Kyocera TASKalfa 3500i User manual

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
uly 7, 2011
KYOCERA MITA Corporation
TASKalfa 3500i, TASKalfa 4500i,
TASKalfa 5500i
Data Security Kit (E)
Overseas Version
Security Target
Version 0.80
This document is a translation of the evaluated
and certified security target written in apanese.

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
i
- Revision History -
Date Version
Content of revision Approver Drafter
Nov. 01, 2010
0.50 - Newly drafted Sato Sone
Apr. 21, 2011 0.60 - Updated of the information Sato Sone
May 19, 2011 0.70 - Revised specified items Sato Sone
May 27, 2011 0.75 - Revised specified items Sato Sone
ul. 7, 2011 0.80 - Revised specified items Sato Sone

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
ii
- TABLE OF CONTENTS -
1. ST INTRODUCTION .............................................. 1
1.1. ST R EFERENCE ................................................................................................................................ 1
1.2. TOE R EFERENCE .............................................................................................................................. 1
1.3. TOE O VERVIEW ............................................................................................................................... 1
1.3.1 TOE Type ............................................................................................................................... 1
1.3.2 Usage and Major Security Features of TOE ................................................................... 1
1.3.3 Required Non TOE Hardware/Software/Firmware ....................................................... 2
1.4. TOE D ESCRIPTION .......................................................................................................................... 3
1.4.1. People Associated with the TOE ....................................................................................... 3
1.4.2. Physical Configuration of the TOE ................................................................................... 4
1.4.3. Logical Configuration of the TOE ..................................................................................... 5
1.4.4. Guidance ............................................................................................................................... 7
1.4.5. Assets Protected by the TOE ............................................................................................ 8
2. CONFORMANCE CLAIMS ....................................... 9
2.1. CC C ONFORMANCE C LAIMS ............................................................................................................. 9
2.2. PP C LAIMS ....................................................................................................................................... 9
2.3. P ACKAGE C LAIMS ............................................................................................................................. 9
2.4. C ONFORMANCE R ATIONALE .............................................................................................................. 9
3. SECURITY PROBLEM DEFINITION ........................ 10
3.1. T HREATS ........................................................................................................................................ 10
3.2. O RGANIZATIONAL S ECURITY P OLICIES ........................................................................................... 10
3.3. A SSUMPTIONS ................................................................................................................................ 10
4. SECURITY OB ECTIVES ...................................... 11
4.1. S ECURITY O B ECTIVES FOR THE TOE..............................................................................................11
4.2. S ECURITY O B ECTIVES FOR THE O PERATIONAL E NVIRONMENT ........................................................11
4.3. S ECURITY O B ECTIVES R ATIONALE .................................................................................................11

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
iii
5. EXTENDED COMPONENTS DEFINITION................. 14
6. SECURITY REQUIREMENTS ................................. 15
6.1. TOE S ECURITY F UNCTIONAL R EQUIREMENTS ................................................................................. 15
6.2. TOE S ECURITY A SSURANCE R EQUIREMENTS ................................................................................. 18
6.3. S ECURITY R EQUIREMENTS R ATIONALE ........................................................................................... 18
6.3.1. Security Functional Requirements Rationale ............................................................... 18
6.3.2. Dependent Relations between TOE Security Functional Requirements ................ 19
6.3.3. Rationale for Security Assurance Requirements ........................................................ 20
7. TOE SUMMARY SPECIFICATION ........................... 21
7.1. E NCRYPTION F UNCTION ................................................................................................................. 21
7.2. O VERWRITE - ERASE F UNCTION ....................................................................................................... 22
8. ACRONYMS AND TERMINOLOGY .......................... 23
8.1. D EFINITIONS OF TERMS ................................................................................................................. 23
8.2. D EFINITIONS OF ACRONYMS ........................................................................................................... 24

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
iv
- List of Figures -
F IGURE 1.1 A COMMON USAGE IN OFFICES ..................................................................................................... 2
F IGURE 1.2 P HYSICAL C ONFIGURATION OF THE TOE...................................................................................... 4
F IGURE 1.3 L OGICAL C ONFIGURATION OF THE TOE ....................................................................................... 5

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
v
- List of Tables -
T ABLE 1.1 TOE C OMPATIBLE P RODUCTS ........................................................................................................ 3
T ABLE 1.2 E VALUATED W EB BROWSER ............................................................................................................ 7
T ABLE 1.3 G UIDANCE THAT COMPOSES TOE................................................................................................... 8
T ABLE 4.1 C ORRESPONDENCES BETWEEN ORGANIZATIONAL SECURITY POLICIES AND ASSUMPTIONS , AND
SECURITY OB ECTIVES ........................................................................................................................... 12
T ABLE 6.1 TOE S ECURITY A SSURANCE R EQUIREMENTS ............................................................................... 18
T ABLE 6.2 C ORRESPONDENCES BETWEEN SECURITY OB ECTIVES AND TOE SECURITY FUNCTIONAL
REQUIREMENTS ...................................................................................................................................... 19
T ABLE 6.3 D EPENDENT RELATIONS BETWEEN TOE SECURITY FUNCTIONAL REQUIREMENTS ........................... 20
T ABLE 7.1 TOE SECURITY FUNCTIONS AND SECURITY FUNCTIONAL REQUIREMENTS ...................................... 21
T ABLE 8.1 D EFINITIONS OF TERMS USED IN THIS ST.................................................................................... 23
T ABLE 8.2 D EFINITIONS OF ACRONYMS USED IN THIS ST ............................................................................. 24

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
1
1. ST INTRODUCTION
1.1. ST Reference
ST Title: TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i Data Security Kit
(E) Overseas Version Security Target
ST Version: Version 0.80
Creation Date: uly 7, 2011
Author: KYOCERA MITA Corporation
1.2. TOE Reference
TOE Name: TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i, TASKalfa 3500iG,
TASKalfa 4500iG, TASKalfa 5500iG, CS 3500i, CS 4500i, CS 5500i,
CD 1435, CD 1445, CD 1455, DC 2435, DC 2445, DC 2455
Data Security Kit (E)
TOE Version: V1.00E
Manufacturer: KYOCERA MITA Corporation
1.3. TOE Overview
1.3.1 TOE Type
This TOE defined by this ST, includes the firmware that controls the Multi Function
Printer (hereinafter referred to as “MFP”) having mainly copy function, scan function
and print function, and ASIC having the security algorithm function. The TOE is
installed to be used for the MFPs manufactured by KYOCERA MITA Corporation,
namely, “TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i, TASKalfa 3500iG, TASKalfa
4500iG, TASKalfa 5500iG, CS 3500i, CS 4500i, CS 5500i, CD 1435, CD 1445, CD
1455, DC 2435, DC 2445, DC 2455”. Major security features of the TOE protect the
image data stored in the internal HDD inside the MFP from being removed through an
unauthorized interface.
1.3.2 Usage and Major Security Features of TOE
The MFP in which this TOE is installed is able to perform coping (duplication), printing
(paper outputting) and network scanning (electronization) of various documents
handled by users. The MFP is located in general office and is not only utilized as a
standalone but also connected to LAN for the use in the network environment. In the
network environment, the MFP is assumed to be used by connecting to client PCs or
server on the internal network protected from unauthorized access on the external
network by firewall. And, the MFP is assumed to be used by connecting to Local Port

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
2
(USB Port).
In this user environment, the above-mentioned operational functions can be
performed through operations on the operation panel or from client PCs on the
network or of the local connection.
Figure 1.1 shows a typical user environment.
Figure 1.1 A common usage in offices
The TOE security functions can activate upon agreement and registration of the
license of the optional “Data Security Kit (E)” for the MFP “TASKalfa 3500i, TASKalfa
4500i, TASKalfa 5500i, TASKalfa 3500iG, TASKalfa 4500iG, TASKalfa 5500iG, CS
3500i, CS 4500i, CS 5500i, CD 1435, CD 1445, CD 1455, DC 2435, DC 2445, DC
2455”.
The TOE provides the protected functions against leakage of the user image data
temporarily stored in the internal HDD inside the MFP during and after processing of
each function. When storing the image data into the internal HDD, the image data is
encrypted. When receiving an instruction for deletion of the image data, it disables
re-usage of the data so that even if the HDD is removed and directly accessed
through an interface of the HDD, leakage of the image data can be protected.
1.3.3 Required Non-TOE Hardware/Software/Firmware
To activate the TOE, a certain models of the MFP manufactured by KYOCERA MITA
Corporation are needed. Products in which this TOE can be installed are listed in
Table 1.1.

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
3
Table 1.1 TOE Compatible Products
TOE Name/Version Compatible Product
TASKalfa 3500i, TASKalfa 4500i,
TASKalfa 5500i, TASKalfa 3500iG,
TASKalfa 4500iG, TASKalfa 5500iG,
CS 3500i, CS 4500i, CS 5500i,
CD 1435, CD 1445, CD 1455,
DC 2435, DC 2445, DC 2455
Data Security Kit (E)
V1.00E
TASKalfa 3500i, TASKalfa 4500i,
TASKalfa 5500i, TASKalfa 3500iG,
TASKalfa 4500iG, TASKalfa 5500iG,
CS 3500i, CS 4500i, CS 5500i,
CD 1435, CD 1445, CD 1455,
DC 2435, DC 2445, DC 2455
In order to use the normal functions of the MFP, printer driver, TWAIN driver
(identified by Guidance) and Web browser are needed for client PCs and SMTP server,
SMB server and FTP server are needed for server in the common usage in offices as
shown in Figure 1.1.
1.4. TOE Description
1.4.1. People Associated with the TOE
Roles of people related to the use of the MFP in which the TOE is installed, are defined
as follows:
-Machine Administrator:
A person registered as an administrator of the MFP in which the TOE is installed.
The administrator holds privileges regarding the MFP. He/she installs and uses
devices comprising the MFP in which the TOE is installed, as well as the TOE, and
operates and manages them.
-TOE User:
A person who can use the MFP in which the TOE is installed. He/she can utilize
the copy function, print function, network scan function and document
management box function.
-Service Person:
A person certified by KYOCERA MITA Corporation as a service person of the MFP
in which the TOE is installed. When the service person installs the TOE, she/he
activates and setups (enables operation of) the TOE. Also, she/he performs
maintenance of devices comprising the MFP in which the TOE is installed, as well
as the TOE.

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
4
1.4.2. Physical Configuration of the TOE
The conceptual figure of physical configuration of the TOE is shown in Figure 1.2.
Figure 1.2 Physical Configuration of the TOE
The MFP in which the TOE is installed consists of an operation panel, a scanner unit,
a printer unit, a main board and HDD hardware.
Controller firmware on the main board to control a copy function, a network scan
function, a print function, a document management box function, an administrator
authentication function, a solution platform, an overwrite-erase function and an
encryption function are included in the TOE.
Additionally, special custom IC (ASIC) which share with the control firmware in
installing the security functions is included in the TOE. The ASIC includes a security
algorithm function module, an image processing module and an interface controller
module. From the above-mentioned, the security algorithm function module
overwrites over the specified area in the HDD regarding the overwrite-erase function,
and encrypts the image data when reading and writing into the HDD regarding the
encryption function.
The firmware term as described in this ST includes the meaning of ASIC as well as
Local Port
Intra-net
MFP
Printer Unit
Printer Unit
Product User
TOE
Operation Panel / Scanner Unit
Operation Panel / Scanner Unit
HDD
Main oard
Controller Firmware
Ethernet
Ethernet EEPROM EEPROM
Volatile
Memory
Volatile
Memory
Encryption Function
Copy
Function
User Interface Function
Overwrite-erase Function
Administrator Authentication
Function
Print
Function
Network Scan
Function Box Function
USB
USB
HyPAS Function
ASIC
ASIC
Security
Algorithm Function
Image
Processing
Interface
Control
Local Port
Intra-net
MFP
Printer Unit
Printer Unit
Product User
TOE
Operation Panel / Scanner Unit
Operation Panel / Scanner Unit
HDD
Main oard
Controller Firmware
Ethernet
Ethernet EEPROM EEPROM
Volatile
Memory
Volatile
Memory
Encryption Function
Copy
Function
User Interface Function
Overwrite-erase Function
Administrator Authentication
Function
Print
Function
Network Scan
Function Box Function
USB
USB
HyPAS Function
ASIC
ASIC
Security
Algorithm Function
Image
Processing
Interface
Control
Solution Platform
Product User
TOE

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
5
the controller firmware.
Non-TOE is: the MFP identified by the table 1.1, language file used for performing
user interface function and application software installed on the solution platform.
Physical tamper resistance in hardware (including ASIC) comprising the MFP is not
evaluated.
1.4.3. Logical Configuration of the TOE
The conceptual figure of logical configuration of the TOE is shown in Figure 1.3.
Figure 1.3 Logical Configuration of the TOE
1.4.3.1.Basic Functions provided by the TOE
The TOE provides the following basic functions.
-User Interface Function
A function that receives inputs or operations from the operation panel for machine
administrators, TOE users and service persons to utilize the MFP functions. It
also makes displays on the operation panel.
Encryption Function
MFP
Copy
Function
User Interface Function
Overwrite-erase
Function
TOE
Operation Panel / Scanner Unit
Printer Unit
HyPAS
Function Print
Function
Network
Scan Function
Client PC
Client PC
Data flow of the copy function
Data flow of the network scan function
Data flow of the print function
Image Data File
（Stored data、Residue data）
Box
Function
Data flow of the box function
HDD
Timing for completion
Overwrite-erase processing
Administrator
Authentication
Function
Encryption Function
MFP
Copy
Function
User Interface Function
Overwrite-erase
Function
TOE
Operation Panel / Scanner Unit
Printer Unit
HyPAS
Function Print
Function
Network
Scan Function
Client PC
Client PC
Data flow of the copy function
Data flow of the network scan function
Data flow of the print function
Image Data File
（Stored data、Residue data）
Box
Function
Data flow of the box function
HDD
Timing for completion
Overwrite-erase processing
Administrator
Authentication
Function
Solution
Platform
Timing for completion
Overwrite
-
erase processing
Data flow of the copy function
Data flow of the network scan function
Data flow of the print function
Data flow of the box function

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
6
-Administrator Authentication Function
A function that identifies and authenticates a machine administrator by a
password of the machine administrator inputted from the operation panel.
However, this function is not the security function that is provided by the TOE.
-Copy Function
A function that reads image data from the scanner of the MFP, and outputs from
the printer unit of the MFP by inputting or operating from the operation panel.
-Network Scan Function
A function that transmits image data to client PCs by inputting or operating from
the operation panel.
-Print Function
A function that outputs image data transmitted from the client PCs connected over
LAN or local, from the printer unit of the MFP by operating from the client PCs.
-Document Management Box Function
A function that stores image data in the HDD for a long period of time.
The image data inputted from the operation panel or the client PCs connected over
LAN or local is stored in the HDD for a long period of time by inputting/operating
from the operation panel or operating through the client PCs. The image data
stored in the HDD for a long period of time can be printed out and forwarded to the
client PCs. Anyone can be unrestricted access to the image data. The image
data stored over a long period of time can be deleted as well.
-Solution Platform (HyPAS)
The MFP in which the TOE is installed, can be used by installing an application
software which makes daily operations more efficient. Solution platform is the
function that installs the application software and activates it in the MFP. The
application software that is installed is however, outside of the TOE scope.
A web browser can be used for the operation from client PC when the document
management box function is used. The web browser supported by TOE and the
evaluated web browser are as follows.

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
7
Table 1.2 Evaluated Web browser
Web browsers supported by TOE Evaluated Web browser
- Microsoft Internet Explorer 7 or later
- Mozilla FireFox 3.5 or later
- Safari 4.0 or later
- Microsoft Internet Explorer 8.0
1.4.3.2. Security Functions provided by the TOE
The TOE provides the following functions as the security function.
-Encryption Function
There is an encryption function for a purpose of being against attacks of leakage
of the image data stored in the HDD.
When operating the basic functions such as the copy function, the network scan
function, the print function and the document management box function, MFP
stores image data in the HDD. The encryption function is a function that encrypts
and stores the image data when image data is stored in the HDD. The encryption
function also reads out the image data by decrypting the encrypted image data
when performing the above-mentioned basic functions, and when reading out the
image data stored in the HDD
A cryptographic key used for encryption is generated to be an identical and unique
number on the MFP basis, every time each MFP is powered on, and is stored in a
volatile memory. That is, the cryptography key is not stored inside the MFP in a
state that power of the MFP is turned off.
-Overwrite-Erase Function
In addition to the logical and conventional deletion process, there is the
overwrite-erase function for a purpose of further enhancing security.
After process of the basic functions such as the copy function, the network scan
function, the print function and the document management box function is
completed, or after the cancellation made by cancel operation during these
processing are completed, MFP deletes used image data in the HDD. The
overwrite-erase function is the function that logically deletes not only the
management information of the stored image data in the HDD, but also entirely
overwrites and erases the actual image data area so that it disables re-usage of
the data when receiving an instruction for deletion of the stored image data in the
HDD
1.4.4. Guidance
Guidance comprising this TOE is shown as below.

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
8
Table 1.3 Guidance that composes TOE
Type Name Version Destination
Data Security Kit (E) Operation Guide Rev.3 2011.3
Overseas
Notice 303MS56320
2011.5
Overseas
Data Security Kit (E) Operation Guide Set-up
Edition
303MS56710
2008.12
Overseas
3500i/4500i/5500i Operation Guide 2LHKMEN101
Rev.1 2011.4
Overseas
User
Manual
CD 1435/DC 2435 CD 1445/DC 2445
CD 1455/DC 2455 Operation Guide
2LHUTEN001
Rev.1 2011.4
Overseas
Service
Manual
TASKalfa 3500i/4500i/5500i Service Manual 2LHSM060
2011.3
Overseas
1.4.5. Assets Protected by the TOE
A common MFP temporarily stores the data in the storage area before operating
the function of copy, print and network scan. After the job is completed, the data
will be deleted. The management area is however, only logically deleted. Thus
either during the operation of each function, or in the event that real-time
processing (output) can not be done due to a printer being out of paper, etc., the
image data stays stored in the HDD, and even after the processing is completed,
the actual data area will remain as residual information. The residual information,
as well as the temporary stored image data, contains the identical data as the data
processed by the each function. Therefore, it is potentially possible for the entire
data to be stolen if the HDD is pulled out from the MFP.
Thus, the assets that should be protected by the TOE are described as follows:
-Residue Data
Remaining data after image data stored in the HDD temporarily or for a long
period of time is logically deleted from the HDD.
-Temporary Stored Data
Image data that is temporarily stored in the HDD when operating the copy,
print and network scan functions.
The above-mentioned data is stored in the image data file in the HDD.

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
9
2. CONFORMANCE CLAIMS
2.1. CC Conformance Claims
This ST and TOE conform to the following evaluation standards for information
security (CC):
Part 1: Introduction and general model
uly 2009, Version 3.1 Revision 3 Final version
Part 2: Security functional components
uly 2009, Version 3.1 Revision 3 Final version
Part 3: Security assurance components
uly 2009, Version 3.1 Revision 3 Final version
The security functional requirements of this ST conform to CC Part 2.
The security assurance requirements of this ST conform to CC Part 3.
2.2. PP Claims
There is no applicable Protection Profile.
2.3. Package Claims
This ST conforms to EAL3.
2.4. Conformance Rationale
There is no applicable PP rationale since this ST does not conform to PP.

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
10
3. SECURITY PROBLEM DEFINITION
This chapter describes threats, organizational security policies and assumptions.
3.1. Threats
There is no threat that the TOE assumes.
3.2. Organizational Security Policies
Organizational security policies that the TOE must comply with are as follows.
P.OVERWRITE: Overwrite-erase of the residue data.
As a requirement of the organization, it shall be impossible to reuse the residue data
of the HDD to prevent unauthorized read the residue data.
P.ENCRYPT: Encryption of the temporary stored data.
As a requirement of the organization, the temporary stored data of the HDD shall be
encrypted to prevent unauthorized read the temporary stored data.
3.3. Assumptions
The assumptions for the TOE are described as follows:
A.LOCATION: Safe security of the TOE in the operational environment
It is assumed that the MFP operates in the managed environment to prevent the
security breach of TOE by the attack that might be done to the hardware of MFP.
A.NETWORK: Safety of the TOE from the external network
It is assumed that the TOE is used by connecting to the internal network that is
protected against unauthorized access from the external network.
A.CE: The service person reliability
It is assumed that the service person is a reliable person and does not act
unfaithfully.

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
11
4. SECURITY OB ECTIVES
This chapter describes the security objectives for the TOE, the security objectives for
the operational environment and the security objectives rationale.
4.1. Security Objectives for the TOE
The security objectives for the TOE are described as follows:
O.OVERWRITE: Overwrite-erase of the residue data
The TOE must ensure that any previous information content of a resource (the actual
data area) is made unavailable upon the deallocation of the resource from the image
data file stored in the HDD.
O.ENCRYPT: Prevention of the stored data from being decoded
The TOE must ensure that the image data stored in the HDD is encrypted and is not
illegally decoded.
4.2. Security Objectives for the Operational Environment
The security objectives to be implemented by the TOE operational environment are
described as follows:
OE.LOCATION: Protection of the TOE and assets in the environment
The MFP should operate in the managed environment, and prevent the attack to
hardware that composes MFP.
OE.NETWORK: Prevention of the TOE from the external network
The TOE-connected internal network must prevent the attacks from the external
network by placing the devices such as the firewall etc.
OE.CE: Confirmation of the service person
When the service person performs maintenance on the TOE, confirmation must be
made if the person is an authorized service person.
4.3. Security Objectives Rationale
The corresponding relations between assumptions, threats and organizational
security policies, and security objectives are shown in the table below. It indicates
that the security objectives correspond to at least one of assumptions, threats and
organizational security policies.

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
12
Table 4.1 Correspondences between organizational security policies and
assumptions, and security objectives
Organizational security policies
/Assumptions
Security Objectives
P.OVERWRITE P.ENCRYPT A.LOCATION A.NETWORK A.CE
O.OVERWRITE X
O.ENCRYPT X
OE.LOCATION X
OE.NETWORK X
OE.CE X
“Table 4.1 correspondences between organizational security policies and
assumptions, and security objectives” rationale is described below.
P.OVERWRITE
It is requested to be impossible to reuse the residue data of the HDD to prevent
unauthorized read as a requirement of the organization by security policy
P.OVERWRITE of the organization. As a countermeasure, by the security objectives
O.OVERWRITE, in the image data file that is stored in the HDD, can not be reused to
ensure that any previous information released from the resource allocation of the
area, the P.OVERWRITE can be realized.
P.ENCRYPT
It is requested that the temporary stored data is encrypted to prevent unauthorized
read as a requirement of the organization by security policy P.ENCRYPT of the
organization. As a countermeasure, by the security objectives O.ENCRYPT,
encrypting the image data stored in the HDD and in guaranteeing to unable to
decrypt the data besides with the same code key, the P.ENCRYPT can be realized.
A.LOCATION
The assumption of A.LOCATION requires that the TOE operates in the managed
environment to prevent the hardware of the MFP from the TOE security breach.
This is to protect the TOE from security breaches on the hardware of the MFP, to limit
the attack methods and the opportunity of attack. By the measures OE.LOCATION,
MFP is operated in the managed environment, and the limitation of the attack to
hardware that composes the MFP, the attack method and the opportunity of the

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
13
attack are limited, and A.LOCATION can be realized.
A.NETWORK
The assumption of A.NETWORK requires that the TOE is connected to the internal
network protected from unauthorized access via the external network. The purpose
is to prevent the TOE from access by uncertain number of unauthorized persons in
order to restrict the attack methods and the attack possibilities by uncertain number
of unauthorized agents through the external network. By OE.NETWORK, the
TOE-connected internal network has the devices such as firewall to defend the
attacks to the TOE against the access from the external network so that the attack
methods and the attack possibilities by uncertain number of threat agents from the
external network are restricted and then A.NETWORK can be achieved.
A.CE
The assumption of A.NETWORK requires that the service person who performs
maintenance on the TOE is reliable person. The purpose is that the service person
who performs maintenance on the TOE does not act unfaithfully. By OE.CE, when
the service person performs maintenance on the TOE, confirmation will be made if
the person is the authorized service person so that the service person who performs
maintenance on the TOE will be restricted as the person who does not act unfaithfully.
Then A.CE can be achieved.

TASKalfa 3500i, TASKalfa 4500i, TASKalfa 5500i
Data Security Kit (E) Overseas Version Security Target
© 2011 KYOCERA MITA Corporation
14
5. EXTENDED COMPONENTS DEFINITION
Extended components are not defined.