security behavior– Correct usage of FDP_ACC was difficult to determine• Ordering of classes/families was hard to navigate if not already familiar with CC• “V3.0 transition” document was helpful– Example of translated PP/ST would be betterICCC 2006 22Other Observations• Team lost momentum/interest after CC V3.1 news– Part 2 is back to V2.3 with minor changes• Project took longer than expected– Conducted as a teaching exercise– Steep learning curve for novice team member– Worked as time allowed  Æ high overhead revving up• 20/20 hindsight: high-level translation might be better than rote• Cyclical learning-by-doing methodology was effective Task definitionTeam explorationReflection on experienceICCC 2006 23Conclusion• 3 out of 4 objectives met√ Stay current on latest CC developments √ Prepare for a new course on security requirements engineering√ Determine effectiveness of learning-by-doing as applied to the CC• Future work to meet sponsored program requirements– Full CC V3.1 migration under considerationICCC 2006 24ContactsThuy D. NguyenCenter for Information Systems Security Studies and Researchhttp://cisr.nps.eduDepartment of Computer ScienceNaval Postgraduate SchoolMonterey, California, USAtdnguyen@nps.edu

An Experiment with CC Version 3.0 Migration

http://calhoun.nps.edu/bitstream/handle/10945/49155/2006_report_mps.pdf?sequence=1&isAllowed=y

An Experiment with CC Version 3.0 Migration

Abstract

Similar works

Full text

Available Versions

Calhoun, Institutional Archive of the Naval Postgraduate School