untitled

Size: px

Start display at page:

Download "untitled"

釜绘韶
5 years ago
Views:

1 CC CISSP CC CC CC CEM CEM 1

2 2

3 1 ISO ISO/IDC JTC1/SC27 ISO/TC68 IEC ISO JTC1 ITU CCITT ISO X.400 X.500 InternetIETF IETFInternet RFC 2 ECMA ISO ANSI 80 FIPS FIPS NISTFIPS NIST DES IEEE IEEELAN/WANSILS P1363 DODDI DOD STD 3

4 GB ISO GB17859 ISO GB/T9387-2, ISO 2 CC ISO15408 GB/T18336, CC SSE-CMM ISO/IEC DIS IATF NSA1993 NSA Information Assurance Technical Framework BS7799 Part1 ISO17799 BSIISMS ISO/IEC TR IT GMITS 5 4

5 Trusted Computer System Evaluation Criteria TCSEC U.S. Department of Defense STD 1985 Trusted Network Interpretation TNI 1987 Information Technology Security Evaluation Criteria ITSEC 1991 Canadian Trusted Computer Product Evaluation Criteria CTCPEC 1993 Federal Criteria FC 1993 Common Criteria CC Version 2 (Finalized 1998), ISO TCSEC 1985 Trusted Computing Base TCB 4 4 7D C1 C2 B1 B2 B3 A TCSECB Bell & LaPadula NCSC

6 TCSEC D Minimal Protection DOS Windows3x Windows9x C Discretionary Access Policy Enforced C1 C2 C1 C2 Unix WindowsNT Novell3.x B Mandatory Access Policy Enforced B1 B2 TCB DAC MAC B3 TCB A Formally Proven Security A1 GB TCSECD A1 5 TCB TCB TCBTCB 6

7 ITSEC 1991ITSEC AC ITSEC Functionality F1 F10F1 F5 C1 B3 European Assurance E0 E6 ITSEC ST ITSEC ITSEC CC CC CC CEM CEM 7

8 8 CC CC CC CC CC CC 1985 TCSEC 1991 ITSEC 1993 CTCPEC 1993 FC 1996 CC v CC v CC ISO/IEC CC GB/T

9 CC CC IT CCISO IT CC CC CC CIA 9

10 CC CC CC PP CEM CC CC Part 1 IT PP ST Part 2 Functional Functional Classes Classes Functional Functional Families Families Functional Functional Components Components Part 3 Assurance Assurance Classes Classes Assurance Assurance Families Families Assurance Assurance Components Components 10

11 CC CC CC CEM CEM 11

12 CC Functional Requirements IT: Assurance Requirements : CC 1 Target of Evaluation TOE Protection Profile PP Security Target ST STTOE TOE ST TOE PP STTOE ST ITSEC ST for Oracle v7 12

13 CC 2 TOE Security Policy TSP TOE TOE Security Functions TSF TSP TOE Component PP ST CC _. Package PP ST CC Family Class Family PP/ST/ TSP TSP TOE TOE Security Security Policy Policy SFP SFP SFP Security Function Policies Security Function Policies SF SF SF Security Security Function Function TSF TSF TSF TOE TOE Security Security Function Function 13

14 PP PP ISO/IEC Standard Protection Profiles Access Control Identification Authentication Audit Cryptography Operating Systems Database Systems Firewalls Smart Cards Applications Biometrics Routers VPNs IT IT IT IT Protection Profile Security Targets Firewall Security Requirements Security Features and Assurances CISCO Firewall Lucent Firewall Checkpoint Firewall Network Assoc. FW IT IT IT IT 14

15 PP ST ST TOE Protection Profile (PP) Security Target (ST) Design documents Target of of Evaluation (TOE) CC CC CC CEM CEM 15

16 CC-Part1 Part11 1 Scope 2 Definitions 3 Overview CCConsumers Developers Evaluators Others CC 4 General Model IT CC CC PP ST TOE 5 CC PP STTOE CC-Part1 Part12 A CC CCCCCC B PP PPPP TOE TOEIT C ST STST TOE TOEIT TOE PP D 16

17 17

18 18

19 PP PP 1.2 PP 2. TOE TOE IT 5.1 TOE 5.2 TOE 5.3 IT PP PP TOE TOE CC CC IT ST ST 1.2 ST 1.3 CC 2. TOE TOE IT 5.1 TOE 5.2 TOE 5.3 IT 6. TOE 6.1 TOE PP 7.2 PP 7.3 PP ST TOE ST TOE TOE CC CC IT IT IT 19

20 CC-Part2 Part21 1 Scope 2 Class Family ComponentComponent catalogue 3 Class FAU Security Audit 6 FAU_ARP FAU_GEN FAU_SAA FAU_SAR FAU_SEL FAU_STG 4 Class FCO Communication 2FCO_NROFCO_NRR 5 Class FCS Cryptographic support 2 FCS_CKM FCS_COP CC-Part2 Part22 6 Class FDP User data protection 13 FDP_ACC FDP_ACF FDP_DAU TSF FDP_ETCFDP_IFCFDP_IFF TSF FDP_ITCTOE FDP_ITT FDP_RIP FDP_ROL FDP_SDITSFFDP_UCTTSF FDP_UIT 7 Class FIA Identification and authentication TSF FMT_MOF FMT_MSATSF FMT_MTD FMT_REV FMT_SAE FMT_SMR 8 Class FMT Security Management 6 FAU_ARP FAU_GEN FAU_SAA FAU_SAR FAU_SEL FAU_STG 20

21 CC-Part2 Part23 9 Class FPR Privacy 4 FPR_ANO FPR_PSEFPR_UNL FPR_UNO 10 Class FPT Protection of the TSF FPT_AMT FPT_FLSTSF FPT_ITATSF FPT_ITCTSF FPT_ITITOE TSF FPT_ITTTSF FPT_PHP FPT_RCV FPT_RPL FPT_RVMFPT_SEP FPT_SSPFPT_STMTSF TSF FPT_TDCTOE TSF FPT_TRCTSF FPT_TST 11 Class FRU Resource utilisation 3 FRU_FLTFRU_PRS FRU_RSA CC-Part2 Part24 12 Class FTA TOE access 6 FTA_LSA (FTA_MCS) FTA_SSL TOE FTA_TABTOE (FTA_TAH) TOE (FTA_TSE) 13 Class FTP Trusted path/channels TSFFTP_ITC FTP_TRP A B 11 M 21

22 Class _.. Family Family Family CC-Part3 Part31 1 Scope 2 Class Family Component EAL PP ST 3 PP ST PP ST TOETOEPP ST TOE PP ST TOE PP ST 4 Class APE Protection Profile evaluation PP TOE 5 Class ASE Security Target evaluation TOE PPTOE 22

23 CC-Part3 Part32 6 Evaluation Assurance Levels EAL CCCC 7 7 7TOE TOE 8 Class ACM Configuration Management TOETOE TOE 3ACM_AUT ACM_CAP ACM_SCP 9 Class ADO Delivery and Operation TOETOE 2 ADO_DEL ADO_IGS CC-Part3 Part33 10 Class ADV Development STTOETOE TSF 7 ADV_FSP ADV_HLD ADV_IMPTSF ADV_INT ADV_LLDADV_RCR ADV_SPM 11 Class AGD Guidance documents 2AGD_ADM AGD_USR 12 Class ALC Life cycle support TOE TOE 4 ALC_DVS ALC_FLR ALC_LCD ALC_TAT 23

24 CC-Part3 Part34 13 Class ATE Tests TOE 4 ATE_COV ATE_DPT ATE_FUN ATE_IND 14 Class AVA Vulnerability assessment TOE 3 AVA_CCA AVA_MSUTOE AVA_SOF 15 Assurance maintenance paradigm TOE TOE CCAMA CC-Part3 Part35 16 Class AMA Maintenance of assurance TOECCTOE 4 AMA_AMPTOE AMA_CAT AMA_EVD AMA_SIA A B EALs 24

25 25 EAL EAL EAL EAL EAL1 EAL1 EAL2 EAL2 EAL3 EAL3 EAL4 EAL4 EAL5 EAL5 EAL6 EAL6 EAL7 EAL7

26 EAL 1 EAL1 functionally tested TOE TOE EAL2 structurally tested EAL3 methodically tested and checked TOE EAL4 methodically designed, tested, and reviewed TOE TOE EAL 2 EAL5 semiformally designed and tested EAL6 semiformally verified design and tested EAL7 formally verified design and tested TOE TOE TOE 26

27 CC CC EAL EAL - T-7 - - - E6 T-6 T-7 A1 EAL7 E5 T-5 T-6 B3 EAL6 E4 T-4 T-5 B2 EAL5 - - T-4 - - - T-3

27 27 CC CC EAL EAL - T E6 T-6 T-7 A1 EAL7 E5 T-5 T-6 B3 EAL6 E4 T-4 T-5 B2 EAL5 - - T T-3 T E3 T-2 T-2 B1 EAL4 E2 T-1 T-1 C2 EAL3 E1 - - C1 EAL D EAL1 ITSEC CTCPEC FC TCSEC GB17859 CC

28 28 PP ST 1 PP ST PP ST TOE TOE 7 TOE 1 TOECC TOE CC CC CC 2 C1 C2 C3 Cn C1 C2 C3 Cn PP ST CC 3 C1 C2 C3 Cn C1 C2 C3 Cn n CC PP TOE ST TOE PP PP CC CC ST PP

29 CC CC CC CEM CEM CC CEM / / 29

30 TOE PP ST ST TOE 30

31 TOE CC CC CC CEM CEM 31

32 CEM Common Evaluation Methodology CEM CC CEM CEM CEM PP IT CEM PPPP TOE CEM PP ST TOE CEM TOE CC CEM CC CEM TOE PP 32

33 33 CC CEM PP ST ST PP

34 CC CC CC CEM CEM 34

35 Q&A 35

ISO Internet IAB IETFIRTFRFC RFC ANSI 4 NIST FIPS PUBSPEC PUBDESFIPS PUB CCEESFPKIGKMIAES 5 DoDNCSC TCSECRainb

ISO Internet IAB IETFIRTFRFC RFC ANSI 4 NIST FIPS PUBSPEC PUBDESFIPS PUB CCEESFPKIGKMIAES 5 DoDNCSC TCSECRainb TCSECGB 17859 ISO 15408GB/T 18336 DB11/T 171 1 1 2 3 4 5 1 1 ISO 5000 2Internet IAB IETFIRTFRFC1421-1424RFC1510 3 ANSI 4 NIST FIPS PUBSPEC PUBDESFIPS PUB 140-1 CCEESFPKIGKMIAES 5 DoDNCSC TCSECRainbow 6