Hewlett-Packard LaserJet Enterprise MFP M525,
M725, and M830 Series and Color LaserJet
Enterprise MFP M575, M775, and M880 Series
Firmware with Jetdirect Inside Security Target
2.0
Version:
Final
Status:
2014-06-05
Last Update:
Trademarks
The following term is a trademark of Adobe Systems Incorporated in the United States, other
countries, or both:
● Adobe®
The following term is a trademark of atsec information security corporation in the United States,
other countries, or both:
● atsec®
The following terms are trademarks of The Institute of Electrical and Electronics Engineers,
Incorporated in the United States, other countries, or both:
● 2600.2™
● IEEE®
The following term is a trademark of Massachusetts Institute of Technology (MIT) in the United
States, other countries, or both:
● Kerberos™
The following terms are trademarks of Microsoft Corporation in the United States, other countries,
or both:
● Microsoft®
● SharePoint®
● Windows®
The following term is a trademark of SafeNet, Inc. in the United States, other countries, or both:
● SafeNet®
Legal Notice
This document is provided AS IS with no express or implied warranties. Use the information in this
document at your own risk.
This document may be reproduced or distributed in any form without prior permission provided the
copyright notice is retained on all copies. Modified versions of this document may be freely distributed
provided that they are clearly identified as such, and this copyright is included intact.
Revision History
Changes to Previous Revision
Author(s)
Date
Revision
MFP ST.
Scott Chapman,
atsec
2014-06-05
2.0
Page 2 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Table of Contents
1 Introduction .................................................................................................... 9
1.1 Security Target Identification ......................................................................................... 9
1.2 TOE Identification .......................................................................................................... 9
1.3 TOE Type ....................................................................................................................... 9
1.4 TOE Overview ................................................................................................................ 9
1.4.1 Required and optional non-TOE hardware, software, and firmware .................... 10
1.4.2 Intended method of use ...................................................................................... 11
1.5 TOE Description ........................................................................................................... 12
1.5.1 TOE architecture ................................................................................................. 12
1.5.2 TOE security functionality (TSF) summary .......................................................... 18
1.5.2.1 Auditing ...................................................................................................... 18
1.5.2.2 Cryptography ............................................................................................. 18
1.5.2.3 Identification and authentication ................................................................ 18
1.5.2.4 Data protection and access control ............................................................ 19
1.5.2.5 Protection of the TSF .................................................................................. 21
1.5.2.6 TOE access protection ................................................................................ 22
1.5.2.7 Trusted channel communication and certificate management .................. 22
1.5.2.8 User and access management ................................................................... 22
1.5.3 TOE boundaries ................................................................................................... 22
1.5.3.1 Physical ...................................................................................................... 22
1.5.3.2 Logical ........................................................................................................ 23
1.5.3.3 Evaluated configuration ............................................................................. 23
1.5.4 Security policy model .......................................................................................... 24
1.5.4.1 Subjects/Users ............................................................................................ 24
1.5.4.2 Objects ....................................................................................................... 25
1.5.4.3 SFR package functions ............................................................................... 28
1.5.4.4 SFR package attributes .............................................................................. 28
2 CC Conformance Claim ................................................................................... 30
2.1 Protection Profile tailoring and additions ..................................................................... 30
2.1.1 IEEE Std 2600.2-2009; "2600.2-PP, Protection Profile for Hardcopy Devices,
Operational Environment B" (with NIAP CCEVS Policy Letter #20) ([PP2600.2]) ........... 30
2.1.2 SFR Package for Hardcopy Device Copy Functions ([PP2600.2-CPY]) ................. 34
2.1.3 SFR Package for Hardcopy Device Document Storage and Retrieval (DSR) Functions
([PP2600.2-DSR]) ........................................................................................................... 34
2.1.4 SFR Package for Hardcopy Device Fax Functions ([PP2600.2-FAX]) ................... 35
2.1.5 SFR Package for Hardcopy Device Print Functions ([PP2600.2-PRT]) .................. 35
2.1.6 SFR Package for Hardcopy Device Scan Functions ([PP2600.2-SCN]) ................. 35
2.1.7 SFR Package for Hardcopy Device Shared-medium Interface Functions
([PP2600.2-SMI]) ............................................................................................................ 35
3 Security Problem Definition ............................................................................ 37
3.1 Introduction ................................................................................................................. 37
3.2 Threat Environment ..................................................................................................... 37
Page 3 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
3.2.1 Threats countered by the TOE ............................................................................ 37
3.3 Assumptions ................................................................................................................ 38
3.3.1 Environment of use of the TOE ........................................................................... 38
3.3.1.1 Physical ...................................................................................................... 38
3.3.1.2 Personnel .................................................................................................... 38
3.3.1.3 Connectivity ............................................................................................... 38
3.4 Organizational Security Policies ................................................................................... 39
3.4.1 Included in the PP2600.2 protection profile ........................................................ 39
3.4.2 In addition to the PP2600.2 protection profile ..................................................... 39
4 Security Objectives ........................................................................................ 40
4.1 Objectives for the TOE ................................................................................................. 40
4.2 Objectives for the Operational Environment ................................................................ 40
4.3 Security Objectives Rationale ...................................................................................... 42
4.3.1 Coverage ............................................................................................................. 42
4.3.2 Sufficiency ........................................................................................................... 44
5 Extended Components Definition .................................................................... 50
5.1 Class FPT: Protection of the TSF .................................................................................. 50
5.1.1 Restricted forwarding of data to external interfaces (FDI) .................................. 50
5.1.1.1 FPT_FDI_EXP.1 - Restricted forwarding of data to external interfaces ........ 50
6 Security Requirements ................................................................................... 51
6.1 TOE Security Functional Requirements ........................................................................ 51
6.1.1 Security audit (FAU) ............................................................................................ 53
6.1.1.1 Audit data generation (FAU_GEN.1) .......................................................... 53
6.1.1.2 User identity association (FAU_GEN.2) ...................................................... 53
6.1.2 Cryptographic support (FCS) ............................................................................... 54
6.1.2.1 Cryptographic key generation (FCS_CKM.1) .............................................. 54
6.1.2.2 Cryptographic key distribution (FCS_CKM.2) ............................................. 54
6.1.2.3 Cryptographic operation (FCS_COP.1-ipsec) .............................................. 55
6.1.2.4 Cryptographic operation (FCS_COP.1-job) ................................................. 55
6.1.3 User data protection (FDP) .................................................................................. 56
6.1.3.1 Common access control SFP (FDP_ACC.1-cac) .......................................... 56
6.1.3.2 TOE function access control SFP (FDP_ACC.1-tfac) .................................... 58
6.1.3.3 Common access control functions (FDP_ACF.1-cac) .................................. 58
6.1.3.4 TOE function access control functions (FDP_ACF.1-tfac) ........................... 58
6.1.3.5 Subset residual information protection (FDP_RIP.1) .................................. 59
6.1.4 Identification and authentication (FIA) ................................................................ 59
6.1.4.1 Local user attribute definition (FIA_ATD.1) ................................................ 59
6.1.4.2 Verification of secrets (FIA_SOS.1) ............................................................ 59
6.1.4.3 Timing of Control Panel authentication (FIA_UAU.1) .................................. 59
6.1.4.4 IPsec authentication before any action (FIA_UAU.2) .................................. 60
6.1.4.5 Control Panel protected authentication feedback (FIA_UAU.7) .................. 60
6.1.4.6 Timing of Control Panel identification (FIA_UID.1) ..................................... 60
6.1.4.7 IPsec identification before any action (FIA_UID.2) ..................................... 60
6.1.4.8 User-subject binding (FIA_USB.1) .............................................................. 60
Page 4 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
6.1.5 Security management (FMT) ............................................................................... 61
6.1.5.1 Management of authentication security functions behavior (FMT_MOF.1-auth)
................................................................................................................................. 61
6.1.5.2 Management of Fax Forward and Fax Archive security functions behavior
(FMT_MOF.1-faxforward) ......................................................................................... 61
6.1.5.3 Management of Permission Set security attributes (FMT_MSA.1-perm) .... 61
6.1.5.4 Management of TOE function security attributes (FMT_MSA.1-tfac) .......... 61
6.1.5.5 Management of TSF data (FMT_MTD.1-auth) ............................................. 61
6.1.5.6 Management of TSF data (FMT_MTD.1-users) ........................................... 61
6.1.5.7 Specification of management functions (FMT_SMF.1) ............................... 62
6.1.5.8 Security roles (FMT_SMR.1) ....................................................................... 62
6.1.6 Protection of the TSF (FPT) .................................................................................. 62
6.1.6.1 Restricted forwarding of data to external interfaces (FPT_FDI_EXP.1) ...... 62
6.1.6.2 Reliable time stamps (FPT_STM.1) ............................................................. 62
6.1.6.3 TSF testing (FPT_TST.1) ............................................................................. 62
6.1.7 TOE access (FTA) ................................................................................................ 63
6.1.7.1 Control Panel TSF-initiated termination (FTA_SSL.3) ................................. 63
6.1.8 Trusted path/channels (FTP) ............................................................................... 63
6.1.8.1 Inter-TSF trusted channel (FTP_ITC.1) ....................................................... 63
6.2 Security Functional Requirements Rationale ............................................................... 63
6.2.1 Coverage ............................................................................................................. 63
6.2.2 Sufficiency ........................................................................................................... 66
6.2.3 Security requirements dependency analysis ...................................................... 71
6.2.4 Internal consistency and mutual support of SFRs ............................................... 74
6.3 Security Assurance Requirements ............................................................................... 74
6.4 Security Assurance Requirements Rationale ............................................................... 75
7 TOE Summary Specification ............................................................................ 76
7.1 TOE Security Functionality ........................................................................................... 76
7.1.1 Auditing ............................................................................................................... 76
7.1.2 Cryptography ...................................................................................................... 76
7.1.3 Identification and authentication (I&A) ............................................................... 77
7.1.3.1 Control Panel I&A ....................................................................................... 77
7.1.3.2 IPsec I&A .................................................................................................... 78
7.1.4 Data protection and access control ..................................................................... 79
7.1.4.1 Permission Sets .......................................................................................... 79
7.1.4.2 Job PINs ...................................................................................................... 80
7.1.4.3 Job Encryption Passwords ........................................................................... 80
7.1.4.4 Common access control ............................................................................. 80
7.1.4.5 TOE function access control ....................................................................... 81
7.1.4.6 Residual information protection ................................................................. 82
7.1.5 Protection of the TSF ........................................................................................... 82
7.1.5.1 Restricted forwarding of data to external interfaces (including fax
separation) ............................................................................................................... 82
7.1.5.2 TSF self-testing ........................................................................................... 82
7.1.5.3 Reliable timestamps ................................................................................... 83
Page 5 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
7.1.6 TOE access protection ......................................................................................... 83
7.1.6.1 Inactivity timeout ....................................................................................... 83
7.1.6.2 Automatic logout ........................................................................................ 83
7.1.7 Trusted channel communication and certificate management ........................... 83
7.1.8 User and access management ............................................................................ 85
8 Abbreviations, Terminology and References .................................................... 87
8.1 Abbreviations ............................................................................................................... 87
8.2 Terminology ................................................................................................................. 89
8.3 References ................................................................................................................... 90
Page 6 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
List of Tables
Table 1: TOE Reference ........................................................................................................ 10
Table 2: IPsec user mappings to allowed network protocols ................................................ 19
Table 3: Users ....................................................................................................................... 24
Table 4: User Data ................................................................................................................ 26
Table 5: TSF Data ................................................................................................................. 27
Table 6: TSF Data Listing ...................................................................................................... 27
Table 7: SFR package functions ............................................................................................ 28
Table 8: SFR package attributes ........................................................................................... 28
Table 9: SFR mappings between 2600.2 and the ST ............................................................ 31
Table 10: SFR mappings of non-PP2600.2 SFRs and the ST (in the ST, but not required by or
hierarchical to SFRs in PP2600.2) ................................................................................... 33
Table 11: SFR mappings between 2600.2-CPY and the ST ................................................... 34
Table 12: SFR mappings between 2600.2-DSR and the ST .................................................. 34
Table 13: SFR mappings between 2600.2-FAX and the ST ................................................... 35
Table 14: SFR mappings between 2600.2-PRT and the ST ................................................... 35
Table 15: SFR mappings between 2600.2-SCN and the ST .................................................. 35
Table 16: SFR mappings between 2600.2-SMI and the ST ................................................... 36
Table 17: Mapping of security objectives to threats and policies ......................................... 42
Table 18: Mapping of security objectives for the Operational Environment to assumptions,
threats and policies ........................................................................................................ 43
Table 19: Sufficiency of objectives countering threats ......................................................... 44
Table 20: Sufficiency of objectives holding assumptions ..................................................... 45
Table 21: Sufficiency of objectives enforcing Organizational Security Policies .................... 48
Table 22: Security functional requirements for the TOE ....................................................... 51
Table 23: Auditable events ................................................................................................... 53
Table 24: Cryptographic key generation .............................................................................. 54
Table 25: Cryptographic key distribution ............................................................................. 54
Table 26: Cryptographic operations ..................................................................................... 55
Table 27: Cryptographic operations ..................................................................................... 55
Table 28: Common Access Control SFP ................................................................................ 56
Table 29: Mapping of security functional requirements to security objectives ..................... 63
Table 30: Security objectives for the TOE rationale ............................................................. 66
Table 31: TOE SFR dependency analysis .............................................................................. 71
Table 32: Security assurance requirements ......................................................................... 74
Table 33: Trusted channel connections ................................................................................ 84
Page 7 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
List of Figures
Figure 1: HCD physical diagram ........................................................................................... 13
Figure 2: HCD logical diagram .............................................................................................. 17
Page 8 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
1 Introduction
1.1 Security Target Identification
Hewlett-Packard LaserJet Enterprise MFP M525, M725, and M830 Series and
Color LaserJet Enterprise MFP M575, M775, and M880 Series Firmware with
Jetdirect Inside Security Target
Title:
2.0
Version:
Final
Status:
2014-06-05
Date:
Hewlett-Packard Development Company, L.P.
Sponsor:
Hewlett-Packard Development Company, L.P.
Developer:
CSEC
Certification Body:
CSEC2014001
Certification ID:
Hewlett-Packard, HP, Color LaserJet, LaserJet, CM525, M575, M727, M775,
M830, M880, multifunction printer, MFP, hardcopy device, HCD, Printer, Jetdirect
Inside, separation of analog fax from network.
Keywords:
1.2 TOE Identification
The TOE is the Hewlett-Packard LaserJet Enterprise MFP M525, M725, and M830 Series and Color
LaserJet Enterprise MFP M575, M775, and M880 Series Firmware with Jetdirect Inside.
1.3 TOE Type
The TOE type is the internal firmware providing the functionality of a multifunction printer (MFP,
e.g., fax, copier, printer, scanner).
1.4 TOE Overview
The Hewlett-Packard LaserJet Enterprise MFPs are enterprise network multifunction products
designed to be shared by many client computers and users. These products are designed to meet
the requirements of the [PP2600.2] protection profile in conjunction with [CCEVS-PL20] in the
environment defined by these two documents (the Policy Letter modifies the requirements and
environment).
MFPs contain functions for the copying, faxing, printing, and scanning of documents. These hardcopy
devices (HCDs), as they are called in [PP2600.2], are self-contained units that include processors,
memory, networking, a storage drive, an image scanner, and a print engine. The operating system,
two web servers, and Control Panel applications (i.e., applications that run internally on the HCD)
reside within the firmware of the HCD.
The TOE is the contents of the firmware with the exception of the operating system and the QuickSec
cryptographic library (used by IPsec), which are part of the Operational Environment.
The MFP models for which the firmware is evaluated are listed in the following table along with the
evaluated firmware version numbers for each model:
Page 9 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
TOE Firmware Version
MFP (HCD) Model
MFP Firmware version: 2302243_421977
Jetdirect Inside version: JDI23200024
HP LaserJet Enterprise MFP M525 Series
(M525dn w/optional fax, M525f, flow M525c)
MFP Firmware version: 2302243_421976
Jetdirect Inside version: JDI23200024
HP Color LaserJet Enterprise MFP M575 Series
(M575dn w/optional fax, M575f, flow M575c)
MFP Firmware version: 2302243_421973
Jetdirect Inside version: JDI23200024
HP LaserJet Enterprise MFP M725 Series
(M725dn w/optional fax, M725f, M725z, M725z+)
MFP Firmware version: 2302243_421975
Jetdirect Inside version: JDI23200024
HP Color Enterprise LaserJet MFP M775 Series
(M775dn w/optional fax, M775f, M775z, M775z+)
MFP Firmware version: 2302243_421971
Jetdirect Inside version: JDI23200024
HP LaserJet Enterprise flow MFP M830 Series
(M830z, M830z w/NFC & Wireless Direct)
MFP Firmware version: 2302243_421966
Jetdirect Inside version: JDI23200024
HP Color LaserJet Enterprise flow MFP M880 Series
(M880z, M880z+ w/NFC & Wireless Direct)
Table 1: TOE Reference
Each model provides the following security features:
● Auditing
● Cryptography
● Identification and authentication
● Data protection and access control
● Protection of the TSF (restricted forwarding, TSF self-testing, timestamps)
● TOE access protection (inactivity timeout and automatic logout)
● Trusted channel communication and certificate management
● User and access management
1.4.1 Required and optional non-TOE hardware, software, and
firmware
The following required firmware components are considered part of the Operational Environment:
● Operating system (included in the firmware)
● QuickSec cryptographic library module (included in the firmware)
The hardware portion of the HP MFP models is considered part of the Operational Environment. The
TOE is evaluated on all of the HP MFP models defined in Table 1 and requires one of these models
in order to run in the evaluated configuration.
The following required components are part of the Operational Environment:
● DNS server
● NTP server
● Syslog server
● WINS server
Page 10 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
● One administrative client computer network connected to the TOE in the role of an
Administrative Computer
The following optional components are part of the Operational Environment:
● HP Print Drivers, including the HP Universal Print Driver, for client computers (for submitting
print job requests from client computers)
● HP Web Jetadmin administrative tool
● Windows domain controller/Kerberos server
● LDAP server
● Client computers network connected to the TOE in a non-administrative computer role
● Remote file systems:
❍ CIFS
❍ FTP
● Microsoft SharePoint (useful with flow models only)
● SMTP gateway
● Web browser
It is recommended that the HP High Performance Secure Hard Disk be used in conjunction with the
TOE, but since the disk is part of the Operational Environment, the disk's security functionality is
not included in this evaluation.
1.4.2 Intended method of use
[PP2600.2] is defined for a commercial information processing environment in which a moderate
level of document security, network security, and security assurance are required.
The TOE is intended to be used in non-hostile, networked environments where TOE users have
direct physical access to the HCDs for copying, faxing, printing, and scanning. The physical
environment should be reasonably controlled and/or monitored where physical tampering of the
HCDs would be evident and noticed.
The TOE can be connected to multiple client computers via a local area network using HP's Jetdirect
Inside in the evaluated configuration. The evaluated configuration uses secure network mechanisms
for communication between the network computers and the TOE. The TOE is managed by one
designated administrative computer. The TOE is not intended be connected to the Internet.
Analog fax phone lines can be connected to the TOE in the evaluated configuration for sending and
receiving faxes.
The evaluated configuration contains a built-in user identification and authentication database
(a.k.a. sign in method) used for Local Device Sign In that is part of the TOE. It also supports a
Windows domain controller (via Kerberos) for a feature called Windows Sign In and a Lightweight
Directory Access Protocol (LDAP) authentication server for a feature called LDAP Sign In to identify
and authenticate users. The Windows domain controller and LDAP server are part of the Operational
Environment.
The evaluated configuration supports the optional HP Web Jetadmin administrative tool for managing
the TOE. This tool uses the Hypertext Transfer Protocol (HTTP), Hypertext Markup Language (HTML),
Simple Object Access Protocol (SOAP), Extensible Markup Language (XML), Open Extensibility
Platform device layer (OXPd) Web Services, WS-* Web Services, and Simple Network Management
Protocol (SNMP) to communicate to the TOE. (The Web Jetadmin administrative tool is part of the
Page 11 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Operational Environment.) The evaluated configuration also supports the Embedded Web Server
(EWS) interface for managing the TOE using a web browser over HTTP. (Web browsers are part of
the Operational Environment.)
The evaluated configuration supports remote file systems for storing scanned documents and faxes
remotely. In addition, the flow models, indicated in Table 1, support Microsoft SharePoint for sending
scanned documents. It also can receive encrypted jobs to protect the job contents while stored in
the TOE.
The Universal Serial Bus (USB) port is disabled in the evaluated configuration.
1.5 TOE Description
1.5.1 TOE architecture
As mentioned previously, the TOE is the firmware of an enterprise network multifunction printer
designed to be shared by many client computers and human users. It performs the functions of
copying, faxing, printing, and scanning of documents. It can be connected to a local network through
the embedded Jetdirect Inside's built-in Ethernet, to an analog phone line using its internal analog
fax modem, or to a USB device using its USB port (but the use of which must be disabled in the
evaluated configuration).
Page 12 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Figure 1: HCD physical diagram
Figure 1 shows a high-level physical diagram of an HCD with the unshaded areas representing the
TOE and the shaded areas indicating components that are part of the Operational Environment.
At the top of this figure is the Administrative Computer which connects to the TOE using Internet
Protocol Security (IPsec) with X.509v3 certificates for both mutual authentication and for protection
of data from disclosure and alteration. This computer can administer the TOE using the following
interfaces over the IPsec connection:
● Embedded Web Server (EWS)
Page 13 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
● Simple Network Management Protocol (SNMP)
● Web Services:
❍ Open Extensibility Platform device (OXPd) Web Services
❍ WS-* Web Services
The HTTP-based EWS administrative interface allows administrators to remotely manage the features
of the TOE using a web browser.
The Web Services allow administrators to manage the TOE using HP's Web Jetadmin application,
which is part of the Operational Environment. The TOE supports both HP's Open Extensibility Platform
device (OXPd) Web Services and certain WS-* Web Services (conforming to the WS-* standards
defined by w3.org) accessed via the Simple Object Access Protocol (SOAP) and Extensible Markup
Language (XML).
The SNMP network interface allows administrators to remotely manage the TOE using external
SNMP-based administrative applications like the HP Web Jetadmin administrative tool.
Printer Job Language (PJL) is used in a non-administrative capacity by the Administrative Computer.
The Administrative Computer uses PJL to send print jobs to the TOE as well as to receive job status.
In general, PJL supports password protected administrative commands, but in the evaluated
configuration these commands are disabled. For the purposes of this Security Target, we define
the PJL Interface as PJL data sent to port 9100.
The TOE protects all network communications with Internet Protocol Security (IPsec), which is part
of the embedded Jetdirect Inside firmware. Though IPsec supports multiple authentication methods,
in the evaluated configuration, both ends of the IPsec connection are authenticated using X.509v3
certificates. An identity certificate for the TOE must be created outside the TOE, signed by a
Certificate Authority (CA), and imported (added) into the TOE with the Certificate Authority's CA
certificate.
Because IPsec authenticates the computers (IPsec authenticates the computer itself; IPsec does
not authenticate the individual users of the computer), access to the Administrative Computer
should be restricted to TOE administrators only.
The TOE distinguishes between the Administrative Computer and Network Client Computers by
using IP addresses, IPsec, and the embedded Jetdirect Inside's internal firewall. In the evaluated
configuration, the number of Administrative Computers used to manage the TOE is limited to one
and the Device Administrator Password must be set.
The evaluated configuration supports the following SNMP versions:
● SNMPv1 read-only
● SNMPv2c read-only
● SNMPv3
Network Client Computers connect to the TOE using IPsec with X.509v3 certificates to protect the
communication and to mutually authenticate. These client computers can send print jobs to the
TOE using the PJL Interface as well as receive job status.
The TOE supports an optional analog telephone line connection for sending and receiving faxes.
The Control Panel uses identification and authentication to control access for sending analog faxes.
Because the fax protocol doesn't support authentication of incoming analog fax phone line users,
anyone can connect to the analog fax phone line (unless the number has been added to the Blocked
Fax Numbers list), but the only function an incoming fax phone line user can perform is to transmit
a fax to the TOE.
Page 14 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Some fax devices can hold a fax until another fax device requests that the fax be sent. Users can
use the Fax Polling Receive function of the TOE to retrieve faxes from other fax devices. This is
called a Fax Polling Receive job by this document. To perform this function, the user authenticates
via the Control Panel and initiates the function by entering the phone number of the other fax
device. The TOE will dial the other fax device and request the other fax device to transfer the held
fax to the TOE via the currently active phone connection. The TOE prints the fax as it receives it.
The TOE does not accept polling requests from other fax devices (i.e., the MFP models in this
evaluation do not contain the Fax Polling Send functionality).
The TOE protects stored jobs with either a 4-digit Job PIN or by accepting (and storing) an encrypted
job from a user computer. Both protection mechanisms are optional by default and are mutually
exclusive of each other if used. In the evaluated configuration, every job must either be assigned
a 4-digit Job PIN or be an encrypted job.
The TOE also supports Microsoft SharePoint (flow MFP models only) and remote file systems for the
storing of scanned documents. The TOE uses IPsec with X.509v3 certificates to protect the
communications and to mutually authenticate to SharePoint and the remote file systems. For remote
file system connectivity, the TOE supports the File Transfer Protocol (FTP) and the Common Internet
File System (CIFS) protocol. (SharePoint is HTTP-based.) The product is capable of encrypting stored
document files according to the Adobe PDF specification.
The TOE can be used to email scanned documents or received faxes. The TOE supports protected
communications between the TOE and Simple Mail Transfer Protocol (SMTP) gateways. It uses IPsec
with X.509v3 certificates to protect the communications and to mutual authenticate with the SMTP
gateway. The product is capable of encrypting email according to the S/MIME specification. The
TOE can only protect unencrypted email up to the SMTP gateway. It is the responsibility of the
Operational Environment to protect emails from the SMTP gateway to the email's destination. Also,
the TOE can only send emails; it does not accept inbound emails.
The TOE's Control Panel supports both local and remote sign in methods. The local sign in method
is called Local Device Sign In which supports individual user accounts. The user account information
is maintained in the Local Device Sign In database within the TOE. The remote sign in methods are
called LDAP Sign In and Windows Sign In (Kerberos). The TOE uses IPsec with X.509v3 certificates
to protect both the LDAP and Kerberos communications.
Each HCD contains a user interface called the Control Panel. The Control Panel consists of a touch
sensitive LCD screen, a physical power button, and a physical home screen button that are attached
to the HCD. In addition, the flow MFP models include a computer keyboard as part of the Control
Panel. The Control Panel is the physical interface that a user uses to communicate with the TOE
when physically using the HCD. The LCD screen displays information such as menus and status to
the user. It also provides virtual buttons to the user such as an alphanumeric keypad for entering
usernames and passwords. When a user signs in at the Control Panel, a Permission Set is associated
with their session which determines the functions the user is permitted to perform.
The Scanner is the part of the HCD that converts hardcopy documents into electronic format. The
Print Engine converts electronic format into hardcopy.
All MFP models contain a persistent storage drive (a.k.a. storage drive) that resides in the Operational
Environment. The storage drive contains a section called Job Storage which is a user-visible file
system where stored jobs such as certain types of fax jobs, certain types of print jobs, and certain
types of copy jobs are stored/held until deleted/released by a user, or depending on the job type,
deleted after a period of time or stored until the TOE is rebooted if no user action is taken.
Page 15 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
On many MFP models, this storage drive is an HP High Performance Secure Hard Disk that provides
hardware-based cryptography and persistent storage to securely manage sensitive print, copy,
scan, and fax data. Data on this drive is encrypted and the encryption key is locked to the device.
The cryptographic functionality is transparent to the TOE and to the user. Not all MFP models in
this evaluation support this drive. (The cryptographic operations performed by this drive are outside
the scope of this evaluation.)
The TOE supports the auditing of security relevant functions by generating and forwarding audit
records to a remote syslog server. The TOE uses IPsec with X.509v3 certificates to protect the
communications between the TOE and the syslog server and to mutually authenticate the TOE and
syslog server.
The Jetdirect Inside Firmware and HCD System Firmware components comprise the firmware on
the system. They are shown as two separate components but they both share the same operating
system (OS). The operating system is part of the Operational Environment. Both firmware
components also contain an Embedded Web Server (EWS).
The Jetdirect Inside firmware includes SNMP, IPsec, a firewall, and the management functions for
managing these network-related features. The Jetdirect Inside firmware also provides the network
stack and drivers controlling the TOE's Ethernet interface.
The HCD System Firmware controls the overall functions of the TOE from the Control Panel to the
storage drive to the print jobs.
Figure 2 shows the HCD boundary in grey and the firmware (TOE) boundary in blue (the TOE being
comprised of the HCD System firmware and the Jetdirect Inside firmware excluding the underlying
operating system and the QuickSec cryptographic library). The Jetdirect Inside firmware provides
the network connectivity and network device drivers used by the HCD System firmware. The HCD
System firmware and Jetdirect Inside firmware share the same operating system (which is part of
the Operational Environment). The HCD System firmware also includes internal Control Panel
applications that drive the functions of the TOE. Both firmware components work together to provide
the security functionality defined in this document for the TOE. (PSTN is an abbreviation for Public
Switched Telephone Network.)
One final note. The TOE's guidance documentation includes topics on role-based access control
(RBAC). Because [PP2600.2] does not include the concept of RBAC, this Security Target does not
include discussions about RBAC, but many of the security features that comprise the guidance
documentation's RBAC (such as Permission Set management and sign in method management)
are included as security features and as security requirements in this Security Target.
Page 16 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Figure 2: HCD logical diagram
Page 17 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
1.5.2 TOE security functionality (TSF) summary
1.5.2.1 Auditing
The TOE performs auditing of security relevant functions. Both the Jetdirect Inside and HCD System
firmware generate audit records. The TOE connects and sends audit records to a syslog server for
long-term storage and audit review. (The syslog server is part of the Operational Environment.)
1.5.2.2 Cryptography
The TOE uses IPsec to protect its communications channels. The QuickSec cryptographic library,
which is part of the Operational Environment, is used to supply the cryptographic algorithms for
IPsec. See section 1.5.2.7 for more information.
The TOE supports the decrypting of print jobs encrypted using the Job Encryption Password. The
decryption code used by the TOE is included in the TOE. See section 1.5.2.4.3 for more information.
The TOE includes functionality to encrypt certain types of scan jobs using the Adobe PDF specification.
This encryption functionality is not part of the claimed security functions of the TOE. Instead, the
TOE uses IPsec to protect its communication channels.
The HP High Performance Secure Hard Disk is part of the Operational Environment. Because of this,
the cryptographic operations performed by this disk are outside the scope of this evaluation.
1.5.2.3 Identification and authentication
1.5.2.3.1 Control Panel I&A
All HCDs have a Control Panel used to select a function (a.k.a. Control Panel application) to be
performed, such as Print, Copy, Scan, or Fax. The Control Panel supports both local and remote
sign in methods.
The mechanism for the local sign in method, which is part of the TOE firmware, is called:
● Local Device Sign In
Remote sign in methods used by the TOE are:
● LDAP Sign In
● Windows Sign In (via Kerberos)
For successful remote authentication, Control Panel users must enter their username and password
as defined by the remote sign in method.
All users must sign in before being presented with the home screen allowing access to Control
Panel applications. Prior to signing in, the user may select a sign in method, sign in, or get help on
various printer functions.
When users sign in through the Control Panel, the TOE displays asterisks for each character of a
PIN, Access Code, or password typed to prevent onlookers from viewing another user's authentication
data.
1.5.2.3.2 IPsec I&A
Client computers can connect to the TOE to submit print jobs and to manage the TOE. The TOE
uses IPsec to identify and mutually authenticate client computers that attempt to connect to it.
Page 18 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
The client computers that connect to the TOE are considered IPsec users and are classified as either
Network Client Computers or the Administrative Computer. The TOE uses IP addresses to identify
these users and X.509v3 certificates to authenticate the users. The IP address of a connecting client
computer must be defined to the TOE's IPsec firewall in order for the computer to be considered
authorized to access the TOE. Any client computer not defined to the TOE's IPsec/Firewall is
considered unauthorized and is blocked by the firewall from accessing the TOE.
The TOE uses IPsec/Firewall address templates, service templates, and rules to map IP addresses
to network service protocols. An address template contains one or more IP addresses. A service
template contains one or more allowed network service protocols. A rule contains a mapping of an
address template to a service template. Through the rules, an administrator determines the User
Role of the client computers (i.e., the administrator determines which client computer is the
Administrative Computer and which client computers are the Network Client Computers).
In the evaluated configuration, the IPsec/firewall only allows the Administrative Computer to connect
to all interfaces supported by the TOE. The Network Client Computers are limited to just the PJL
Interface (TCP port 9100). Table 2 shows the mapping of IPsec users to their allowed network
protocols.
Allowed network protocol access
IPsec user
EWS (HTTP), OPXd, WS-*, SNMP, PJL
Administrative Computer
(U.ADMINISTRATOR)
PJL (TCP port 9100 only)
Network Client Computer
(U.NORMAL)
Table 2: IPsec user mappings to allowed network protocols
Because IPsec mutual authentication is performed at the computer level, not the user level, the
computer allowed by the firewall to access the TOE via EWS, OXPd, WS-*, and SNMP must itself be
the Administrative Computer. This means that non-TOE administrative users should not be allowed
to logon to the Administrative Computer because every user of the Administrative Computer is
potentially a TOE administrator.
IPsec is configured to use X.509v3 certificates via the Internet Key Exchange (IKE) protocols IKEv1
and IKEv2 in the evaluated configuration.
In addition, the TOE can contact many types of trusted IT products using IPsec and mutual
authentication over the interfaces specified in section 1.5.4.1. The TOE contacts these computers
either to send data to them (e.g., send a scanned object in an email to the SMTP Gateway) or to
request information from them (e.g., authenticate a user using LDAP). The TOE mutually
authenticates these servers via IPsec prior to sending data to them.
1.5.2.4 Data protection and access control
1.5.2.4.1 Permission Sets
Each Control Panel application requires one or more permissions in order to execute it. These
permissions are defined in Permission Sets (a.k.a. Control Panel User Roles). The applied Permission
Set can be a combination of various Permission Sets associated with a user. The default Permission
Sets in the evaluated configuration are:
● Device Administrator (assigned to U.ADMINISTRATOR)
Page 19 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
● Device User (assigned to U.NORMAL)
The TOE includes a Device Guest Permission Set, but it has no enabled permissions in the evaluated
configuration. Additional (custom) Permission Sets can be created and applied by the administrator
in the evaluated configuration.
The Device Administrator Permission Set has more permissions enabled than the Device User
Permission Set. For example, the Device Administrator Permission Set has a fax permission enabled
which allows a U.ADMINISTRATOR user to print and delete incoming fax jobs stored in Job Storage.
The Device User Permission Set has this permission disabled in the evaluated configuration; therefore,
the TOE denies a U.NORMAL user permission to print an incoming fax job stored in Job Storage.
Permission Set data is stored in the TOE and managed via EWS and WS-* Web Services.
1.5.2.4.2 Job PINs
Users control access to print and stored copy jobs that they place on the TOE by assigning Job PINs
to these jobs (required in the evaluated configuration). Job PINs must be 4 digits in length. Job PINs
limit access to these jobs while they reside on the TOE and allows users to control when the jobs
are printed so that physical access to the hard copies can be controlled.
1.5.2.4.3 Job Encryption Password
The TOE can store and decrypt encrypted stored print jobs received from a client computer which
has the HP Universal Print Driver installed. A stored print job is first encrypted by the client computer
using a user-specified Job Encryption Password. The job is then sent encrypted to the TOE and
stored encrypted by the TOE. To decrypt the job, a Control Panel user must enter the correct Job
Encryption Password used to encrypt the job.
1.5.2.4.4 Common access control
The TOE protects each non-fax job in Job Storage from non-administrative users through the use
of a user identifier and a Job PIN or through the use of just a Job Encryption Password. The user
identifier for a print job received from a client computer is either automatically assigned by that
client computer or assigned by the user sending the print job from the client computer. For all other
types of jobs, the user identifier is assigned by the TOE. Every non-fax job in Job Storage is assigned
either a Job PIN or a Job Encryption Password by the user at job creation time.
The default rules for a non-administrative (U.NORMAL) user for accessing a non-fax job in Job Storage
are:
● if the job is Job PIN protected:
❍ the job owner (i.e., the authenticated user who matches the job's user identifier)
can access the job without supplying the Job PIN
❍ any non-owner authenticated user who supplies the correct Job PIN can access
the job
● if the job is Job Encryption Password protected, any authenticated user who supplies the
correct Job Encryption Password can access the job
A Control Panel administrator (U.ADMINISTRATOR) user has a permission in their Permission Set
that allows the administrator to delete non-fax Job Storage jobs.
The TOE protects each fax job in Job Storage through the Permission Set mechanism. A user must
have a specific fax permission in their Permission Set to access incoming fax jobs stored in Job
Storage.
Page 20 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
1.5.2.4.5 TOE function access control
For Control Panel users, the TOE controls access to Control Panel applications using Permission
Sets and, optionally, sign-in methods (authentication databases). Permission Sets act as User Roles
to determine if the user can perform a function controlled by permissions.
In addition, each Control Panel application (e.g., Copy, Print) has a sign in method mapped to it.
This is separate from the home screen sign in presented on the Control Panel when no user is signed
in to the Control Panel.
To access an application, the TOE can require a user to successfully authenticate to the sign in
method mapped to the application. During a user's Control Panel session, the TOE remembers
which sign in methods the user has successfully authenticated against, including the user's home
screen sign in method. This allows the TOE to grant the user immediate access to any applications
that require the same sign in method without prompting for the user's sign in method credentials
again during the session. This session information is discarded when the user signs out.
Administrators can change/modify the sign in method mapped to each application. Administrators
can also control whether the TOE strictly enforces the sign in method mapped to the applications
or if the TOE allows users to select an alternate sign in method to access applications.
For IPsec users, the TOE uses the IPsec/Firewall to control access to the supported network protocols.
The IPsec/Firewall contains the IP addresses of authorized client computers grouped into address
templates and the network service protocols grouped into service templates. The administrator
maps an address template to a service template using an IPsec/Firewall rule. Service templates,
therefore, act as the User Roles. IP addresses of computers not contained in a rule are denied
access to the TOE.
1.5.2.4.6 Residual information protection
The TOE protects deleted objects by making them unavailable to TOE users via the TOE's interfaces.
This prevents TOE users from attempting to recover deleted objects of other users via the TOE
interfaces.
1.5.2.5 Protection of the TSF
1.5.2.5.1 Restricted forwarding of data to external interfaces
The TOE allows an administrator to restrict the forwarding of data received from an External Interface
to the Shared-medium Interface. Specifically, the fax features Fax Forwarding and Fax Archive,
which can automatically forward or archive received faxes can be enabled / disabled by an
administrator.
1.5.2.5.2 TSF self-testing
The TOE contains a suite of self tests to test specific security functionality of the TOE. It contains
data integrity checks for testing specific TSF Data of the TOE and for testing the stored TOE
executables.
1.5.2.5.3 Reliable timestamps
The TOE contains a system clock that is used to generate reliable timestamps. In the evaluated
configuration, the TOE synchronizes the system clock with a Network Time Protocol (NTP) server.
Page 21 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
1.5.2.6 TOE access protection
1.5.2.6.1 Inactivity timeout
The Control Panel supports an administrator selectable inactivity timeout in case users forget to
logout of the Control Panel after logging in.
1.5.2.6.2 Automatic logout
The Control Panel supports the following administrator-selectable automatic logout functions:
● Sign out the user immediately after starting the job
● Sign out the user 10 seconds after starting the job with the user-selectable option to remain
signed in
If the user logs in and never starts a job, the inactivity timeout feature will terminate the session.
1.5.2.7 Trusted channel communication and certificate management
The TOE supports IPsec to protect data being transferred over the Shared-medium Interface. IPsec
uses IP addresses and X.509v3 certificates to identify and authenticate the Network Client Computers
and Administrative Computers as well as other trusted IT products to which the TOE connects (e.g.,
syslog server, NTP server, SMTP gateway).
The TOE uses several cryptographic algorithms with IPsec. These cryptographic algorithms, supplied
by the QuickSec cryptographic library, are all part of the Operational Environment., but the TOE
controls the usage of these algorithms. Also, the TOE uses a software-based random number
generator in the Operational Environment when creating symmetric encryption keys used as
communications session keys and secret keys used during data integrity verification.
In addition, the TOE provides certificate management functions used to manage (add, replace,
delete) X.509v3 certificates.
1.5.2.8 User and access management
The TOE provides management capabilities for managing its security functionality. The TOE supports
the following roles:
● administrators (U.ADMINISTRATOR)
● users (U.NORMAL)
Administrators have the authority to manage the security functionality of the TOE and to manage
users. Users can only manage user data that they have access to on the TOE.
1.5.3 TOE boundaries
1.5.3.1 Physical
The physical boundary of the TOE is the programs and data stored in the firmware of the HCD
(except for the embedded operating system and the QuickSec cryptographic library) and the
English-language guidance documentation.
It is typical for an HCD, and thus the TOE, to be shared by many users and for those users have
direct physical access to the HCD. By design, users have easy access to some of the hardware
features, such as the Control Panel (where users select to print, copy, etc.), the paper bins, the
printer output trays, the scanner / copier, and the power switch. But other features such as the
Page 22 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
processor, firmware, and storage drive have more restricted access. These more restricted
components (such as the processor board) are more difficult to access because they require hardware
tools to disassemble the HCD or have a combination lock used to restrict access (such as to restrict
access to the storage drive).
Because of the restricted access to the storage drive, the drive is considered a non-removable
nonvolatile storage device from the perspective of [PP2600.2].
Due to the physical accessibility of the HCDs, they must be used in non-hostile environments.
Physical access should be controlled and/or monitored.
QuickSec version 5.1 ([QuickSec51]) library implements the TOE's IPsec including the IPsec/Firewall.
QuickSec includes a cryptographic library. Although the IPsec implementation in QuickSec is in the
TOE boundary, the QuickSec cryptographic library used by QuickSec for all IPsec cryptography is
part of the Operational Environment. QuickSec is developed and tested by SafeNet, Inc.
Regarding the SMTP gateway, the TOE can only provide protection of sent emails to the device with
which the TOE has the IPsec connection (i.e., the TOE only provides protection between the TOE
and SMTP gateway). After that point, the Operational Environment must provide the remaining
protection necessary to transfer the email from the SMTP gateway to the email's addressee(s).
1.5.3.2 Logical
The security functionality provided by the TOE has been described above and includes:
● Auditing
● Cryptography
● Identification and authentication
● Data protection and access control
● Protection of the TSF (restricted forwarding, TSF self-testing, timestamps)
● TOE access protection (inactivity timeout and automatic logout)
● Trusted channel communication and certificate management
● User and access management
1.5.3.3 Evaluated configuration
The following items will need to be adhered to in the evaluated configuration:
● HP High Performance Secure Hard Disk, if installed, must be configured with a password
to activate drive encryption
● Device Administrator Password must be set
● Only one Administrative Computer is used to manage the TOE
● HP and third party applications cannot be installed on the TOE
● All non-fax stored jobs must be assigned a Job PIN or encrypted with a password
● PC Fax Send must be disabled
● Type A and B USB ports must be disabled
● Remote Firmware Upgrade through any means other than EWS and USB (e.g., PJL) must
be disabled
● Jetdirect Inside management via telnet and FTP must be disabled
● Jetdirect XML Services must be disabled
Page 23 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
● File System External Access must be disabled
● IPsec authentication using X.509v3 certificates must be enabled (IPsec authentication using
Kerberos or Pre-Shared Key is not supported)
● IPsec Authenticated Headers (AH) must be disabled
● IPsec IKE Main Mode for key exchange must be used
● Full Authentication must be enabled (this disables the Guest account)
● SNMP support limited to:
❍ SNMPv1 read-only
❍ SNMPv2c read-only
❍ SNMPv3
● The Service PIN, used by a customer support engineer to access functions available to HP
support personnel, must be disabled
● Near Field Communication (NFC) must be disabled
● Wireless Direct Print must be disabled
● PJL device access commands must be disabled
● When using Windows Sign In, the Windows domain must reject Microsoft NT LAN Manager
(NTLM) connections
● The "Save to HTTP" function (workflows) is disallowed and must not be configured to
function with an HTTP server
● Display Names for the Local Device Sign In method users and user names for the LDAP
and Windows Sign In method users must only contain the characters defined in
P.USERNAME.CHARACTER_SET.
1.5.4 Security policy model
This section describes the security policy model for the TOE. Much of the terminology in this section
comes from [PP2600.2] and is duplicated here so that readers won't have to read [PP2600.2] to
understand the terminology used in the rest of this Security Target document.
1.5.4.1 Subjects/Users
Users are entities that are external to the TOE and which interact with the TOE. TOE users are
defined in Table 3.
Definition
Designation
Any authorized User. Authorized Users are U.ADMINISTRATOR and U.NORMAL.
U.USER
Definition
Designation
A User who is authorized to perform User Document Data processing
functions of the TOE.
U.NORMAL
Page 24 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Definition
Designation
A User who has been specifically granted the authority to manage some
portion or all of the TOE and whose actions may affect the TOE security
policy (TSP). A password must be set for all U.ADMINISTRATOR accounts
in the evaluated configuration.
U.ADMINISTRATOR
Table 3: Users
For the purpose of clarity in this Security Target, the following distinctions are made:
● Control Panel users – U.NORMAL and U.ADMINISTRATOR users who physically access
the TOE's Control Panel.
❍ Security attributes: User Role (defined by Permission Set) and User Identifier
● Incoming analog fax phone line users – Unauthenticated entities that initiate and
transmit faxes to the TOE over the TOE's analog fax phone line. These users are considered
U.ADMINISTRATOR because User Document Data (i.e., incoming faxes) created by these
users is considered to be owned by U.ADMINISTRATOR. There are no actual management
/ administrative functions available to these users.
❍ Security attributes: None
● IPsec users:
❍ Network Client Computers – Computers (U.NORMAL entities) that can
successfully authenticate to the TOE's PJL Interface (TCP port 9100) using IPsec
and mutual authentication. The TOE will accept print jobs from any user of a client
computer where the client computer has successfully authenticated with the TOE.
➤ Security attributes: User Role (defined by IPsec/Firewall service
template) and User Identifier (define by IP address)
❍ Administrative Computers – Computers (U.ADMINISTRATOR entities) that can
successfully authenticate to the TOE's administrative interfaces (e.g., EWS/HTTP,
OXPd, WS-*, SNMP) using IPsec and mutual authentication. An Administrative
Computer may also connect to the TOE as a Network Client Computer (i.e., the
Administrative Computer can send print jobs as a U.NORMAL user through the PJL
Interface on port 9100).
➤ Security attributes: User Role (defined by IPsec/Firewall service
template) and User Identifier (define by IP address)
● Trusted IT products: - Operational Environment products that the TOE uses and that the
TOE trusts to enforce the product's own security functional requirements correctly (e.g.,
LDAP server, NTP server).
1.5.4.2 Objects
Objects are passive entities in the TOE that contain or receive information, and upon which Subjects
perform Operations. Objects are equivalent to TOE Assets. There are three types of Objects:
● User Data
● TSF Data
● Functions
Page 25 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
1.5.4.2.1 User Data
User Data are data created by and for Users and do not affect the operation of the TOE Security
Functionality (TSF). This type of data is comprised of two objects:
● User Document Data
● User Function Data
Definition
Designation
User Document Data consists of the information contained in a user's document. This
includes the original document itself in hardcopy or electronic form, image data, or
residually-stored data created by the HCD while processing an original document and
printed hardcopy output.
D.DOC
User Function Data are the information about a user's document or job to be processed by
the TOE.
D.FUNC
Table 4: User Data
User Data objects include:
● Fax jobs:
❍ Receive Fax jobs – Fax jobs received by the TOE over the analog fax phone line
where the connection is initiated by another fax device.
❍ Fax Polling Receive jobs – Fax jobs received by the TOE over the analog fax
phone line where the connection is initiated by the TOE via the Fax Polling Receive
function.
❍ Send Fax jobs – Fax jobs being sent by the TOE over the analog fax phone line.
(The Send Fax functionality is available in the evaluated configuration, but the PC
Fax Send feature is disabled in the evaluated configuration.)
● Print job types that use Job Storage:
❍ Personal jobs – Print jobs from a client computer that are stored in Job Storage.
In the evaluated configuration, such jobs must be PIN protected with a Job PIN.
These jobs are held until the user logs in to the Control Panel and releases the job.
For PIN protected stored jobs, the user must be the job owner or know the Job PIN
(or have administrator privileges) in order to delete the job. These jobs are
automatically deleted after printing or if the HCD is turned off (configurable by the
administrator) or after an administrator specified time interval.
❍ Stored jobs – Print jobs such as a personnel form, time sheet, or calendar from
a client computer that are stored indefinitely on the TOE and reprinted. In the
evaluated configuration, such jobs must be PIN protected with a Job PIN. For PIN
protected stored jobs, the user must be the job owner or know the Job PIN (or have
administrator privileges) in order to delete the job.
❍ Encrypted stored print jobs – Print jobs like those described above but that
require higher than normal protection (for example, documents containing company
or employee confidential information). These jobs will be assigned a password by
the submitter when submitted to the TOE. The user must know the password of
the job in order to print or delete it. The administrator may delete it without knowing
the password.
Page 26 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
● Scan job types:
❍ Email jobs – Scan jobs that are scanned directly into an email and sent from the
TOE to an SMTP gateway.
❍ Save to Network Folder jobs – Scan jobs that are saved to a remote file system.
❍ Save to SharePoint jobs - Scan jobs that are saved to a SharePoint server.
● Stored copy jobs – A copy job that a Control Panel user has stored on the TOE. Stored
copy jobs are scanned using the HCD scanner. In the evaluated configuration, users are
required to protect Stored Copy jobs with a 4-digit Job PIN. The user must be the job owner,
know the Job PIN of the job, or be an administrator in order to delete the job. .
A user signed in at the Control Panel will be the owner of any created stored copy job. Ownership
of a print job sent from a client computer is defined as the username associated with the job when
it is submitted to the TOE. The username is specified outside of the TOE, in the Operational
Environment, so it can neither be confirmed nor denied by the TOE.
1.5.4.2.2 TSF Data
TSF Data are data created by and for the TOE and that might affect the operation of the TOE. This
type of data is comprised of two components: TSF Protected Data and TSF Confidential Data.
Definition
Designation
TSF Confidential Data are assets for which either disclosure or alteration by a user who is
neither an administrator nor the owner of the data would have an effect on the operational
security of the TOE.
D.CONF
TSF Protected Data are assets for which alteration by a user who is neither an administrator
nor the owner of the data would have an effect on the operational security of the TOE, but
for which disclosure is acceptable.
D.PROT
Table 5: TSF Data
The following table lists the TSF Data and the data designations.
D.PROT
D.CONF
TSF Data
X
Audit records
X
Cryptographic keys and certificates
X
Device and network configuration settings (including IPsec/Firewall rules and
templates)
X
Job data including Job PINs
X
PJL protocol excluding the job data and Job PINs
X
Permission Sets
X
System time
X
User and Administrator identification data
Page 27 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
D.PROT
D.CONF
TSF Data
X
User and Administrator authentication data
Table 6: TSF Data Listing
1.5.4.3 SFR package functions
Functions perform processing, storage, and transmission of data. The following [PP2600.2]-defined
functions apply to this Security Target.
Definition
Designation
Copying: a function in which physical document input is duplicated to physical document
output
F.CPY
Document storage and retrieval: a function in which a document is stored during one job
and retrieved during one or more subsequent jobs
F.DSR
Faxing: a function in which physical document input is converted to a telephone-based
document facsimile (fax) transmission, and a function in which a telephone-based document
facsimile (fax) reception is converted to physical document output
F.FAX
Printing: a function in which electronic document input is converted to physical document
output
F.PRT
Scanning: a function in which physical document input is converted to electronic document
output
F.SCN
Shared-medium interface: a function that transmits or receives User Data or TSF Data over
a communications medium which, in conventional practice, is or can be simultaneously
accessed by multiple users, such as wired network media and most radio-frequency wireless
media
F.SMI
Table 7: SFR package functions
1.5.4.4 SFR package attributes
When a function is performing processing, storage, or transmission of data, the identity of the
function is associated with that particular data as a security attribute. The following
[PP2600.2]-defined attributes apply to this Security Target.
Definition
Designation
Indicates data that is associated with a copy job.
+CPY
Indicates data that is associated with a document storage and retrieval job.
+DSR
Indicates data that is associated with an inbound (received) fax job.
+FAXIN
Indicates data that is associated with an outbound (sent) fax job.
+FAXOUT
Indicates data that is associated with a print job.
+PRT
Page 28 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Definition
Designation
Indicates data that is associated with a scan job.
+SCN
Indicates data that is transmitted or received over a shared-medium interface.
+SMI
Table 8: SFR package attributes
Page 29 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
2 CC Conformance Claim
This Security Target is CC Part 2 extended and CC Part 3 conformant, with a claimed Evaluation
Assurance Level of EAL2, augmented by ALC_FLR.2.
This Security Target claims conformance to the following Protection Profiles and PP packages, if
any:
● [PP2600.2]: IEEE Std 2600.2-2009; "2600.2-PP, Protection Profile for Hardcopy Devices,
Operational Environment B" (with NIAP CCEVS Policy Letter #20) . Version 1.0 as of
December 2009; demonstrable conformance.
● [PP2600.2-CPY]: SFR Package for Hardcopy Device Copy Functions. Version 1.0 as of
December 2009; demonstrable conformance.
● [PP2600.2-DSR]: SFR Package for Hardcopy Device Document Storage and Retrieval (DSR)
Functions. Version 1.0 as of December 2009; demonstrable conformance.
● [PP2600.2-FAX]: SFR Package for Hardcopy Device Fax Functions. Version 1.0 as of
December 2009; demonstrable conformance.
● [PP2600.2-PRT]: SFR Package for Hardcopy Device Print Functions. Version 1.0 as of
December 2009; demonstrable conformance.
● [PP2600.2-SCN]: SFR Package for Hardcopy Device Scan Functions. Version 1.0 as of
December 2009; demonstrable conformance.
● [PP2600.2-SMI]: SFR Package for Hardcopy Device Shared-medium Interface Functions.
Version 1.0 as of December 2009; demonstrable conformance.
Common Criteria [CC] version 3.1 revision 4 is the basis for this conformance claim.
2.1 Protection Profile tailoring and additions
2.1.1 IEEE Std 2600.2-2009; "2600.2-PP, Protection Profile for
Hardcopy Devices, Operational Environment B" (with NIAP CCEVS
Policy Letter #20) ([PP2600.2])
In this Security Target, [PP2600.2] has been modified to conform with the NIAP CCEVS Policy Letter
#20 ([CCEVS-PL20]).
Although the HCDs in this Security Target contain a nonvolatile storage device (i.e., a storage drive),
this device is considered an internal, built-in component of the HCDs and, therefore, constitutes a
non-removable nonvolatile storage device from the perspective of [PP2600.2] and [CCEVS-PL20].
Because no removable nonvolatile storage devices exist in the HCDs, this Security Target does not
claim conformance to "2600.2-NVS SFR Package for Hardcopy Device Nonvolatile Storage Functions,
Operational Environment B" contained in [PP2600.2].
The following tables provide the mappings of and rationale for how the SFRs in this Security Target
map to the SFRs in the protection profile [PP2600.2]. The term "n/a" means "not applicable". The
term "common" is used to refer to that portion of [PP2600.2] to which all TOEs must conform (i.e.,
the portions not labeled as packages).
Page 30 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Rationale
Hierarchical
substitution
Iteration
Maps to ST SFR(s)
[PP2600.2] SFR
The ST's FAU_GEN.1 combines the
contents of FAU_GEN.1 from the
common [PP2600.2] and FAU_GEN.1
from the [PP2600.2] SMI SFR
package.
FAU_GEN.1
FAU_GEN.1
n/a
FAU_GEN.2
FAU_GEN.2
The ST's FDP_ACC.1-cac combines
the contents of the FDP_ACC.1(a)
from the common [PP2600.2] and
FDP_ACC.1-cac
FDP_ACC.1(a)
the FDP_ACC.1's from the
[PP2600.2] packages claimed by
the ST. The iteration name was
changed from "(a)" to "-cac"
(Common Access Control) for better
understandability when reading the
ST.
The iteration name was changed
from "(b)" to "-tfac" (TOE Function
Access Control) for better
understandability when reading the
ST.
FDP_ACC.1-tfac
FDP_ACC.1(b)
The ST's FDP_ACF.1-cac combines
the contents of the FDP_ACF.1(a)
from the common [PP2600.2] and
FDP_ACF.1-cac
FDP_ACF.1(a)
the FDP_ACF.1's from the
[PP2600.2] packages claimed by
the ST. The iteration name was
changed from "(a)" to "-cac"
(Common Access Control) for better
understandability when reading the
ST.
The iteration name was changed
from "(b)" to "-tfac" (TOE Function
Access Control) for better
understandability when reading the
ST.
FDP_ACF.1-tfac
FDP_ACF.1(b)
n/a
FDP_RIP.1
FDP_RIP.1
n/a
FIA_ATD.1
FIA_ATD.1
The TOE's Control Panel supports
authentication (FIA_UAU.1).
FIA_UAU.1
FIA_UAU.1
Page 31 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Rationale
Hierarchical
substitution
Iteration
Maps to ST SFR(s)
[PP2600.2] SFR
The TOE supports IPsec
authentication (FIA_UAU.2) which
complies with the more restrictive
FIA_UAU.2.
X
FIA_UAU.2
The TOE's Control Panel supports
identification (FIA_UID.1).
FIA_UID.1
FIA_UID.1
The TOE supports IPsec
identification (FIA_UID.2) which
complies with the more restrictive
FIA_UID.2.
X
FIA_UID.2
n/a
FIA_USB.1
FIA_USB.1
FMT_MSA.1(a) iteration name is
different to better reflect the
security attributes involved because
this SFR is shared with another
access control policy.
X
FMT_MSA.1-perm
FMT_MSA.1(a)
FMT_MSA.1(b) was further iterated
because the operations on the
security attributes differ.
X
FMT_MSA.1-perm and
FMT_MSA.1-tfac
FMT_MSA.1(b)
FMT_MSA.3(a) was omitted because
the security attributes do not have
default values in the evaluated
configuration.
None
FMT_MSA.3(a)
FMT_MSA.3(b) was omitted because
the security attributes do not have
default values in the evaluated
configuration.
None
FMT_MSA.3(b)
The iteration name was changed
from "(a)" to "-auth" (TSF Data
associated with authorization) for
better understandability when
reading the ST.
FMT_MTD.1-auth
FMT_MTD.1.1(a)
The iteration name was changed
from "(b)" to "-users" (TSF Data
associated with users) for better
understandability when reading the
ST.
FMT_MTD.1-users
FMT_MTD.1.1(b)
n/a
FMT_SMF.1
FMT_SMF.1
n/a
FMT_SMR.1
FMT_SMR.1
Page 32 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Rationale
Hierarchical
substitution
Iteration
Maps to ST SFR(s)
[PP2600.2] SFR
Because the TOE is configured to
use NTP along with its internal time
source, both A.NTP.RELIABLE and
OE.NTP.RELIABLE apply.
FPT_STM.1
FPT_STM.1
n/a
FPT_TST.1
FPT_TST.1
n/a
FTA_SSL.3
FTA_SSL.3
Table 9: SFR mappings between 2600.2 and the ST
These SFRs in the Security Target are not required by and do not map to the protection profile
[PP2600.2].
Rationale
Hierarchical
substitution
Iteration
Maps to ST SFR(s)
[PP2600.2] SFR
FCS_CKM.1 specifies the types of
cryptographic keys generated by
the TOE for use with AES and HMAC
in IPsec.
FCS_CKM.1
None
FCS_CKM.2 specifies the
cryptographic key distribution
methods used by the TOE in IKEv1
and IKEv2 in IPsec.
FCS_CKM.2
None
FCS_COP.1-ipsec specifies the AES
encryption and decryption
algorithm, the RSA decryption
algorithm, and the HMAC algorithms
used by the TOE in IPsec.
X
FCS_COP.1-ipsec
None
FCS_COP.1-job specifies the AES
decryption algorithm used by the
TOE for decrypting encrypted print
jobs.
X
FCS_COP.1-job
None
FIA_SOS.1 specifies the Job PIN
strength of certain authorization
mechanisms used by the TOE.
FIA_SOS.1
None
The TOE masks Job PINs, Access
Codes, and passwords.
Recommended by [PP2600.2]
APPLICATION NOTE 38.
FIA_UAU.7
None
Page 33 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Rationale
Hierarchical
substitution
Iteration
Maps to ST SFR(s)
[PP2600.2] SFR
The TOE allows administrators to
allow or disallow users from
choosing an alternate sign in
method differing from the
administrator-selected method.
X
FMT_MOF.1-auth
None
The TOE allows the administrator
to allow or disallow use of the Fax
Forward and Fax Archive features.
X
FMT_MOF.1-faxforward
None
Table 10: SFR mappings of non-PP2600.2 SFRs and the ST (in the ST, but not required
by or hierarchical to SFRs in PP2600.2)
2.1.2 SFR Package for Hardcopy Device Copy Functions
([PP2600.2-CPY])
The following table shows how the SFRs in this SFR package map to the SFRs in the Security Target.
Rationale
Hierarchical
substitution
Iteration
Maps to ST SFR(s)
[PP2600.2-CPY]
SFR
See rationale for FDP_ACC.1(a).
X
FDP_ACC.1-cac
FDP_ACC.1
See rationale for FDP_ACF.1(a).
X
FDP_ACF.1-cac
FDP_ACF.1
Table 11: SFR mappings between 2600.2-CPY and the ST
2.1.3 SFR Package for Hardcopy Device Document Storage and
Retrieval (DSR) Functions ([PP2600.2-DSR])
The following table shows how the SFRs in this SFR package map to the SFRs in the Security Target.
Rationale
Hierarchical
substitution
Iteration
Maps to ST SFR(s)
[PP2600.2-DSR]
SFR
See rationale for FDP_ACC.1(a).
X
FDP_ACC.1-cac
FDP_ACC.1
See rationale for FDP_ACF.1(a).
X
FDP_ACF.1-cac
FDP_ACF.1
Table 12: SFR mappings between 2600.2-DSR and the ST
Page 34 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
2.1.4 SFR Package for Hardcopy Device Fax Functions
([PP2600.2-FAX])
The following table shows how the SFRs in this SFR package map to the SFRs in the Security Target.
Rationale
Hierarchical
substitution
Iteration
Maps to ST SFR(s)
[PP2600.2-FAX]
SFR
See rationale for FDP_ACC.1(a).
X
FDP_ACC.1-cac
FDP_ACC.1
See rationale for FDP_ACF.1(a).
X
FDP_ACF.1-cac
FDP_ACF.1
Table 13: SFR mappings between 2600.2-FAX and the ST
2.1.5 SFR Package for Hardcopy Device Print Functions
([PP2600.2-PRT])
The following table shows how the SFRs in this SFR package map to the SFRs in the Security Target.
Rationale
Hierarchical
substitution
Iteration
Maps to ST SFR(s)
[PP2600.2-PRT]
SFR
See rationale for FDP_ACC.1(a).
X
FDP_ACC.1-cac
FDP_ACC.1
See rationale for FDP_ACF.1(a).
X
FDP_ACF.1-cac
FDP_ACF.1
Table 14: SFR mappings between 2600.2-PRT and the ST
2.1.6 SFR Package for Hardcopy Device Scan Functions
([PP2600.2-SCN])
The following table shows how the SFRs in this SFR package map to the SFRs in the Security Target.
Rationale
Hierarchical
substitution
Iteration
Maps to ST SFR(s)
[PP2600.2-SCN]
SFR
See rationale for FDP_ACC.1(a).
X
FDP_ACC.1-cac
FDP_ACC.1
See rationale for FDP_ACF.1(a).
X
FDP_ACF.1-cac
FDP_ACF.1
Table 15: SFR mappings between 2600.2-SCN and the ST
2.1.7 SFR Package for Hardcopy Device Shared-medium Interface
Functions ([PP2600.2-SMI])
The following table shows how the SFRs in this SFR package map to the SFRs in the Security Target.
Page 35 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Rationale
Hierarchical
substitution
Iteration
Maps to ST SFR(s)
[PP2600.2-SMI]
SFR
The ST's FAU_GEN.1 combines the
contents of FAU_GEN.1 from the
common [PP2600.2] and FAU_GEN.1
from the [PP2600.2] SMI SFR
package.
FAU_GEN.1
FAU_GEN.1
n/a
FPT_FDI_EXP.1
FPT_FDI_EXP.1
[CCEVS-PL20] modifies FTP_ITC.1.3.
FTP_ITC.1
FTP_ITC.1
Table 16: SFR mappings between 2600.2-SMI and the ST
Page 36 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
3 Security Problem Definition
3.1 Introduction
The statement of TOE security environment describes the security aspects of the environment in
which the TOE is intended to be used and the manner in which it is expected to be deployed.
To this end, the statement of TOE security environment identifies the list of assumptions made on
the Operational Environment (including physical and procedural measures) and the intended method
of use of the product, defines the threats that the product is designed to counter, and the
organizational security policies with which the product is designed to comply.
3.2 Threat Environment
This security problem definition addresses threats posed by four categories of threat agents:
a) Persons who are not permitted to use the TOE who may attempt to use the TOE
b) Persons who are authorized to use the TOE who may attempt to use TOE functions for
which they are not authorized.
c) Persons who are authorized to use the TOE who may attempt to access data in ways for
which they not authorized.
d) Persons who unintentionally cause a software malfunction that may expose the TOE to
unanticipated threats.
The threats and policies defined in this Security Target address the threats posed by these threat
agents.
The threat agents are assumed to originate from a well managed user community in a non-hostile
working environment. Therefore, the product protects against threats of security vulnerabilities
that might be exploited in the intended environment for the TOE with low level of expertise and
effort. The TOE protects against straightforward or intentional breach of TOE security by attackers
possessing a Basic attack potential.
3.2.1 Threats countered by the TOE
T.DOC.DIS
User Document Data may be disclosed to unauthorized persons.
T.DOC.ALT
User Document Data may be altered by unauthorized persons.
T.FUNC.ALT
User Function Data may be altered by unauthorized persons.
T.PROT.ALT
TSF Protected Data may be altered by unauthorized persons.
T.CONF.DIS
TSF Confidential Data may be disclosed to unauthorized persons.
Page 37 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
T.CONF.ALT
TSF Confidential Data may be altered by unauthorized persons.
3.3 Assumptions
3.3.1 Environment of use of the TOE
3.3.1.1 Physical
A.ACCESS.MANAGED
The TOE is located in a restricted or monitored environment that provides protection from
unmanaged access to the physical components and data interfaces of the TOE.
A.ADMIN.PC.SECURE
The administrative computer is in a physically secured and managed environment and only
the authorized administrator has access to it.
A.USER.PC.POLICY
User computers are configured and used in conformance with the organization's security
policies.
3.3.1.2 Personnel
A.USER.TRAINING
TOE Users are aware of the security policies and procedures of their organization, and are
trained and competent to follow those policies and procedures.
A.ADMIN.TRAINING
Administrators are aware of the security policies and procedures of their organization, are
trained and competent to follow the manufacturer's guidance and documentation, and
correctly configure and operate the TOE in accordance with those policies and procedures.
A.ADMIN.TRUST
Administrators do not use their privileged access rights for malicious purposes.
3.3.1.3 Connectivity
A.DNS.RELIABLE
When the TOE resolves network hostnames to addresses with the Domain Name System,
the Domain Name System provides reliable network addresses.
A.NTP.RELIABLE
When the TOE synchronizes time with the Network Time Protocol server, the Network Time
Protocol server provides reliable time synchronization information.
Page 38 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
A.SERVICES.RELIABLE
When the TOE uses any of the network services Kerberos, LDAP, SMTP, or syslog, these
services provide reliable information and responses to the TOE.
A.WINS.RELIABLE
When the TOE resolves network hostnames to addresses with the Windows Internet Name
Service, the Windows Internet Name Service provides reliable network addresses.
3.4 Organizational Security Policies
3.4.1 Included in the PP2600.2 protection profile
P.USER.AUTHORIZATION
To preserve operational accountability and security, Users will be authorized to use the TOE
only as permitted by the TOE Owner.
P.SOFTWARE.VERIFICATION
To detect corruption of the executable code in the TSF, procedures will exist to self-verify
executable code in the TSF.
P.AUDIT.LOGGING
To preserve operational accountability and security, records that provide an audit trail of
TOE use and security-relevant events will be created, maintained, and protected from
unauthorized disclosure or alteration, and will be reviewed by authorized personnel.
P.INTERFACE.MANAGEMENT
To prevent unauthorized use of the external interfaces of the TOE, operation of those
interfaces will be controlled by the TOE and its IT environment.
3.4.2 In addition to the PP2600.2 protection profile
P.ADMIN.PASSWORD
To restrict access to administrative tasks, the Device Administrator Password will be set in
the evaluated configuration so that it is required to perform security-relevant actions through
EWS (HTTP) or at the Control Panel.
P.USERNAME.CHARACTER_SET
To prevent ambiguous user names in the TOE's audit trail, the Display Names of the Local
Device Sign In method users and the user names of the LDAP and Windows Sign In method
users must only contain ASCII printable characters except for the double quote (22 hex) and
single quote (27 hex) characters (i.e., allowed ASCII characters in hexadecimal: 20, 21, 23
- 26, 28 - 7E).
Page 39 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
4 Security Objectives
4.1 Objectives for the TOE
O.AUDIT.LOGGED
The TOE shall create and maintain a log of TOE use and security-relevant events, and prevent
its unauthorized disclosure or alteration.
O.CONF.NO_ALT
The TOE shall protect TSF Confidential Data from unauthorized alteration.
O.CONF.NO_DIS
The TOE shall protect TSF Confidential Data from unauthorized disclosure.
O.DOC.NO_ALT
The TOE shall protect User Document Data from unauthorized alteration.
O.DOC.NO_DIS
The TOE shall protect User Document Data from unauthorized disclosure.
O.FUNC.NO_ALT
The TOE shall protect User Function Data from unauthorized alteration.
O.INTERFACE.MANAGED
The TOE shall manage the operation of external interfaces in accordance with security
policies.
O.PROT.NO_ALT
The TOE shall protect TSF Protected Data from unauthorized alteration.
O.SOFTWARE.VERIFIED
The TOE shall provide procedures to self-verify executable code in the TSF.
O.USER.AUTHORIZED
The TOE shall require identification and authentication of Users, and shall ensure that Users
are authorized in accordance with security policies before allowing them to use the TOE.
4.2 Objectives for the Operational Environment
OE.ADMIN.TRAINED
The TOE Owner shall ensure that TOE Administrators are aware of the security policies and
procedures of their organization; have the training, competence, and time to follow the
manufacturer's guidance and documentation; and correctly configure and operate the TOE
in accordance with those policies and procedures.
Page 40 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
OE.ADMIN.PC.SECURE
The TOE Owner shall locate the Administrative Computer in a physically secured and managed
environment and allow only authorized personnel access to it.
OE.USER.PC.POLICY
The TOE Owner shall create a set of security policies to which user computers will conform.
OE.ADMIN.TRUSTED
The TOE Owner shall establish trust that TOE Administrators will not use their privileged
access rights for malicious purposes.
OE.AUDIT.REVIEWED
The TOE Owner shall ensure that audit logs are reviewed at appropriate intervals for security
violations or unusual patterns of activity.
OE.AUDIT_ACCESS.AUTHORIZED
If audit records generated by the TOE are exported from the TOE to another trusted IT
product, the TOE Owner shall ensure that those records can be accessed in order to detect
potential security violations, and only by authorized persons.
OE.AUDIT_STORAGE.PROTECTED
If audit records are exported from the TOE to another trusted IT product, the TOE Owner
shall ensure that those records are protected from unauthorized access, deletion and
modifications.
OE.INTERFACE.MANAGED
The IT environment shall provide protection from unmanaged access to TOE external
interfaces.
OE.PHYSICAL.MANAGED
The TOE shall be placed in a secure or monitored area that provides protection from
unmanaged physical access to the TOE.
OE.USER.AUTHORIZED
The TOE Owner shall grant permission to Users to be authorized to use the TOE according
to the security policies and procedures of their organization.
OE.USER.TRAINED
The TOE Owner shall ensure that Users are aware of the security policies and procedures
of their organization, and have the training and competence to follow those policies and
procedures.
OE.DNS.RELIABLE
When the TOE uses the Domain Name System to resolve hostnames to network addresses,
the Domain Name System shall provide a reliable address for the TOE.
Page 41 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
OE.NTP.RELIABLE
When the TOE synchronizes with the Network Time Protocol server, the Network Time
Protocol server shall provide reliable time synchronization information for the TOE.
OE.SERVICES.RELIABLE
When the TOE is configured to use the networks services Kerberos, LDAP, SMTP, or syslog,
these services shall provide reliable information and responses to the TOE.
OE.USERNAME.CHARACTER_SET
The Display Names of all Local Device Sign In method users and the user names of all LDAP
and Windows Sign In method users shall only contain ASCII printable characters except for
the double quote (22 hex) and single quote (27 hex) characters (i.e., allowed ASCII characters
in hexadecimal: 20, 21, 23 - 26, 28 - 7E).
OE.WINS.RELIABLE
When the TOE uses the Windows Internet Name Service to resolve hostnames to network
addresses, the Windows Internet Name Service shall provide a reliable address for the TOE.
4.3 Security Objectives Rationale
4.3.1 Coverage
The following table provides a mapping of TOE objectives to threats and policies, showing that each
objective counters or enforces at least one threat or policy, respectively.
Threats / OSPs
Objective
P.AUDIT.LOGGING
O.AUDIT.LOGGED
T.CONF.ALT
O.CONF.NO_ALT
T.CONF.DIS
O.CONF.NO_DIS
T.DOC.ALT
O.DOC.NO_ALT
T.DOC.DIS
O.DOC.NO_DIS
T.FUNC.ALT
O.FUNC.NO_ALT
P.INTERFACE.MANAGEMENT
O.INTERFACE.MANAGED
T.PROT.ALT
O.PROT.NO_ALT
P.SOFTWARE.VERIFICATION
O.SOFTWARE.VERIFIED
Page 42 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Threats / OSPs
Objective
T.DOC.DIS
T.DOC.ALT
T.FUNC.ALT
T.PROT.ALT
T.CONF.DIS
T.CONF.ALT
P.USER.AUTHORIZATION
O.USER.AUTHORIZED
Table 17: Mapping of security objectives to threats and policies
The following table provides a mapping of the objectives for the Operational Environment to
assumptions, threats and policies, showing that each objective holds, counters or enforces at least
one assumption, threat or policy, respectively.
Assumptions / Threats / OSPs
Objective
A.ADMIN.TRAINING
P.ADMIN.PASSWORD
OE.ADMIN.TRAINED
A.ADMIN.PC.SECURE
OE.ADMIN.PC.SECURE
A.USER.PC.POLICY
OE.USER.PC.POLICY
A.ADMIN.TRUST
OE.ADMIN.TRUSTED
P.AUDIT.LOGGING
OE.AUDIT.REVIEWED
P.AUDIT.LOGGING
OE.AUDIT_ACCESS.AUTHORIZED
P.AUDIT.LOGGING
OE.AUDIT_STORAGE.PROTECTED
P.INTERFACE.MANAGEMENT
OE.INTERFACE.MANAGED
A.ACCESS.MANAGED
OE.PHYSICAL.MANAGED
T.DOC.DIS
T.DOC.ALT
T.FUNC.ALT
T.PROT.ALT
T.CONF.DIS
T.CONF.ALT
P.USER.AUTHORIZATION
OE.USER.AUTHORIZED
A.USER.TRAINING
OE.USER.TRAINED
A.DNS.RELIABLE
OE.DNS.RELIABLE
A.NTP.RELIABLE
OE.NTP.RELIABLE
A.SERVICES.RELIABLE
OE.SERVICES.RELIABLE
P.USERNAME.CHARACTER_SET
OE.USERNAME.CHARACTER_SET
Page 43 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Assumptions / Threats / OSPs
Objective
A.WINS.RELIABLE
OE.WINS.RELIABLE
Table 18: Mapping of security objectives for the Operational Environment to assumptions,
threats and policies
4.3.2 Sufficiency
The following rationale provides justification that the security objectives are suitable to counter
each individual threat and that each security objective tracing back to a threat, when achieved,
actually contributes to the removal, diminishing or mitigation of that threat:
Rationale for security objectives
Threat
The threat:
T.DOC.DIS
● User Document Data may be disclosed to unauthorized persons.
is countered by:
● O.DOC.NO_DIS which protects D.DOC from unauthorized disclosure.
● O.USER.AUTHORIZED which establishes user identification and
authentication as the basis for authorization.
● OE.USER.AUTHORIZED which establishes responsibility of the TOE
Owner to appropriately grant authorization.
The threat:
T.DOC.ALT
● User Document Data may be altered by unauthorized persons.
is countered by:
● O.DOC.NO_ALT which protects D.DOC from unauthorized alteration.
● O.USER.AUTHORIZED which establishes user identification and
authentication as the basis for authorization.
● OE.USER.AUTHORIZED which establishes responsibility of the TOE
Owner to appropriately grant authorization.
The threat:
T.FUNC.ALT
● User Function Data may be altered by unauthorized persons.
is countered by:
● O.FUNC.NO_ALT which protects D.FUNC from unauthorized
alteration.
● O.USER.AUTHORIZED which establishes user identification and
authentication as the basis for authorization.
● OE.USER.AUTHORIZED which establishes responsibility of the TOE
Owner to appropriately grant authorization.
The threat:
T.PROT.ALT
● TSF Protected Data may be altered by unauthorized persons.
is countered by:
Page 44 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Rationale for security objectives
Threat
● O.PROT.NO_ALT which protects D.PROT from unauthorized
alteration.
● O.USER.AUTHORIZED which establishes user identification and
authentication as the basis for authorization.
● OE.USER.AUTHORIZED which establishes responsibility of the TOE
Owner to appropriately grant authorization.
The threat:
T.CONF.DIS
● TSF Confidential Data may be disclosed to unauthorized persons.
is countered by:
● O.CONF.NO_DIS which protects D.CONF from unauthorized
disclosure.
● O.USER.AUTHORIZED which establishes user identification and
authentication as the basis for authorization.
● OE.USER.AUTHORIZED which establishes responsibility of the TOE
Owner to appropriately grant authorization.
The threat:
T.CONF.ALT
● TSF Confidential Data may be altered by unauthorized persons.
is countered by:
● O.CONF.NO_ALT which protects D.CONF from unauthorized
alteration.
● O.USER.AUTHORIZED which establishes user identification and
authentication as the basis for authorization.
● OE.USER.AUTHORIZED which establishes responsibility of the TOE
Owner to appropriately grant authorization.
Table 19: Sufficiency of objectives countering threats
The following rationale provides justification that the security objectives for the environment are
suitable to cover each individual assumption, that each security objective for the environment that
traces back to an assumption about the environment of use of the TOE, when achieved, actually
contributes to the environment achieving consistency with the assumption, and that if all security
objectives for the environment that trace back to an assumption are achieved, the intended usage
is supported:
Rationale for security objectives
Assumption
The assumption:
A.ACCESS.MANAGED
● The TOE is located in a restricted or monitored environment that
provides protection from unmanaged access to the physical
components and data interfaces of the TOE.
is upheld by:
● OE.PHYSICAL.MANAGED which establishes a protected physical
environment for the TOE.
Page 45 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Rationale for security objectives
Assumption
The assumption:
A.ADMIN.PC.SECURE
● The administrative computer is in a physically secured and managed
environment and only the authorized administrator has access to
it.
is upheld by:
● OE.ADMIN.PC.SECURE which establishes the responsibility of the
TOE owner to locate the administrative computer in a physically
secured and managed environment and allow only authorized
personnel access.
The assumption:
A.USER.PC.POLICY
● User computers are configured and used in conformance with the
organization's security policies.
is upheld by:
● OE.USER.PC.POLICY which establishes the responsibility of the TOE
owner to create a set of security policies to which user computers
will conform.
The assumption:
A.USER.TRAINING
● TOE Users are aware of the security policies and procedures of
their organization, and are trained and competent to follow those
policies and procedures.
is upheld by:
● OE.USER.TRAINED which establishes responsibility of the TOE Owner
to provide appropriate User training.
The assumption:
A.ADMIN.TRAINING
● Administrators are aware of the security policies and procedures
of their organization, are trained and competent to follow the
manufacturer's guidance and documentation, and correctly
configure and operate the TOE in accordance with those policies
and procedures.
is upheld by:
● OE.ADMIN.TRAINED which establishes responsibility of the TOE
Owner to provide appropriate Administrator training.
The assumption:
A.ADMIN.TRUST
● Administrators do not use their privileged access rights for malicious
purposes.
is upheld by:
● OE.ADMIN.TRUSTED which establishes responsibility of the TOE
Owner to have a trusted relationship with Administrators.
The assumption:
A.DNS.RELIABLE
Page 46 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Rationale for security objectives
Assumption
● When the TOE resolves network hostnames to addresses with the
Domain Name System, the Domain Name System provides reliable
network addresses.
is upheld by:
● OE.DNS.RELIABLE which, when the TOE uses the Domain Name
System to resolve hostnames to network addresses, establishes
that the Domain Name System shall provide a reliable address for
the TOE.
The assumption:
A.NTP.RELIABLE
● When the TOE synchronizes time with the Network Time Protocol
server, the Network Time Protocol server provides reliable time
synchronization information.
is upheld by:
● OE.NTP.RELIABLE which, when the TOE synchronizes with the
Network Time Protocol server, establishes that the Network Time
Protocol server shall provide reliable time synchronization
information for the TOE.
The assumption:
A.SERVICES.RELIABLE
● When the TOE uses any of the network services Kerberos, LDAP,
SMTP, or syslog, these services provide reliable information and
responses to the TOE.
is upheld by:
● OE.SERVICES.RELIABLE which, when the TOE uses the network
services Kerberos, LDAP, SMTP, and syslog, establishes that these
services provide reliable information and responses to the TOE.
The assumption:
A.WINS.RELIABLE
● When the TOE resolves network hostnames to addresses with the
Windows Internet Name Service, the Windows Internet Name
Service provides reliable network addresses.
is upheld by:
● OE.WINS.RELIABLE which, when the TOE uses the Windows Internet
Name Service to resolve hostnames to network addresses,
establishes that the Windows Internet Name Service shall provide
a reliable address for the TOE.
Table 20: Sufficiency of objectives holding assumptions
The following rationale provides justification that the security objectives are suitable to cover each
individual organizational security policy, that each security objective that traces back to an OSP,
when achieved, actually contributes to the implementation of the OSP, and that if all security
objectives that trace back to an OSP are achieved, the OSP is implemented:
Page 47 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Rationale for security objectives
OSP
The OSP:
P.USER.AUTHORIZATION
● To preserve operational accountability and security, Users will be
authorized to use the TOE only as permitted by the TOE Owner.
is enforced by:
● O.USER.AUTHORIZED which establishes user identification and
authentication as the basis for authorization to use the TOE.
● OE.USER.AUTHORIZED which establishes responsibility of the TOE
Owner to appropriately grant authorization.
The OSP:
P.SOFTWARE.VERIFICATION
● To detect corruption of the executable code in the TSF, procedures
will exist to self-verify executable code in the TSF.
is enforced by:
● O.SOFTWARE.VERIFIED which provides procedures to self-verify
executable code in the TSF.
The OSP:
P.AUDIT.LOGGING
● To preserve operational accountability and security, records that
provide an audit trail of TOE use and security-relevant events will
be created, maintained, and protected from unauthorized disclosure
or alteration, and will be reviewed by authorized personnel.
is enforced by:
● O.AUDIT.LOGGED which creates and maintains a log of TOE use
and security-relevant events, and prevents unauthorized disclosure
or alteration.
● OE.AUDIT_STORAGE.PROTECTED which protects exported audit
records from unauthorized access, deletion and modifications.
● OE.AUDIT_ACCESS.AUTHORIZED which establishes responsibility
of, the TOE Owner to provide appropriate access to exported audit
records.
● OE.AUDIT.REVIEWED which establishes responsibility of the TOE
Owner to ensure that audit logs are appropriately reviewed.
The OSP:
P.INTERFACE.MANAGEMENT
● To prevent unauthorized use of the external interfaces of the TOE,
operation of those interfaces will be controlled by the TOE and its
IT environment.
is enforced by:
● O.INTERFACE.MANAGED which manages the operation of external
interfaces in accordance with security policies.
● OE.INTERFACE.MANAGED which establishes a protected
environment for TOE external interfaces.
The OSP:
P.ADMIN.PASSWORD
Page 48 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Rationale for security objectives
OSP
● To restrict access to administrative tasks, the Device Administrator
Password will be set in the evaluated configuration so that it is
required to perform security-relevant actions through EWS (HTTP)
or at the Control Panel.
is enforced by:
● OE.ADMIN.TRAINED which establishes responsibility of the TOE
Owner to provide appropriate Administrator training.
The OSP:
P.USERNAME.CHARACTER_SET
● To prevent ambiguous user names in the TOE's audit trail, the
Display Names of the Local Device Sign In method users and the
user names of the LDAP and Windows Sign In method users must
only contain ASCII printable characters except for the double quote
(22 hex) and single quote (27 hex) characters (i.e., allowed ASCII
characters in hexadecimal: 20, 21, 23 - 26, 28 - 7E).
is enforced by:
● OE.USERNAME.CHARACTER_SET which establishes that the Display
Names of all Local Device Sign In users and the user names of all
LDAP and Windows Sign In method users shall only contain ASCII
printable characters except for the double quote (22 hex) and single
quote (27 hex) characters (i.e., allowed ASCII characters in
hexadecimal: 20, 21, 23 - 26, 28 - 7E).
Table 21: Sufficiency of objectives enforcing Organizational Security Policies
Page 49 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
5 Extended Components Definition
[PP2600.2-SMI] defines the following extended component:
● FPT_FDI_EXP.1: Restricted forwarding of data to external interfaces
5.1 Class FPT: Protection of the TSF
This section describes the functional requirements for the restrictions of forwarding of data to
external interfaces. This extended component is defined in [PP2600.2-SMI].
5.1.1 Restricted forwarding of data to external interfaces (FDI)
Family behaviour
This family defines requirements for the TSF to restrict direct forwarding of information from one
external interface to another external interface.
Many products receive information on specific external interfaces and are intended to transform
and process this information before it is transmitted on another external interface. However, some
products may provide the capability for attackers to misuse external interfaces to violate the security
of the TOE or devices that are connected to the TOE's external interfaces. Therefore, direct forwarding
of unprocessed data between different external interfaces is forbidden unless explicitly allowed by
an authorized administrative role. The family FPT_FDI_EXP has been defined to specify this kind of
functionality.
Component levelling
FPT_FDI_EXP.1 Restricted forwarding of data to external interfaces provides for the functionality to
require TSF controlled processing of data received over defined external interfaces before these
data are sent out on another external interface. Direct forwarding of data from one external interface
to another one requires explicit allowance by an authorized administrative role.
Management: FPT_FDI_EXP.1
There are no management activities foreseen.
Audit: FPT_FDI_EXP.1
There are no audit events foreseen.
5.1.1.1 FPT_FDI_EXP.1 - Restricted forwarding of data to external
interfaces
No other components.
Hierarchical to:
No dependencies.
Dependencies:
The TSF shall provide the capability to restrict data received on
[assignment: list of external interfaces] from being forwarded without
further processing by the TSF to [assignment: list of external interfaces].
FPT_FDI_EXP.1.1
Page 50 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
6 Security Requirements
6.1 TOE Security Functional Requirements
The following table shows the security functional requirements for the TOE, and the operations
performed on the components according to CC part 2: iteration (Iter.), refinement (Ref.), assignment
(Ass.) and selection (Sel.).
Operations
Source
Base
security
functional
component
Security functional requirement
Security
functional
group Sel.
Ass.
Ref.
Iter.
Yes
Yes
No
No
PP2600.2
FAU_GEN.1 Audit data generation
FAU - Security
audit
No
No
No
No
PP2600.2
FAU_GEN.2 User identity association
No
Yes
Yes
No
CC Part 2
FCS_CKM.1 Cryptographic key
generation
FCS -
Cryptographic
support
No
Yes
Yes
No
CC Part 2
FCS_CKM.2 Cryptographic key
distribution
No
Yes
Yes
Yes
CC Part 2
FCS_COP.1
FCS_COP.1-ipsec Cryptographic
operation
No
Yes
No
Yes
CC Part 2
FCS_COP.1
FCS_COP.1-job Cryptographic
operation
No
Yes
No
Yes
PP2600.2
FDP_ACC.1
FDP_ACC.1-cac Common access
control SFP
FDP - User data
protection
No
Yes
No
Yes
PP2600.2
FDP_ACC.1
FDP_ACC.1-tfac TOE function access
control SFP
No
Yes
No
Yes
PP2600.2
FDP_ACF.1
FDP_ACF.1-cac Common access
control functions
No
Yes
No
Yes
PP2600.2
FDP_ACF.1
FDP_ACF.1-tfac TOE function access
control functions
Yes
Yes
No
No
PP2600.2
FDP_RIP.1 Subset residual
information protection
No
Yes
No
No
PP2600.2
FIA_ATD.1 Local user attribute
definition
FIA - Identification
and
authentication
No
Yes
No
No
CC Part 2
FIA_SOS.1 Verification of secrets
No
Yes
Yes
No
PP2600.2
FIA_UAU.1 Timing of Control Panel
authentication
No
No
Yes
No
PP2600.2
FIA_UAU.2 IPsec authentication
before any action
No
Yes
Yes
No
CC Part 2
FIA_UAU.7 Control Panel protected
authentication feedback
Page 51 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Operations
Source
Base
security
functional
component
Security functional requirement
Security
functional
group Sel.
Ass.
Ref.
Iter.
No
Yes
Yes
No
PP2600.2
FIA_UID.1 Timing of Control Panel
identification
No
No
Yes
No
PP2600.2
FIA_UID.2 IPsec identification before
any action
No
Yes
Yes
No
PP2600.2
FIA_USB.1 User-subject binding
Yes
Yes
No
Yes
CC Part 2
FMT_MOF.1
FMT_MOF.1-auth Management of
authentication security functions
behavior
FMT - Security
management
Yes
Yes
No
Yes
CC Part 2
FMT_MOF.1
FMT_MOF.1-faxforward Management
of Fax Forward and Fax Archive
security functions behavior
Yes
Yes
No
Yes
PP2600.2
FMT_MSA.1
FMT_MSA.1-perm Management of
Permission Set security attributes
Yes
Yes
No
Yes
PP2600.2
FMT_MSA.1
FMT_MSA.1-tfac Management of
TOE function security attributes
Yes
Yes
No
Yes
PP2600.2
FMT_MTD.1
FMT_MTD.1-auth Management of
TSF data
Yes
Yes
No
Yes
PP2600.2
FMT_MTD.1
FMT_MTD.1-users Management of
TSF data
No
Yes
No
No
PP2600.2
FMT_SMF.1 Specification of
management functions
No
Yes
No
No
PP2600.2
FMT_SMR.1 Security roles
No
Yes
No
No
PP2600.2-
SMI
FPT_FDI_EXP.1 Restricted forwarding
of data to external interfaces
FPT - Protection of
the TSF
No
No
No
No
PP2600.2
FPT_STM.1 Reliable time stamps
Yes
Yes
No
No
PP2600.2
FPT_TST.1 TSF testing
No
Yes
Yes
No
PP2600.2
FTA_SSL.3 Control Panel
TSF-initiated termination
FTA - TOE access
Yes
Yes
Yes
No
PP2600.2-
SMI
FTP_ITC.1 Inter-TSF trusted channel
FTP - Trusted
path/channels
Table 22: Security functional requirements for the TOE
Page 52 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
6.1.1 Security audit (FAU)
6.1.1.1 Audit data generation (FAU_GEN.1)
The TSF shall be able to generate an audit record of the following auditable events:
FAU_GEN.1.1
a) Start-up and shutdown of the audit functions; and
b) All auditable events for the not specified level of audit; and
c) All Auditable Events as each is defined for its Audit Level (if one is
specified) for the Relevant SFR in Table 23; none.
The TSF shall record within each audit record at least the following information:
FAU_GEN.1.2
a) Date and time of the event, type of event, subject identity (if applicable),
and the outcome (success or failure) of the event; and
b) For each audit event type, based on the auditable event definitions of the
functional components included in the PP/ST, for each Relevant SFR
listed in Table 23: (1) information as defined by its Audit Level (if
one is specified), and (2) all Additional Information (if any is
required); none.
[PP2600.2]
Additional
information
Audit level
Relevant
SFR(s)
Auditable event
Yes: Common
None required
Basic
FIA_UAU.1,
FIA_UAU.2
Both successful and unsuccessful use of
the authentication mechanism
Yes: Common
Attempted user
identity, if available
Basic
FIA_UID.1,
FIA_UID.2
Both successful and unsuccessful use of
the identification mechanism
Yes: Common
None required
Minimum
FMT_SMF.1
Use of the management functions
Yes: Common
None required
Minimum
FMT_SMR.1
Modifications to the group of users that
are part of a role
Yes: Common
None required
Minimum
FPT_STM.1
Changes to the time
Yes: SMI
None required
Minimum
FTP_ITC.1
Failure of the trusted channel functions
No
None required
Minimum
FTA_SSL.3
Termination of an interactive session by
the session termination mechanism
Table 23: Auditable events
6.1.1.2 User identity association (FAU_GEN.2)
For audit events resulting from actions of identified users, the TSF shall be able
to associate each auditable event with the identity of the user that caused the
event.
FAU_GEN.2.1
Page 53 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
6.1.2 Cryptographic support (FCS)
6.1.2.1 Cryptographic key generation (FCS_CKM.1)
The QuickSec cryptographic library in the Operational Environment TSF shall
generate cryptographic keys in accordance with a specified cryptographic key
generation algorithm defined in Table 24 and specified cryptographic key sizes
defined in Table 24 that meet the following: the standards defined in Table
24.
FCS_CKM.1.1
Standards
Key sizes
(in bits)
Key generation
algorithm
Protocol
[RFC4301] Security Architecture for the Internet
Protocol
128, 192, 256
AES
IPsec
[RFC2404] The Use of HMAC-SHA-1-96 within ESP
and AH;
[RFC4301] Security Architecture for the Internet
Protocol;
[RFC4894] Use of Hash Algorithms in Internet Key
Exchange (IKE) and IPsec
96
HMAC-SHA1-96
[RFC4868] Using HMAC-SHA-256, HMAC-SHA-384,
and HMAC-SHA-512 with IPsec
256
HMAC-SHA-256-128
384
HMAC-SHA-384-196
512
HMAC-SHA-512-256
Table 24: Cryptographic key generation
Application Note: Key generation for FCS_CKM.1 is implemented with the SSH random number
generator described in section 29.5.3 (pages 1044-1045) of [QuickSec51].
6.1.2.2 Cryptographic key distribution (FCS_CKM.2)
The QuickSec cryptographic library in the Operational Environment TSF shall
distribute cryptographic keys in accordance with a specified cryptographic key
distribution method defined in Table 25 that meets the following: the
standards defined in Table 25.
FCS_CKM.2.1
Standards
Key distribution method
Protocol
[RFC2409] The Internet Key Exchange (IKE);
[RFC4109] Algorithms for Internet Key Exchange version 1
(IKEv1)
IKEv1
IPsec
[RFC4306] Diffie-Hellman key agreement method defined for
the IKEv2 protocol;
[RFC4718] IKEv2 Clarifications and Implementation Guidelines
IKEv2
Table 25: Cryptographic key distribution
Page 54 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
6.1.2.3 Cryptographic operation (FCS_COP.1-ipsec)
The QuickSec cryptographic library in the Operational Environment TSF shall
perform the operations defined in Table 26 in accordance with a specified
cryptographic algorithm defined in Table 26 and cryptographic key sizes
defined in Table 26 that meet the following: the standards defined in Table
26.
FCS_COP.1.1
Standards
Key sizes
(in bits)
Algorithm
Operations
Protocol
[PKCS1v1.5] Public-Key Cryptography
Standard (PKCS) #1: RSA Encryption
Standard
1024, 2048,
4096
RSA
Asymmetric
decryption
IPsec
[FIPS197] Advanced Encryption Standard;
[SP800-38A] Recommendation for Block
Cipher Modes of Operation: Methods and
Techniques
128, 192, 256
AES (CBC mode)
Symmetric
encryption and
decryption
[RFC2104] HMAC: Keyed-Hashing for
Message Authentication
96
HMAC-SHA1-96
Data
authentication
[RFC4868] Using HMAC-SHA-256,
HMAC-SHA-384, and HMAC-SHA-512 with
IPsec
256
HMAC-SHA-256-128
384
HMAC-SHA-384-192
512
HMAC-SHA-512-256
Table 26: Cryptographic operations
6.1.2.4 Cryptographic operation (FCS_COP.1-job)
The TSF shall perform the operations defined in Table 27 in accordance with
a specified cryptographic algorithm defined in Table 27 and cryptographic key
sizes defined in Table 27 that meet the following: the standards defined in
Table 27.
FCS_COP.1.1
Standards
Key sizes
(in bits)
Algorithm
Operations
Protocol
[FIPS197] Advanced Encryption Standard;
[SP800-38A] Recommendation for Block
Cipher Modes of Operation
256
AES (CBC mode)
Symmetric
decryption
Print job
Table 27: Cryptographic operations
Page 55 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
6.1.3 User data protection (FDP)
6.1.3.1 Common access control SFP (FDP_ACC.1-cac)
The TSF shall enforce the Common Access Control SFP in Table 28 on the
list of users as subjects, objects, and operations among subjects and
objects covered by the Common Access Control SFP in Table 28.
FDP_ACC.1.1
[PP2600.2]
section
Access control rules
Subject
Operation(s)
Object
Common
For stored copy and print jobs in Job Storage
with the Job PIN attribute set: From the Control
Panel, subjects must be the job owner or know
U.NORMAL
Modify,
Delete
D.FUNC
the Job PIN or have the appropriate non-fax
Job Storage permission in their Permission Set
to delete the job; otherwise, delete access is
denied. D.FUNC for Stored Jobs cannot be
modified by any user, including
U.ADMINISTRATOR.
For encrypted stored print jobs: From the
Control Panel, subjects must know the job's
Job Encryption Password or have the
appropriate non-fax Job Storage permission
in their Permission Set to delete D.FUNC;
otherwise, delete access is denied.
For Receive Fax jobs: Subjects must have the
appropriate permission in their Permission Set
to delete D.FUNC; otherwise, delete access is
denied. Modify access is denied to all subjects.
For Fax Polling Receive jobs: The subject
performing the polling fax function can delete
the received object's D.FUNC (i.e., the TOE
automatically deletes the job at the end of the
function); otherwise, delete access is denied.
Modify access is denied to all subjects.
Common
For stored copy and print jobs in Job Storage
with the Job PIN attribute set: From the Control
Panel, subjects must be the job owner or know
U.NORMAL
Delete
D.DOC
the Job PIN or have the appropriate non-fax
Job Storage permission in their Permission Set
to delete the job; otherwise, delete access is
denied.
For encrypted stored print jobs: From the
Control Panel, subjects must know the job's
Job Encryption Password or have the
appropriate non-fax Job Storage permission
in their Permission Set to delete D.DOC;
otherwise, delete access is denied.
Page 56 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
[PP2600.2]
section
Access control rules
Subject
Operation(s)
Object
For Receive Fax jobs: From the Control Panel,
subjects must have the appropriate permission
in their Permission Set to delete the objects;
otherwise, delete access is denied. By default,
U.NORMAL users do not have the appropriate
permission. (Network access is not possible.)
For Fax Polling Receive jobs: The subject
performing the outbound fax polling function
can delete the job (i.e., the TOE automatically
deletes the job at the end of the function);
otherwise, delete access is denied.
DSR,
Scan jobs are not stored in Job Storage while
the scan is in progress, but in temporary
storage not accessible to any other user. The
U.NORMAL
Read
D.DOC+DSR
D.DOC+SCN SCN
user scanning the document specifies its
disposition (e.g., network folder, email, job
storage) at the time of the scan and the scan
job becomes the job type appropriate for the
requested disposition upon completion of the
scan.
For stored copy jobs in Job Storage with the
Job PIN attribute set: Subjects must be the job
owner or know the Job PIN to read the object;
otherwise, read access is denied.
DSR,
For print jobs in Job Storage with the Job PIN
attribute set: Subjects must be the job owner
or know the Job PIN to read the object;
otherwise, read access is denied.
U.NORMAL
Read
D.DOC+DSR
D.DOC+PRT PRT
For encrypted stored print jobs: Subjects must
know the job's Job Encryption Password to
read the object, otherwise, read access is
denied.
DSR,
(D.DOC+FAXIN+DSR) For Receive Fax jobs:
Subjects must have the appropriate
permission in their Permission Set to read the
objects; otherwise, read access is denied.
U.NORMAL
Read
D.DOC+DSR
D.DOC+FAXIN
D.DOC+FAXOUT
FAX
(D.DOC+FAXIN) For Fax Polling Receive jobs:
The subject performing the outbound fax
polling function can read the object; otherwise,
read access is denied.
(D.DOC+FAXOUT) Send Fax jobs cannot be
read by any subject.
Page 57 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
[PP2600.2]
section
Access control rules
Subject
Operation(s)
Object
CPY
There are no access control restrictions for
read and modify access.
U.NORMAL
Read, Modify
D.DOC+CPY
Table 28: Common Access Control SFP
6.1.3.2 TOE function access control SFP (FDP_ACC.1-tfac)
The TSF shall enforce the TOE Function Access Control SFP on users as
subjects, TOE functions as objects, and the right to use the functions
as operations.
FDP_ACC.1.1
6.1.3.3 Common access control functions (FDP_ACF.1-cac)
The TSF shall enforce the Common Access Control SFP in Table 28 to objects
based on the following: the list of users as subjects and objects controlled
under the Common Access Control SFP in Table 28, and for each, the
indicated security attributes in Table 28.
FDP_ACF.1.1
The TSF shall enforce the following rules to determine if an operation among
controlled subjects and controlled objects is allowed: rules specified in the
Common Access Control SFP in Table 28 governing access among
controlled users as subjects and controlled objects using controlled
operations on controlled objects.
FDP_ACF.1.2
The TSF shall explicitly authorise access of subjects to objects based on the
following additional rules:
FDP_ACF.1.3
● U.ADMINISTRATOR can delete any D.DOC without providing a Job
PIN or Job Encryption Password.
The TSF shall explicitly deny access of subjects to objects based on the following
additional rules: none.
FDP_ACF.1.4
6.1.3.4 TOE function access control functions (FDP_ACF.1-tfac)
The TSF shall enforce the TOE Function Access Control SFP to objects based
on the following: users and the following TOE functions and security
attributes:
FDP_ACF.1.1
● Users: Control Panel users;
Functions: F.CPY, F.DSR, F.FAX, F.PRT, F.SCN, F.SMI;
Security attributes:
❍ User Role as defined by the user's Permission Set
❍ Association of a sign in method to a Control Panel application
● Users: Network Client Computers, Administrative Computer;
Functions: F.DSR, F.PRT, F.SMI;
Security attributes:
❍ User Role as defined by the user's IPsec/Firewall service
templates.
Page 58 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
The TSF shall enforce the following rules to determine if an operation among
controlled subjects and controlled objects is allowed:
FDP_ACF.1.2
● The user is explicitly authorized by U.ADMINISTRATOR to use a
function
● A Network Client Computer that is authorized to use the TOE is
automatically authorized to use the functions F.DSR, F.PRT, F.SMI.
The TSF shall explicitly authorise access of subjects to objects based on the
following additional rules: the user acts in the role U.ADMINISTRATOR,
none.
FDP_ACF.1.3
The TSF shall explicitly deny access of subjects to objects based on the following
additional rules: none.
FDP_ACF.1.4
6.1.3.5 Subset residual information protection (FDP_RIP.1)
The TSF shall ensure that any previous information content of a resource is made
unavailable upon the deallocation of the resource from the following objects:
D.DOC.
FDP_RIP.1.1
6.1.4 Identification and authentication (FIA)
6.1.4.1 Local user attribute definition (FIA_ATD.1)
The TSF shall maintain the following list of security attributes belonging to
individual users:
FIA_ATD.1.1
● Control Panel users:
❍ User Identifier (Access Code and Display Name) for Local Device
Sign In
❍ User Role (defined by Permission Set)
● IPsec users:
❍ User Identifier (defined by IP address)
❍ User Role (defined by IPsec/Firewall service template)
Application Note:
The LDAP and Windows Sign In method security attributes belonging to individual users are not in
FIA_ATD.1 because these attributes are "maintained" independently by the LDAP server and Windows
domain controller, respectively, which are part of the Operational Environment.
6.1.4.2 Verification of secrets (FIA_SOS.1)
The TSF shall provide a mechanism to verify that secrets meet the requirement:
Job PINs shall be 4 digits.
FIA_SOS.1.1
6.1.4.3 Timing of Control Panel authentication (FIA_UAU.1)
The TSF shall allow viewing of the Control Panel help screens and selection
of a sign in method on behalf of the Control Panel user to be performed before
the user is authenticated.
FIA_UAU.1.1
Page 59 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
The TSF shall require each Control Panel user to be successfully authenticated
before allowing any other TSF-mediated actions on behalf of that user.
FIA_UAU.1.2
6.1.4.4 IPsec authentication before any action (FIA_UAU.2)
The TSF shall require each Network Client Computer, Administrative Computer,
and trusted IT product connection user to be successfully authenticated before
allowing any other TSF-mediated actions on behalf of that connection user.
FIA_UAU.2.1
6.1.4.5 Control Panel protected authentication feedback (FIA_UAU.7)
The TSF shall provide only asterisk characters for each
FIA_UAU.7.1
● Access Code digit typed
● Authentication password character typed
● Job PIN digit typed
to the user while the Control Panel authentication is in progress.
6.1.4.6 Timing of Control Panel identification (FIA_UID.1)
The TSF shall allow viewing of the Control Panel help screens and selection
of a sign in method on behalf of the Control Panel user to be performed before
the user is identified.
FIA_UID.1.1
The TSF shall require each Control Panel user to be successfully identified before
allowing any other TSF-mediated actions on behalf of that user.
FIA_UID.1.2
6.1.4.7 IPsec identification before any action (FIA_UID.2)
The TSF shall require each Network Client Computer, Administrative Computer,
and trusted IT product connection user to be successfully identified before allowing
any other TSF-mediated actions on behalf of that connection user.
FIA_UID.2.1
6.1.4.8 User-subject binding (FIA_USB.1)
The TSF shall associate the following user security attributes with subjects acting
on the behalf of that user: User Identifier (Display Name for Local Device
Sign In, user name for both LDAP Sign In and Windows Sign In, IP address
for IPsec) and User Role.
FIA_USB.1.1
Application Note: Incoming analog fax phone line users have no security attributes, but Receive
Fax jobs are owned by U.ADMINISTRATOR.
The TSF shall enforce the following rules on the initial association of user security
attributes with subjects acting on behalf of users: none.
FIA_USB.1.2
The TSF shall enforce the following rules governing changes to the user security
attributes associated with the subjects acting on the behalf of users: none.
FIA_USB.1.3
Page 60 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
6.1.5 Security management (FMT)
6.1.5.1 Management of authentication security functions behavior
(FMT_MOF.1-auth)
The TSF shall restrict the ability to enable, disable the functions "Allow users
to choose alternate sign-in methods" for Control Panel applications to
U.ADMINISTRATOR.
FMT_MOF.1.1
6.1.5.2 Management of Fax Forward and Fax Archive security functions
behavior (FMT_MOF.1-faxforward)
The TSF shall restrict the ability to disable, enable the functions Fax
Forwarding, Fax Archive to U.ADMINISTRATOR.
FMT_MOF.1.1
6.1.5.3 Management of Permission Set security attributes
(FMT_MSA.1-perm)
The TSF shall enforce the Common Access Control SFP in Table 28 and TOE
Function Access Control SFP to restrict the ability to modify, create, delete
the security attributes Permission Sets and Permission Set associations to
U.ADMINISTRATOR.
FMT_MSA.1.1
6.1.5.4 Management of TOE function security attributes (FMT_MSA.1-tfac)
The TSF shall enforce the TOE Function Access Control SFP to restrict the
ability to perform the following operations on the security attributes
FMT_MSA.1.1
● IPsec/Firewall service templates (defining IPsec User Roles): create,
modify, delete operations
● Association of a sign in method to a Control Panel application: modify
operation
to U.ADMINISTRATOR.
6.1.5.5 Management of TSF data (FMT_MTD.1-auth)
The TSF shall restrict the ability to perform operations specified below for
the
FMT_MTD.1.1
● IPsec CA X.509v3 certificate: add, replace, delete operations
● IPsec identity X.509v3 certificate: replace operation
● IPsec/Firewall address templates and rules for IPsec users: create,
modify, delete operations
● IPsec/Firewall address templates, service templates, and rules for
trusted IT products: create, modify, delete operations
to U.ADMINISTRATOR.
6.1.5.6 Management of TSF data (FMT_MTD.1-users)
The TSF shall restrict the ability to modify, delete, initialize the Device User
Accounts to U.ADMINISTRATOR.
FMT_MTD.1.1
Page 61 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
6.1.5.7 Specification of management functions (FMT_SMF.1)
The TSF shall be capable of performing the following management functions:
FMT_SMF.1.1
● Fax forwarding and fax archive management
(FMT_MOF.1-faxforward)
● IPsec/Firewall rules, address templates, and service templates
management (FMT_MSA.1-tfac, FMT_MTD.1-auth)
● IPsec X.509v3 certificate management (FMT_MTD.1-auth)
● Local Device Sign In data (Access Code) management
(FMT_MTD.1-users)
● Permission Set management (FMT_MSA.1-perm)
● Sign in method association management (FMT_MOF.1-auth,
FMT_MSA.1-tfac).
6.1.5.8 Security roles (FMT_SMR.1)
The TSF shall maintain the roles U.ADMINISTRATOR, U.NORMAL.
FMT_SMR.1.1
The TSF shall be able to associate users with roles.
FMT_SMR.1.2
6.1.6 Protection of the TSF (FPT)
6.1.6.1 Restricted forwarding of data to external interfaces
(FPT_FDI_EXP.1)
The TSF shall provide the capability to restrict data received on any external
Interface from being forwarded without further processing by the TSF to any
Shared-medium Interface.
FPT_FDI_EXP.1.1
6.1.6.2 Reliable time stamps (FPT_STM.1)
The TSF shall be able to provide reliable time stamps.
FPT_STM.1.1
6.1.6.3 TSF testing (FPT_TST.1)
The TSF shall run a suite of self tests at the request of the authorised user
to demonstrate the correct operation of
FPT_TST.1.1
● System Clock - timestamp verification
● Local Device Sign In - user Access Code verification
● LDAP Sign In - LDAP settings verification
● Windows Sign In (via Kerberos) - Windows Settings verification.
The TSF shall provide authorised users with the capability to verify the integrity
of
FPT_TST.1.2
● Local Device Sign In database
● Device Administrator Password
● User and administrator authentication configuration data (including
Permission Sets and sign-in method assigned to top-level Control
Panel application).
Page 62 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
The TSF shall provide authorised users with the capability to verify the integrity
of stored TSF executable code.
FPT_TST.1.3
6.1.7 TOE access (FTA)
6.1.7.1 Control Panel TSF-initiated termination (FTA_SSL.3)
The TSF shall terminate an a Control Panel interactive session after a any one of:
FTA_SSL.3.1
● The user starts any job (if configured by U.ADMINISTRATOR)
● 10 seconds after a user starts any job and the user agrees to the
termination (if configured by U.ADMINISTRATOR)
● A period of time, configurable by U.ADMINISTRATOR, of user
inactivity.
6.1.8 Trusted path/channels (FTP)
6.1.8.1 Inter-TSF trusted channel (FTP_ITC.1)
The TSF shall provide a communication channel between itself and another trusted
IT product that is logically distinct from other communication channels and
provides assured identification of its end points and protection of the channel
communicated data from modification or disclosure.
FTP_ITC.1.1
The TSF shall permit the TSF, another trusted IT product to initiate
communication via the trusted channel.
FTP_ITC.1.2
The TSF shall initiate communication via the trusted channel for communication
of D.DOC, D.FUNC, D.PROT, and D.CONF over any Shared-medium
Interface.
FTP_ITC.1.3
6.2 Security Functional Requirements Rationale
6.2.1 Coverage
The following table provides a mapping of SFR to the security objectives, showing that each security
functional requirement addresses at least one security objective.
Objectives
Security functional requirements
O.AUDIT.LOGGED
FAU_GEN.1
O.AUDIT.LOGGED
FAU_GEN.2
O.CONF.NO_ALT,
O.CONF.NO_DIS,
O.DOC.NO_ALT,
O.DOC.NO_DIS,
O.FUNC.NO_ALT,
O.PROT.NO_ALT
FCS_CKM.1
Page 63 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Objectives
Security functional requirements
O.CONF.NO_ALT,
O.CONF.NO_DIS,
O.DOC.NO_ALT,
O.DOC.NO_DIS,
O.FUNC.NO_ALT,
O.PROT.NO_ALT
FCS_CKM.2
O.CONF.NO_ALT,
O.CONF.NO_DIS,
O.DOC.NO_ALT,
O.DOC.NO_DIS,
O.FUNC.NO_ALT,
O.PROT.NO_ALT
FCS_COP.1-ipsec
O.DOC.NO_ALT,
O.DOC.NO_DIS
FCS_COP.1-job
O.DOC.NO_ALT,
O.DOC.NO_DIS,
O.FUNC.NO_ALT
FDP_ACC.1-cac
O.USER.AUTHORIZED
FDP_ACC.1-tfac
O.DOC.NO_ALT,
O.DOC.NO_DIS,
O.FUNC.NO_ALT
FDP_ACF.1-cac
O.USER.AUTHORIZED
FDP_ACF.1-tfac
O.DOC.NO_DIS
FDP_RIP.1
O.USER.AUTHORIZED
FIA_ATD.1
O.USER.AUTHORIZED
FIA_SOS.1
O.INTERFACE.MANAGED,
O.USER.AUTHORIZED
FIA_UAU.1
O.INTERFACE.MANAGED,
O.USER.AUTHORIZED
FIA_UAU.2
O.CONF.NO_DIS
FIA_UAU.7
O.AUDIT.LOGGED,
O.CONF.NO_ALT,
O.CONF.NO_DIS,
O.DOC.NO_ALT,
O.DOC.NO_DIS,
O.FUNC.NO_ALT,
O.INTERFACE.MANAGED,
O.PROT.NO_ALT,
O.USER.AUTHORIZED
FIA_UID.1
Page 64 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Objectives
Security functional requirements
O.AUDIT.LOGGED,
O.CONF.NO_ALT,
O.CONF.NO_DIS,
O.DOC.NO_ALT,
O.DOC.NO_DIS,
O.FUNC.NO_ALT,
O.INTERFACE.MANAGED,
O.PROT.NO_ALT,
O.USER.AUTHORIZED
FIA_UID.2
O.USER.AUTHORIZED
FIA_USB.1
O.PROT.NO_ALT
FMT_MOF.1-auth
O.INTERFACE.MANAGED
FMT_MOF.1-faxforward
O.DOC.NO_ALT,
O.DOC.NO_DIS,
O.FUNC.NO_ALT,
O.USER.AUTHORIZED
FMT_MSA.1-perm
O.USER.AUTHORIZED
FMT_MSA.1-tfac
O.CONF.NO_ALT,
O.CONF.NO_DIS,
O.PROT.NO_ALT
FMT_MTD.1-auth
O.CONF.NO_ALT,
O.CONF.NO_DIS,
O.PROT.NO_ALT
FMT_MTD.1-users
O.CONF.NO_ALT,
O.CONF.NO_DIS,
O.DOC.NO_ALT,
O.DOC.NO_DIS,
O.FUNC.NO_ALT,
O.PROT.NO_ALT
FMT_SMF.1
O.CONF.NO_ALT,
O.CONF.NO_DIS,
O.DOC.NO_ALT,
O.DOC.NO_DIS,
O.FUNC.NO_ALT,
O.PROT.NO_ALT,
O.USER.AUTHORIZED
FMT_SMR.1
O.INTERFACE.MANAGED
FPT_FDI_EXP.1
O.AUDIT.LOGGED
FPT_STM.1
O.SOFTWARE.VERIFIED
FPT_TST.1
O.INTERFACE.MANAGED,
O.USER.AUTHORIZED
FTA_SSL.3
Page 65 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Objectives
Security functional requirements
O.CONF.NO_ALT,
O.CONF.NO_DIS,
O.DOC.NO_ALT,
O.DOC.NO_DIS,
O.FUNC.NO_ALT,
O.PROT.NO_ALT
FTP_ITC.1
Table 29: Mapping of security functional requirements to security objectives
6.2.2 Sufficiency
The following rationale provides justification for each security objective for the TOE, showing that
the security functional requirements are suitable to meet and achieve the security objectives:
Rationale
Security objectives
The objective:
O.AUDIT.LOGGED
● The TOE shall create and maintain a log of TOE use and
security-relevant events, and prevent its unauthorized disclosure
or alteration.
is met by:
● FAU_GEN.1 which enforces audit policies by requiring logging of
relevant events.
● FAU_GEN.2 which enforces audit policies by requiring logging of
information associated with audited events.
● FIA_UID.1 and FIA_UID.2 which support audit policies by associating
user identity with events
● FPT_STM.1 which supports audit policies by requiring time stamps
associated with events.
The objective:
O.CONF.NO_ALT
● The TOE shall protect TSF Confidential Data from unauthorized
alteration.
is met by:
● FCS_CKM.1 which specifies the type of cryptographic keys
generated by the TOE for use with HMAC algorithms in IPsec.
● FCS_CKM.2 which specifies the cryptographic key distribution
methods used by the TOE in IKEv1 and IKEv2 in IPsec.
● FCS_COP.1-ipsec which specifies the RSA decryption algorithms
and HMAC algorithms used by the TOE.
● FIA_UID.1 and FIA_UID.2 which support access control and security
roles by requiring user identification.
● FMT_MTD.1-auth and FMT_MTD.1-users which enforce protection
by restricting access.
● FMT_SMF.1 which supports control of security attributes by requiring
functions to control attributes.
Page 66 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Rationale
Security objectives
● FMT_SMR.1 which supports control of security attributes by requiring
security roles.
● FTP_ITC.1 which enforces protection by requiring the use of trusted
channels for communication of data over Shared-medium Interfaces.
The objective:
O.CONF.NO_DIS
● The TOE shall protect TSF Confidential Data from unauthorized
disclosure.
is met by:
● FCS_CKM.1 which specifies the type of cryptographic keys
generated by the TOE for use with AES in IPsec.
● FCS_CKM.2 which specifies the cryptographic key distribution
methods used by the TOE in IKEv1 and IKEv2 in IPsec.
● FCS_COP.1-ipsec which specifies the AES encryption/decryption
algorithms and the RSA decryption algorithms used by the TOE in
IPsec.
● FIA_UAU.7 which masks the display of certain passwords and PINs
during authentication.
● FIA_UID.1 and FIA_UID.2 which support access control and security
roles by requiring user identification.
● FMT_MTD.1-auth and FMT_MTD.1-users which enforce protection
by restricting access.
● FMT_SMF.1 which supports control of security attributes by requiring
functions to control attributes.
● FMT_SMR.1 which supports control of security attributes by requiring
security roles.
● FTP_ITC.1 which enforces protection by requiring the use of trusted
channels for communication of data over Shared-medium Interfaces.
The objective:
O.DOC.NO_ALT
● The TOE shall protect User Document Data from unauthorized
alteration.
is met by:
● FCS_CKM.1 which specifies the type of cryptographic keys
generated by the TOE for use with HMAC algorithms in IPsec.
● FCS_CKM.2 which specifies the cryptographic key distribution
methods used by the TOE in IKEv1 and IKEv2 in IPsec.
● FCS_COP.1-ipsec which specifies the RSA decryption algorithms
used by the TOE and the HMAC algorithms used by the TOE in IPsec.
● FCS_COP.1-job which specifies the AES decryption algorithm used
by the TOE to process encrypted jobs.
● FDP_ACC.1-cac which enforces protection by establishing an access
control policy.
● FDP_ACF.1-cac which supports access control policy by providing
access control function.
Page 67 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Rationale
Security objectives
● FIA_UID.1 and FIA_UID.2 which support access control and security
roles by requiring user identification.
● FMT_MSA.1-perm which supports access control function by
enforcing control of security attributes.
● FMT_SMF.1 which supports control of security attributes by requiring
functions to control attributes.
● FMT_SMR.1 which supports control of security attributes by requiring
security roles.
● FTP_ITC.1 which enforces protection by requiring the use of trusted
channels for communication of data over Shared-medium Interfaces.
The objective:
O.DOC.NO_DIS
● The TOE shall protect User Document Data from unauthorized
disclosure.
is met by:
● FCS_CKM.1 which specifies the type of cryptographic keys
generated by the TOE for use with AES in IPsec.
● FCS_CKM.2 which specifies the cryptographic key distribution
methods used by the TOE in IKEv1 and IKEv2 in IPsec.
● FCS_COP.1-ipsec which specifies the AES encryption/decryption
algorithms and the RSA decryption algorithms used by the TOE in
IPsec.
● FCS_COP.1-job which specifies the AES decryption algorithm used
by the TOE to process encrypted jobs.
● FDP_ACC.1-cac which enforces protection by establishing an access
control policy.
● FDP_ACF.1-cac which supports access control policy by providing
access control function.
● FDP_RIP.1 which enforces protection by making residual data
unavailable.
● FIA_UID.1 and FIA_UID.2 which support access control and security
roles by requiring user identification.
● FMT_MSA.1-perm which supports access control function by
enforcing control of security attributes.
● FMT_SMF.1 which supports control of security attributes by requiring
functions to control attributes.
● FMT_SMR.1 which supports control of security attributes by requiring
security roles.
● FTP_ITC.1 which enforces protection by requiring the use of trusted
channels for communication of data over Shared-medium Interfaces.
The objective:
O.FUNC.NO_ALT
● The TOE shall protect User Function Data from unauthorized
alteration.
is met by:
Page 68 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Rationale
Security objectives
● FCS_CKM.1 which specifies the type of cryptographic keys
generated by the TOE for use with HMAC algorithms in IPsec.
● FCS_CKM.2 which specifies the cryptographic key distribution
methods used by the TOE in IKEv1 and IKEv2 in IPsec.
● FCS_COP.1-ipsec which specifies the RSA decryption algorithms
used by the TOE and the HMAC algorithms used by the TOE in IPsec.
● FDP_ACC.1-cac which enforces protection by establishing an access
control policy.
● FDP_ACF.1-cac which supports access control policy by providing
access control function.
● FIA_UID.1 and FIA_UID.2 which support access control and security
roles by requiring user identification.
● FMT_MSA.1-perm which supports access control function by
enforcing control of security attributes.
● FMT_SMF.1 which supports control of security attributes by requiring
functions to control attributes.
● FMT_SMR.1 which supports control of security attributes by requiring
security roles.
● FTP_ITC.1 which enforces protection by requiring the use of trusted
channels for communication of data over Shared-medium Interfaces.
The objective:
O.INTERFACE.MANAGED
● The TOE shall manage the operation of external interfaces in
accordance with security policies.
is met by:
● FIA_UAU.1 and FIA_UAU.2 which enforce management of external
interfaces by requiring user authentication.
● FIA_UID.1 and FIA_UID.2 which enforce management of external
interfaces by requiring user identification.
● FMT_MOF.1-faxforward which allows the administrator to allow or
disallow use of the Fax Forward and Fax Archive features.
● FPT_FDI_EXP.1 which enforces management of external interfaces
by requiring (as needed) administrator control of data transmission
from external Interfaces to Shared-medium Interfaces.
● FTA_SSL.3 which enforces management of external interfaces by
terminating inactive sessions.
The objective:
O.PROT.NO_ALT
● The TOE shall protect TSF Protected Data from unauthorized
alteration.
is met by:
● FCS_CKM.1 which specifies the type of cryptographic keys
generated by the TOE for use with HMAC algorithms in IPsec.
● FCS_CKM.2 which specifies the cryptographic key distribution
methods used by the TOE in IKEv1 and IKEv2 in IPsec.
Page 69 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Rationale
Security objectives
● FCS_COP.1-ipsec which specifies the RSA decryption algorithm and
the HMAC algorithms used by the TOE in IPsec.
● FIA_UID.1 and FIA_UID.2 which support access control and security
roles by requiring user identification.
● FMT_MOF.1-auth which specifies the roles that can manage the
selection of sign in methods.
● FMT_MTD.1-auth and FMT_MTD.1-users which enforce protection
by restricting access.
● FMT_SMF.1 which supports control of security attributes by requiring
functions to control attributes.
● FMT_SMR.1 which supports control of security attributes by requiring
security roles.
● FTP_ITC.1 which enforces protection by requiring the use of trusted
channels for communication of data over Shared-medium Interfaces.
The objective:
O.SOFTWARE.VERIFIED
● The TOE shall provide procedures to self-verify executable code in
the TSF.
is met by:
● FPT_TST.1 which enforces verification of software by requiring the
TOE include self-tests.
The objective:
O.USER.AUTHORIZED
● The TOE shall require identification and authentication of Users,
and shall ensure that Users are authorized in accordance with
security policies before allowing them to use the TOE.
is met by:
● FDP_ACC.1-tfac which enforces authorization by establishing an
access control policy.
● FDP_ACF.1-tfac which supports access control policy by providing
access control function.
● FIA_ATD.1 which supports authorization by associating security
attributes with users.
● FIA_SOS.1 which specifies the password/PIN strength of certain
authentication mechanisms.
● FIA_UAU.1 and FIA_UAU.2 which enforce authorization by requiring
user authentication.
● FIA_UID.1 and FIA_UID.2 which enforce authorization by requiring
user identification.
● FIA_USB.1 which enforces authorization by distinguishing subject
security attributes associated with User Roles.
● FMT_MSA.1-perm and FMT_MSA.1-tfac which support access control
function by enforcing control of security attributes.
● FMT_SMR.1 which supports authorization by requiring security roles.
Page 70 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Rationale
Security objectives
● FTA_SSL.3 which enforces authorization by terminating inactive
sessions.
Table 30: Security objectives for the TOE rationale
6.2.3 Security requirements dependency analysis
The following table demonstrates the dependencies of SFRs modeled in CC Part 2 and how the SFRs
for the TOE resolve those dependencies:
Resolution
Dependencies
Security
Functional
Requirement
FPT_STM.1
FPT_STM.1
FAU_GEN.1
FAU_GEN.1
FAU_GEN.1
FAU_GEN.2
FIA_UID.1
FIA_UID.1
FCS_CKM.2
FCS_COP.1-ipsec
[FCS_CKM.2 or FCS_COP.1]
FCS_CKM.1
This dependency is unresolved. The
generated keys are not formally destroyed.
The object reuse mechanisms of the
operating system prevent their use except
in the intended context.
FCS_CKM.4
FCS_CKM.1
[FDP_ITC.1 or FDP_ITC.2 or FCS_CKM.1]
FCS_CKM.2
This dependency is unresolved. The
distributed symmetric keys are not formally
destroyed. The object reuse mechanisms
in the operating system prevent their use
except in the intended context.
FCS_CKM.4
FCS_CKM.1
[FDP_ITC.1 or FDP_ITC.2 or FCS_CKM.1]
FCS_COP.1-ipsec
This dependency is unresolved. The keys
used for encryption, decryption, and data
authentication are not formally destroyed.
FCS_CKM.4
The object reuse mechanisms in the
operating system prevent their use except
in the intended context.
Page 71 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Resolution
Dependencies
Security
Functional
Requirement
This dependency is unresolved. The Client
Computer encrypts the print job prior to
sending the print job to the TOE using an
[FDP_ITC.1 or FDP_ITC.2 or FCS_CKM.1]
FCS_COP.1-job
AES 256-bit key derived from the user's Job
Encryption Password. The TOE requires the
Control Panel user to reenter the same Job
Encryption Password so that the TOE can
derive the same AES 256-bit key in order
to decrypt the print job.
This dependency is unresolved. The key
used for decryption is not formally
destroyed. The object reuse mechanisms
in the operating system prevent their use
except in the intended context.
FCS_CKM.4
FDP_ACF.1-cac
FDP_ACF.1
FDP_ACC.1-cac
FDP_ACF.1-tfac
FDP_ACF.1
FDP_ACC.1-tfac
FDP_ACC.1-cac
FDP_ACC.1
FDP_ACF.1-cac
This dependency is unresolved. The Job
PIN, Job Encryption Password, and
Permission Sets do not have default values
and do not allow for the specification of
alternative initial values.
FMT_MSA.3
FDP_ACC.1-tfac
FDP_ACC.1
FDP_ACF.1-tfac
This dependency is unresolved. The IP
service templates, associations of sign in
method to a Control Panel application, and
FMT_MSA.3
Permission Sets do not have default values
and do not allow for the specification of
alternative initial values.
No dependencies.
FDP_RIP.1
No dependencies.
FIA_ATD.1
No dependencies.
FIA_SOS.1
FIA_UID.1
FIA_UID.1
FIA_UAU.1
FIA_UID.2
FIA_UID.1
FIA_UAU.2
FIA_UAU.1
FIA_UAU.1
FIA_UAU.7
No dependencies.
FIA_UID.1
No dependencies.
FIA_UID.2
Page 72 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Resolution
Dependencies
Security
Functional
Requirement
FIA_ATD.1
FIA_ATD.1
FIA_USB.1
FMT_SMR.1
FMT_SMR.1
FMT_MOF.1-auth
FMT_SMF.1
FMT_SMF.1
FMT_SMR.1
FMT_SMR.1
FMT_MOF.1-
faxforward
FMT_SMF.1
FMT_SMF.1
FDP_ACC.1-cac
FDP_ACC.1-tfac
[FDP_ACC.1 or FDP_IFC.1]
FMT_MSA.1-perm
FMT_SMR.1
FMT_SMR.1
FMT_SMF.1
FMT_SMF.1
FDP_ACC.1-tfac
[FDP_ACC.1 or FDP_IFC.1]
FMT_MSA.1-tfac
FMT_SMR.1
FMT_SMR.1
FMT_SMF.1
FMT_SMF.1
FMT_SMR.1
FMT_SMR.1
FMT_MTD.1-auth
FMT_SMF.1
FMT_SMF.1
FMT_SMR.1
FMT_SMR.1
FMT_MTD.1-users
FMT_SMF.1
FMT_SMF.1
No dependencies.
FMT_SMF.1
FIA_UID.1
FIA_UID.1
FMT_SMR.1
FMT_SMR.1
FMT_SMR.1
FPT_FDI_EXP.1
FMT_SMF.1
FMT_SMF.1
No dependencies.
FPT_STM.1
No dependencies.
FPT_TST.1
No dependencies.
FTA_SSL.3
No dependencies.
FTP_ITC.1
Table 31: TOE SFR dependency analysis
Page 73 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
6.2.4 Internal consistency and mutual support of SFRs
6.3 Security Assurance Requirements
The security assurance requirements for the TOE are the Evaluation Assurance Level 2 components
as specified in [CC] part 3, augmented by ALC_FLR.2.
The following table shows the Security assurance requirements, and the operations performed on
the components according to CC part 3: iteration (Iter.), refinement (Ref.), assignment (Ass.) and
selection (Sel.).
Operations
Source
Security assurance requirement
Security
assurance class
Sel.
Ass.
Ref.
Iter.
No
No
No
No
CC Part 3
ADV_ARC.1 Security architecture description
ADV Development
No
No
No
No
CC Part 3
ADV_FSP.2 Security-enforcing functional
specification
No
No
No
No
CC Part 3
ADV_TDS.1 Basic design
No
No
No
No
CC Part 3
AGD_OPE.1 Operational user guidance
AGD Guidance
documents
No
No
No
No
CC Part 3
AGD_PRE.1 Preparative procedures
No
No
No
No
CC Part 3
ALC_CMC.2 Use of a CM system
ALC Life-cycle
support
No
No
No
No
CC Part 3
ALC_CMS.2 Parts of the TOE CM coverage
No
No
No
No
CC Part 3
ALC_DEL.1 Delivery procedures
No
No
No
No
CC Part 3
ALC_FLR.2 Flaw reporting procedures
No
No
No
No
CC Part 3
ASE_INT.1 ST introduction
ASE Security
Target evaluation
No
No
No
No
CC Part 3
ASE_CCL.1 Conformance claims
No
No
No
No
CC Part 3
ASE_SPD.1 Security problem definition
No
No
No
No
CC Part 3
ASE_OBJ.2 Security objectives
No
No
No
No
CC Part 3
ASE_ECD.1 Extended components definition
No
No
No
No
CC Part 3
ASE_REQ.2 Derived security requirements
No
No
No
No
CC Part 3
ASE_TSS.1 TOE summary specification
No
No
No
No
CC Part 3
ATE_COV.1 Evidence of coverage
ATE Tests
No
No
No
No
CC Part 3
ATE_FUN.1 Functional testing
No
No
No
No
CC Part 3
ATE_IND.2 Independent testing - sample
Page 74 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Operations
Source
Security assurance requirement
Security
assurance class
Sel.
Ass.
Ref.
Iter.
No
No
No
No
CC Part 3
AVA_VAN.2 Vulnerability analysis
AVA Vulnerability
assessment
Table 32: Security assurance requirements
6.4 Security Assurance Requirements Rationale
The evaluation assurance level has been chosen to match a Basic attack potential commensurate
with the threat environment that is experienced by typical consumers of the TOE and commensurate
with [PP2600.2]. In addition, the evaluation assurance level has been augmented with ALC_FLR.2
commensurate with the augmented flaw remediation capabilities offered by the developer beyond
those required by the evaluation assurance level and commensurate with [PP2600.2].
Page 75 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
7 TOE Summary Specification
7.1 TOE Security Functionality
The following section explains how the security functions are implemented by the TOE. The different
TOE security functions cover the various SFR classes.
The primary security features of the TOE are:
● Auditing
● Cryptography
● Identification and authentication
● Data protection and access control
● Protection of the TSF
● TOE access protection
● Trusted channel communication and certificate management
● User and access management
7.1.1 Auditing
The TOE performs auditing of security relevant functions. The TOE connects and sends audit records
to a syslog server (part of the Operational Environment) for long-term storage and audit review.
The records sent to the syslog server by the TOE are only those generated by the TOE while the
syslog server has an established connection with the TOE. If the connection between the TOE and
syslog server breaks and is later reestablished, only records generated by the TOE after the
connection is reestablished are sent to the syslog server. Both the Jetdirect Inside and HCD System
firmware generate audit records.
The types of records generated by the TOE are specified in section 6.1.1.1. Each record includes
the date and time of the event, type of event, subject identity (if applicable), and the outcome
(success or failure) of the event. Events resulting from actions of identified users are associated
with the identity of the user that caused the event.
The subject identity used in the audit record is formed in the following manner. For Local Device
Sign In, the subject's identity contains the user's Display Name prefixed with "LOCAL\". For LDAP
Sign In, the subject's identity contains the user's LDAP user name prefixed with either the LDAP
server's host name or IP address then a backslash. For Windows Sign In, the subject's identity
contains the user's Windows domain name and Windows user name separated by a "\". For IPsec,
the subject's identity is the user's IP address.
The time source used for the audit record timestamps is discussed in section 7.1.5.3.
This section maps to the following SFRs:
● FAU_GEN.1
● FAU_GEN.2
7.1.2 Cryptography
The TOE uses IPsec to protect its communications channels. The QuickSec cryptographic library,
which is part of the Operational Environment, is used to supply the cryptographic algorithms for
IPsec. See section 7.1.7 for more information.
Page 76 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
The TOE supports the decrypting of print jobs encrypted using the Job Encryption Password. The
decryption code used by the TOE is included in the TOE. See section 7.1.4.3 for more information.
7.1.3 Identification and authentication (I&A)
The TOE supports multiple Control Panel sign in methods, both local and remote methods. It also
supports IPsec identification and mutual authentication.
The following interfaces support I&A:
● Control Panel
● IPsec
The following interface allows a user limited TOE access without I&A:
● Analog Fax Phone Line (for incoming analog fax phone line users)
7.1.3.1 Control Panel I&A
The Control Panel interface supports both local and remote sign in methods. The following sign in
methods are allowed with the evaluated configuration:
● Local sign in method:
❍ Local Device Sign In
● Remote sign in methods:
❍ LDAP Sign In
❍ Windows Sign In (via Kerberos)
(The servers for the remote sign in methods are part of the Operational Environment.)
The Control Panel also allows both non-administrative users (U.NORMAL) and administrative users
(U.ADMINISTRATOR) to sign in. Prior to sign in, the Control Panel allows users to select a sign in
method, sign in to the TOE, or get help on various printer functions.
Local Device Sign In is only available through the Control Panel. The TOE contains a local user
database for defining non-administrative (U.NORMAL, by default) device user accounts used to
support the Local Device Sign In mechanism. Each device user account contains the following
security attributes:
● Access Code (8 digits)
● Display Name
The Access Code is a number that serves as both the login user identifier and the authentication
secret. Each user's Access Code is unique from all other Local Device users. In the evaluated
configuration, the Access Code length must be 8 digits, which is the largest length for an Access
Code allowed by the TOE. The length of the Access Code is manually enforced by the administrator.
The one exception is the Local Device Administrator Access Code, also known as the Device
Administrator Password. While stored on the device, this password can be as long as 16 characters
and composed of letters, numbers, and special characters. The Device Administrator Password can
also be used to sign in to EWS or the Web Services interface from a remote computer in addition
to signing in at the Control Panel.
The Display Name is a unique name assigned to the account by the administrator. This name is a
security attribute because it is used in audit records to identify the user. (The Access Code is not
written in the audit records.)
Page 77 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
Like Local Device Sign In, the remote sign in methods are only used by the Control Panel. The TOE
receives authentication credentials from the Control Panel users and passes the credentials to the
remote sign in method. The remote sign in method returns an authentication decision to the TOE.
This decision is then enforced by the TOE by granting or denying access to the Control Panel user.
In the case of LDAP, the user name and password entered at the Control Panel are used to bind to
the LDAP server. The user must have a valid and active LDAP account in order to successfully bind
using this method.
In the case of Kerberos, the user name and password entered at the Control Panel are used to
authenticate with the Windows domain controller. The user must have a valid and active Windows
domain account in order to successfully bind using this method.
When a user successfully logs in to the Control Panel, the Permission Set associated with that user
is bound to that user instance and defines the user's User Role.
When users authenticate through the Control Panel, the TOE displays asterisks for each character
of a PIN, Access Code, or password typed to prevent onlookers from viewing another user's
authentication data.
This section maps to the following SFRs:
● FIA_ATD.1 (Access Code, User Role)
● FIA_UAU.1
● FIA_UAU.7
● FIA_UID.1
● FIA_USB.1
● FMT_SMR.1
7.1.3.2 IPsec I&A
The TOE uses IPsec to identify and mutually authenticate the following user types:
● Administrative Computer (U.ADMINISTRATOR)
● Network Client Computers (U.NORMAL)
IPsec uses IP addresses and X.509v3 certificates via the IKE protocols (IKEv1 and IKEv2) to identify
and authenticate, respectively, a client computer. The TOE contains an X.509v3 identity certificate
and an X.509v3 CA certificate to use for the IPsec mutual authentication. The TOE does not maintain
individual X.509v3 certificates of its client computers.
The User Identity of a client computer is its IP address. The TOE's internal firewall maintains lists
(IPsec/Firewall address templates) of IP addresses of client computers that can connect to the TOE
as a Network Client Computer and as the Administrative Computer. If a client computer has an
unrecognized IP address that is not defined in the IPsec/Firewall as either the Administrative
Computer or a Network Client Computer, then the client computer is not allowed to connect to the
TOE. Similarly, if the client computer presents an invalid or unknown (unrecognized CA) X.509v3
certificate, the IPsec mutual authentication mechanism will fail.
The TOE also uses IP addresses and X.509v3 certificates via the IKE protocols to connect to and
identify other trusted IT products. See section 7.1.7 for more details.
The TOE supports the following versions of the IKE protocol:
● IKEv1 ([RFC2409] and [RFC4109])
● IKEv2 ([RFC4306] and [RFC4718])
Page 78 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
The TOE must use IKE Main Mode for key exchange in the evaluated configuration.
Mutual identification and authentication must be completed before any tasks can be performed by
a Network Client Computer or an Administrative Computer.
The service templates define the User Role of a client computer. The following service templates
are used to define the TOE's User Roles for IPsec users:
● All Services (U.ADMINISTRATOR)
● Client Computers (U.NORMAL)
The All Services service template is provided with the TOE. The Client Computers service template
is created by the administrator as part of the TOE's configuration guidance.
Both the Administrative Computer and the Network Client Computers can access the PJL Interface
on port 9100, but only the Administrative Computer can access the EWS (HTTP) interface, Web
Services interface (OXPd and WS-*), and SNMP interface.
IP address management is discussed in section 7.1.4.5. Certificate management is discussed in
section 7.1.7.
This section maps to the following SFRs:
● FIA_ATD.1
● FIA_UAU.2
● FIA_UID.2
● FIA_USB.1
● FMT_SMR.1
7.1.4 Data protection and access control
7.1.4.1 Permission Sets
For Control Panel users, the TOE uses a user's User Role (as determined by each user's Permission
Set) to determine a user's access to many TOE functions. Only U.ADMINISTRATOR can create,
modify, and delete Permission Sets. In addition, only U.ADMINISTRATOR can create, modify, and
delete the Permission Set associations to users. By default, the TOE includes the following Permission
Sets:
● Device Administrator (U.ADMINISTRATOR)
● Device User (U.NORMAL)
Permissions in a Permission Set include permissions as high-level as copy, print, scan, and fax.
They also include more granular permissions that control administrative functions like the ability
to print a received incoming fax and the ability to delete any non-fax Job Storage job. Each permission
in a Permission Set has two possible values: allowed and disallowed.
This section maps to the following SFRs:
● FMT_MSA.1-perm
● FMT_SMF.1
Page 79 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
7.1.4.2 Job PINs
Users can control access to each print and stored copy job that they place under the TOE's control
by assigning a Job PIN to each job. Job PINs apply only to print jobs and stored copy jobs. A Job PIN
limits access to a stored print or stored copy job while the job resides under the TOE's control and
allows a user to control when the job is printed so that physical access to the hard copies can be
controlled by the user. A Job PIN must be 4 digits (0000-9999) in length. Only one Job PIN is permitted
per job.
A Job PIN can only be assigned to a job at job creation time. They cannot be assigned after the job
already resides under the TOE's control. A user assigns a Job PIN to a stored copy job via the Control
Panel. A user assigns a Job PIN to a print job at the client computer. In the case of the client computer,
the Job PIN is embedded in the print job by the client computer prior to sending the print job to the
TOE. Once the TOE receives a print job containing a Job PIN, the TOE enforces the Job PIN embedded
in that job.
Once a Job PIN is set on a job and the job resides under the TOE's control, the Job PIN cannot be
modified or deleted (i.e., the TOE does not provide the ability to manage Job PINs).
A job with a Job Encryption Password cannot be assigned a Job PIN.
This section maps to the following SFRs:
● FIA_SOS.1
7.1.4.3 Job Encryption Passwords
The TOE can store and decrypt encrypted stored print jobs received from a client computer. A
stored print job is first encrypted by the client computer using a user-specified Job Encryption
Password and AES-256 in CBC mode. The job is then sent encrypted to the TOE and stored encrypted
by the TOE. To decrypt the job, a Control Panel user must enter the correct Job Encryption Password
used to encrypt the job. The decryption algorithm is included in the TOE. Only one Job Encryption
Password is permitted per job.
A Job Encryption Password can only be assigned to a job at job creation time. A user assigns a Job
Encryption Password to a print job via the client computer. Once a Job Encryption Password is set
on a job, it cannot be changed or removed. In addition, a job with a Job Encryption Password cannot
be assigned a Job PIN.
This section maps to the following SFRs:
● FCS_COP.1-job
7.1.4.4 Common access control
The TOE protects each non-fax job in Job Storage from non-administrative users through the use
of a user identifier and a Job PIN or through the use of a Job Encryption Password. The user identifier
for a print job received from a client computer is either assigned by that client computer or assigned
by the user sending the print job from the client computer. For all other types of jobs, the user
identifier is assigned by the TOE. Every non-fax job in Job Storage is assigned either a Job PIN or a
Job Encryption Password by the user at job creation time. If the TOE receives a non-fax job from a
client computer without either a Job PIN or a Job Encryption Password, the TOE cancels the job.
The User Role, as defined by the user's Permission Set, defines each user's access. The default
rules for a non-administrative U.NORMAL User Role for accessing a non-fax job in Job Storage are:
● if the job is Job PIN protected:
Page 80 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
the job owner (i.e., the authenticated user who matches the job's user identifier)
can access (read/delete D.DOC) the job without supplying the Job PIN
❍
❍ any non-owner authenticated user who supplies the correct Job PIN can access
(read/delete D.DOC) the job
● if the job is Job Encryption Password protected, any authenticated user who supplies the
correct Job Encryption Password can access (read/delete D.DOC) the job
By default, a Control Panel administrator (U.ADMINISTRATOR) has a permission in their Permission
Set that allows them to delete non-fax Job Storage jobs (D.DOC).
The TOE protects each fax job in Job Storage through the Permission Set mechanism. A user must
have a specific fax permission in their Permission Set to access (read/delete D.DOC) incoming fax
jobs stored in Job Storage. By default, only U.ADMINISTRATOR has this permission enabled. Faxes
are automatically deleted by the TOE once they are printed.
The Fax Polling Receive function of the TOE allows an authorized user (U.NORMAL) to request a fax
from another fax device over the analog fax phone line via the Control Panel. This is called a Fax
Polling Receive job (D.DOC+FAXIN). The user must be authenticated via the Control Panel to perform
this function. In the evaluated configuration, outbound fax polling requests are allowed.
Any faxes received from a polling request are immediately printed by the TOE and deleted. They
are not stored in Job Storage. This implies that the user is the temporary owner of these faxes, the
user can read these faxes, and the user deletes these faxes. The user cannot modify these faxes.
Scan jobs are ephemeral and not stored in Job Storage. Only the user performing the scan can
access the job on the TOE.
This section maps to the following SFRs:
● FDP_ACC.1-cac
● FDP_ACF.1-cac
7.1.4.5 TOE function access control
The TOE controls Control Panel access to TOE functions through the use of Permission Sets. The
home screen sign in process assigns the Permission Set to the authenticated user's session. This
session Permission Set becomes the user's User Role. Access to each TOE device function is
configurable in a Permission Set by an administrator. A user can perform any function permitted
in the Permission Set that is associated with the user's User Role. Control Panel applications (e.g.,
Copy, Print, Fax) use the user's Permission Set to determine which of the application's functions
should be allowed or disallowed for the user. A Control Panel user can perform the [PP2600.2]
functions of F.CPY, F.DSR, F.FAX, F.PRT, F.SCN, and F.SMI as determined by the user's Permission
Set.
In addition, each Control Panel application has a sign in method mapped to it. This is separate from
the home screen sign in presented by the Control Panel when no user is signed in to the Control
Panel. To access an application, the TOE can require the user to successfully authenticate to the
sign in method mapped to the application. During a user's Control Panel session, the TOE remembers
which sign in methods the user has successfully authenticated against, including the user's home
screen sign in method. This allows the TOE to grant the user immediate access to any applications
that require the same sign in method without prompting for the user's sign in method credentials
again during the session. This session information is discarded when the user signs out.
Page 81 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
The TOE also supports an administrative option to allow users to choose alternate application sign-in
methods. This option allows the administrator to control whether the specific sign in method mapping
to each application is strictly enforced by the TOE (as described in the previous paragraph) or if
users can select an alternate sign in method to access the applications.
For IPsec users, the TOE uses the IPsec/Firewall to control access to the supported network protocols.
The IPsec/Firewall contains the IP addresses of authorized client computers grouped into address
templates and the network service protocols grouped into service templates. The administrator
maps an address template to a service template using an IPsec/Firewall rule. Service templates,
therefore, act as the User Roles for IPsec users. IP addresses of computers not contained in a rule
are denied access to the TOE. The [PP2600.2] functions available to an authorized client computer
are F.DSR, F.PRT, and F.SMI.
This section maps to the following SFRs:
● FDP_ACC.1-tfac
● FDP_ACF.1-tfac
7.1.4.6 Residual information protection
When the TOE deletes an object defined in section 6.1.3.5, the contents of the object are no longer
available to TOE users.
This section maps to the following SFR:
● FDP_RIP.1
7.1.5 Protection of the TSF
7.1.5.1 Restricted forwarding of data to external interfaces (including fax
separation)
The TOE allows an administrator to enable / disable the forwarding of data received from an External
Interface to the Shared-medium Interface. The terms External Interface and Shared-medium Interface
are defined in [PP2600.2] and duplicated in section 8.2 of this Security Target. This implies that an
administrator can configure the TOE to have a distinct functional separation between the analog
fax phone line and the Shared-medium Interface (i.e., network interface) of the TOE. The
administrator can disable the fax feature "Fax Archive" to prevent data from being sent from the
Public Switched Telephone Network (PSTN) to the local network. The administrator can also disable
the Fax Forward feature which receives a fax, then forwards the fax over the phone line to another
fax machine.
This section maps to the following SFR:
● FMT_MOF.1-faxforward
● FPT_FDI_EXP.1
7.1.5.2 TSF self-testing
The EWS interface allows an administrator (U.ADMINISTRATOR) to execute a set of correct operations
tests, TSF Data integrity tests, and integrity tests of TSF executable code. The specific security
related tests available to the administrator are listed in FPT_TST.1. In some cases, the tests can
only be executed if the system is configured to use the feature being tested. For example, the LDAP
Settings verification test requires LDAP Sign In to be configured prior to executing the test. The
tests that may be available during self-test include:
Page 82 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
● Timestamp verification (verify a Network Time Server is configured and responding)
● Device User Access Code verification
● LDAP settings verification
● Windows Setting verification
This section maps to the following SFR:
● FPT_TST.1
7.1.5.3 Reliable timestamps
The TOE contains a system clock that is used to generate reliable timestamps. Only administrators
can manage the system clock.
The administrator must configure the device to synchronize the system clock via a Network Time
Protocol (NTP) server.
This section maps to the following SFR:
● FPT_STM.1
7.1.6 TOE access protection
The following session termination mechanisms are supported by the TOE:
● Inactivity timeout
● Automatic logout
7.1.6.1 Inactivity timeout
The TOE supports an inactivity timeout for Control Panel sessions. If a logged in user is inactive for
longer than the specified period, the user is automatically logged off of the system. The inactivity
period is managed by the administrator via EWS (HTTP) or with WS-* web services. Only one inactivity
period setting exists per TOE.
This section maps to the following SFR:
● FTA_SSL.3
7.1.6.2 Automatic logout
The administrator can optionally configure the TOE to automatically sign users out after starting a
job. The user can be signed out immediately or with a delay of 10 seconds during which time the
user can select to remain signed in. If enabled, after initiating a job, the TOE displays a screen
informing the user of job termination immediately or in 10 seconds. If given the option and the user
chooses to remain signed in, the Inactivity Timeout timer is started.
This section maps to the following SFR:
● FTA_SSL.3
7.1.7 Trusted channel communication and certificate management
Shared-medium communications (i.e., non-fax connections) between the TOE and other trusted IT
products use a trusted channel mechanism to protect the communications from disclosure and
modification. The TOE also ensures the cryptographic operations are validated during policy
Page 83 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
processing such as validating digital signatures or encrypting and decrypting data. The following
table provides a list of the mechanism(s) used to protect these channels and the channels protected
by the mechanism(s).
Initiated by
Network channel
Secure
protocol
TOE
Email connections (SMTP gateway)
IPsec
Administrative Computer
EWS (HTTP) connections (including web browser & certificate
upload)
TOE
Windows domain controller (Kerberos) connections
TOE
LDAP server connections
TOE
NTP connections
Administrative Computer &
Network Client Computer
PJL connections
TOE
Save to Network Folder connections (FTP, CIFS)
TOE
Save to SharePoint connections (flow models only)
Administrative Computer
SNMP connections
TOE
Syslog server connections
Administrative Computer
Web Services connections (OXPd & WS-*)
Table 33: Trusted channel connections
The TOE uses IPsec as means to provide trusted channel communications. IPsec uses X.509v3
certificates, the ESP, ISAKMP, IKEv1, and IKEv2 protocols, and the cryptographic algorithms listed
below to protect communications.
The cryptographic functions used by IPsec are implemented in the QuickSec cryptographic library
version 5.1 ([QuickSec51]) which is produced by SafeNet, Inc. The QuickSec cryptographic library
is part of the Operational Environment, not the TOE. The TOE prepares the data and invokes the
appropriate cryptographic functions, but the code in the QuickSec cryptographic library performs
the processing and calculations required. SafeNet, Inc. performs regular and rigorous developer
testing of the implementation of the cryptographic algorithms in the QuickSec cryptographic library.
In the evaluated configuration, the supported IPsec cryptographic algorithms are:
● RSA 1024-bit, 2048-bit, and 4096-bit (Operational Environment)
● AES-128, AES-192, and AES-256 in CBC mode (Operational Environment)
● HMAC-SHA1-96 (Operational Environment)
● HMAC-SHA-256-128 (Operational Environment)
● HMAC-SHA-384-196 (Operational Environment)
● HMAC-SHA-512-256 (Operational Environment)
IPsec is conformant to the MUST/MUST NOT requirements of the following IETF RFCs:
● [RFC4301] and [RFC4894] for IPsec
Page 84 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
● [RFC4303] for ESP
● [RFC4306] for ISAKMP
● [RFC4109] and [RFC4894] for IKEv1
● [RFC4306], [RFC4718], and [RFC4894] for IKEv2.
The TOE maintains two X.509v3 certificates for IPsec in the Jetdirect certificate store:
● Identity certificate
● Certificate Authority (CA) certificate
The EWS (HTTP) and WS-* interfaces allow administrators to manage these X.509v3 certificates
used by IPsec.
When the TOE is first powered on, the Jetdirect Inside firmware generates its own self-signed identity
certificate, however, this certificate is not permitted in the evaluated configuration. The administrator
is required to replace the self-signed identity certificate created by the TOE when first powered on
with an identity certificate created outside the TOE and signed by a Certificate Authority. The TOE
requires that an identity certificate always exist; therefore, it supports the ability for an administrator
to replace the identity certificate.
The TOE requires a CA certificate, but it does not come with a CA certificate pre-installed. The
administrator must obtain a CA certificate from the Operational Environment, then add the CA
certificate to the TOE when configuring the TOE. The TOE allows an administrator to add, replace,
and delete the CA certificate used by IPsec.
This section maps to the following SFRs:
● FCS_CKM.1
● FCS_CKM.2
● FCS_COP.1-ipsec
● FMT_MOF.1-auth
● FMT_MTD.1-auth
● FMT_SMF.1
● FTP_ITC.1
7.1.8 User and access management
The TOE supports the following roles:
● Administrators (U.ADMINISTRATOR)
● Users (U.NORMAL)
Administrators maintain and configure the TOE and Operational Environment. Users perform the
standard print, copy, fax, etc. functions on the system.
In addition, the TOE performs many security management functions.
Only administrators can configure the list of Network Client Computers and the Administrative
Computer that are allowed to connect to the TOE and the list of other trusted IT products to which
the TOE will connect. Administrators do this by creating, modifying, and deleting IPsec/Firewall
address templates, service templates, and rules via the TOE. Similarly, only administrators can
create, modify, and delete address templates, service templates, and rules via the TOE for trusted
IT products.
Page 85 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
For each Control Panel application, an administrator can modify the association of a sign in method
to an application. (for example, the administrator can associate LDAP Sign In method to the Copy
application). In addition, administrators control if a Control Panel user must use the
administrator-selected sign in method associated with the applications or if the user is allowed to
select an alternate sign in method. This latter feature is controlled through the "Allow users to
choose alternate sign-in methods" checkbox.
Administrators can initialize, modify, and delete Device User Accounts in the Local Device Sign In
database.
It's worth noting that although the following security attributes are enforced by the TOE, the TOE
does not provide functionality to manage these attributes (i.e., the TOE cannot add, change, delete,
or query these attributes on an existing job) and the TOE does not provide default values for these
attributes; therefore, there are no management SFRs specified in this ST for these security attributes:
● Job Encryption Password - The job is encrypted by the Operational Environment. The TOE
does not provide a mechanism to change or delete the password on the job.
● Job PIN - A print job's Job PIN is set by the Operational Environment (i.e., Client Computer).
A copy job's Job PIN is set through the TOE by the user at the creation of the copy job (no
default value is specified by the TOE). The TOE does not provide a mechanism to change
or delete a Job PIN from a print or copy job.
This section maps to the following SFRs:
● FMT_MSA.1-tfac
● FMT_MTD.1-auth
● FMT_MTD.1-users
● FMT_SMF.1
● FMT_SMR.1
Page 86 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
8 Abbreviations, Terminology and References
8.1 Abbreviations
AES
Advanced Encryption Standard
AH
Authentication Header (IPsec)
ASCII
American Standard Code for Information Interchange
CA
Certificate Authority
CBC
Cipher Block Chaining
CIFS
Common Internet File System
DNS
Domain Name System
ESP
Encapsulating Security Payload (IPsec)
EWS
Embedded Web Server
FTP
File Transfer Protocol
HCD
Hardcopy Device
HMAC
Hashed Message Authentication Code
HP
Hewlett-Packard
HTML
Hypertext Markup Language
HTTP
Hypertext Transfer Protocol
IEEE
Institute of Electrical and Electronics Engineers, Inc.
IKE
Internet Key Exchange (IPsec)
IP
Internet Protocol
IPsec
Internet Protocol Security
Page 87 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
ISAKMP
Internet Security Association Key Management Protocol (IPsec)
LCD
Liquid Crystal Display
LDAP
Lightweight Directory Access Protocol
MAC
Message Authentication Code
MFP
Multifunction Product
NFC
Near Field Communication
NTLM
Microsoft NT LAN Manager
NTP
Network Time Protocol
OXP
Open Extensibility Platform
OXPd
OXP device layer
PIN
Personal Identification Number
PJL
Printer Job Language
PRF
Pseudo-random Function
PSTN
Public Switched Telephone Network
RBAC
Role-Based Access Control
SFR
Security Functional Requirement
SHA
Secure Hash Algorithm
SMTP
Simple Mail Transfer Protocol
SNMP
Simple Network Management Protocol
SOAP
Simple Object Access Protocol
Page 88 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
SSH
Secure Shell
TOE
Target of Evaluation
USB
Universal Serial Bus
WINS
Windows Internet Name Service
XML
Extensible Markup Language
8.2 Terminology
This section contains definitions of technical terms that are used with a meaning specific to this
document. Terms defined in the [CC] are not reiterated here, unless stated otherwise.
Administrative User
This term refers to a user with administrative control of the TOE.
Authentication Data
This includes the Access Code and/or password for each user of the product.
Control Panel Application
An application that resides in the firmware and is selectable by the user via the Control Panel.
Device Administrator Password
The password used to restrict access to administrative tasks via EWS and the Control Panel.
This password is also required to associate a user with the Administrator role. In product
documentation, it may also be referred to as the Local Device Administrator Password, Local
Device Administrator Access Code, the Device Password, or the Administrator Password.
External Interface
A non-hardcopy interface where either the input is being received from outside the TOE or the
output is delivered to a destination outside the TOE.
Hardcopy Device (HCD)
This term generically refers to the product models in this Security Target.
Near Field Communication (NFC)
Proximity (within a few inches) radio communication between two or more devices.
Shared-medium Interface
Mechanism for transmitting or receiving data that uses wired or wireless network or non-network
electronic methods over a communications medium which, in conventional practice, is or can
be simultaneously accessed by multiple users.
User Security Attributes
Defined by functional requirement FIA_ATD.1, every user is associated with one or more security
attributes which allow the TOE to enforce its security functions on this user.
Wireless Direct
Wireless local area network (Wi-Fi) support.
Page 89 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
8.3 References
Common Criteria for Information Technology Security Evaluation
CC
3.1R4
Version
September 2012
Date
http://www.commoncriteriaportal.org/files/ccfiles/CCPART1V3.1R4.pdf
Location
http://www.commoncriteriaportal.org/files/ccfiles/CCPART2V3.1R4.pdf
Location
http://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3.1R4.pdf
Location
NIAP CCEVS Policy Letter #20
CCEVS-PL20
2010-11-15
Date
http://www.niap-
ccevs.org/Documents_and_Guidance/ccevs/policy-ltr-20.pdf
Location
Advanced Encryption Standard
FIPS197
2001-11-26
Date
http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
Location
Public-Key Cryptography Standard (PKCS) #1: RSA Encryption Standard
PKCS1v1.5
RSA Laboratories
Author(s)
1.5
Version
November 1993
Date
IEEE Std 2600.2-2009; "2600.2-PP, Protection Profile for Hardcopy
Devices, Operational Environment B" (with NIAP CCEVS Policy Letter #20)
PP2600.2
1.0
Version
December 2009
Date
http://www.niap-ccevs.org/pp/pp_hcd_eal2_v1.0.pdf
Location
SFR Package for Hardcopy Device Copy Functions
PP2600.2-CPY
1.0
Version
December 2009
Date
http://www.niap-ccevs.org/pp/pp_hcd_eal2_v1.0.pdf
Location
SFR Package for Hardcopy Device Document Storage and Retrieval (DSR)
Functions
PP2600.2-DSR
1.0
Version
December 2009
Date
http://www.niap-ccevs.org/pp/pp_hcd_eal2_v1.0.pdf
Location
SFR Package for Hardcopy Device Fax Functions
PP2600.2-FAX
1.0
Version
December 2009
Date
http://www.niap-ccevs.org/pp/pp_hcd_eal2_v1.0.pdf
Location
SFR Package for Hardcopy Device Print Functions
PP2600.2-PRT
1.0
Version
December 2009
Date
http://www.niap-ccevs.org/pp/pp_hcd_eal2_v1.0.pdf
Location
Page 90 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
SFR Package for Hardcopy Device Scan Functions
PP2600.2-SCN
1.0
Version
December 2009
Date
http://www.niap-ccevs.org/pp/pp_hcd_eal2_v1.0.pdf
Location
SFR Package for Hardcopy Device Shared-medium Interface Functions
PP2600.2-SMI
1.0
Version
December 2009
Date
http://www.niap-ccevs.org/pp/pp_hcd_eal2_v1.0.pdf
Location
QuickSec 5.1 Toolkit Reference Manual
QuickSec51
SafeNet, Inc.
Author(s)
1.0
Version
December 2009
Date
HMAC: Keyed-Hashing for Message Authentication
RFC2104
H. Krawczyk, M. Bellare, R. Canetti
Author(s)
1997-02-01
Date
http://www.ietf.org/rfc/rfc2104.txt
Location
The Use of HMAC-SHA-1-96 within ESP and AH
RFC2404
C. Madson, R. Glenn
Author(s)
1998-11-01
Date
http://www.ietf.org/rfc/rfc2404.txt
Location
The Internet Key Exchange (IKE)
RFC2409
D. Harkins, D. Carrel
Author(s)
1998-11-01
Date
http://www.ietf.org/rfc/rfc2409.txt
Location
Algorithms for Internet Key Exchange version 1 (IKEv1)
RFC4109
P. Hoffman
Author(s)
2005-05-01
Date
http://www.ietf.org/rfc/rfc4109.txt
Location
Security Architecture for the Internet Protocol
RFC4301
S. Kent, K. Seo
Author(s)
2005-12-01
Date
http://www.ietf.org/rfc/rfc4301.txt
Location
IP Encapsulating Security Payload (ESP)
RFC4303
S. Kent
Author(s)
2005-12-01
Date
http://www.ietf.org/rfc/rfc4303.txt
Location
Internet Key Exchange (IKEv2) Protocol
RFC4306
C. Kaufman
Author(s)
2005-12-01
Date
http://www.ietf.org/rfc/rfc4306.txt
Location
Page 91 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST
IKEv2 Clarifications and Implementation Guidelines
RFC4718
P. Eronen, P. Hoffman
Author(s)
2006-10-01
Date
http://www.ietf.org/rfc/rfc4718.txt
Location
Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsec
RFC4868
S. Kelly, S. Frankel
Author(s)
2007-05-01
Date
http://www.ietf.org/rfc/rfc4868.txt
Location
Use of Hash Algorithms in Internet Key Exchange (IKE) and IPsec
RFC4894
P. Hoffman
Author(s)
2007-05-01
Date
http://www.ietf.org/rfc/rfc4894.txt
Location
Recommendation for Block Cipher Modes of Operation: Methods and
Techniques
SP800-38A
Morris Dworkin
Author(s)
NIST Special Publication 800-38A 2001 Edition
Version
December 2001
Date
http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Location
Page 92 of 92
Version: 2.0
Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard
Development Company, L.P. or its wholly owned subsidiaries.
Last update: 2014-06-05
Hewlett-Packard Development Company, L.P.
HP LaserJet Enterprise MFP M525, M725, and M830
Series and Color LaserJet Enterprise MFP M575, M775,
and M880 Series Firmware with Jetdirect Inside ST