lexma X548 User manual

Lexmark Multi-Function Printers Security Target
Lexmark X548, XS548, X748, X792, XS796,
X925, XS925, X950, X952, X954, XS955 and
6500e Scanner (with T650, T652, or T654
Printer) Multi-Function Printers
Security Target
Version 1.11
September 22, 2014
Lexmark International, Inc.
740 New Circle Road
Lexington, KY 40550

Lexmark Multi-Function Printers Security Target
2
DOCUMENT INTRODUCTION
Prepared By:
Common Criteria Consulting LLC
15804 Laughlin Lane
Silver Spring, MD 20906
http://www.consulting-cc.com
Prepared For:
Lexmark International, Inc.
740 New Circle Road
Lexington, KY 40550
http://www.lexmark.com
This document provides the basis for an evaluation of a specific Target of Evaluation (TOE), the
Lexmark X548, XS548, X748, X792, XS796, X925, XS925, X950, X952, X954, XS955 and
6500e Scanner (with T650, T652, or T654 Printer) Multi-Function Printers. This Security Target
(ST) defines a set of assumptions about the aspects of the environment, a list of threats that the
product intends to counter, a set of security objectives, a set of security requirements and the IT
security functions provided by the TOE which meet the set of requirements.
Various text from clauses 5, 7-9, and 12 reprinted with permission from IEEE, 445 Hoes Lane,
Piscataway, New Jersey 08855, from IEEE "2600.2™-2009 Standard for a Protection Profile in
Operational Environment B", Copyright © 2009 IEEE. All rights reserved.
REVISION HISTORY
Rev Description
1.0 January 13, 2011, initial release
1.1 January 19, 2011, addressed lab EORs
1.2 January 24, 2011, addressed lab EORs
1.3 May 4, 2011, enabled management via the touch panel and addressed FSP consistency
1.4 October 28, 2011, inserted CAVP certificate numbers, deleted references to Lexlink and
Netware
1.5 December 7, 2011, addressed TVOR comments, updated MFP versions
1.6 December 12, 2011, updated MFP version
1.7 December 14, 2011, updated MFP version for 6500e
1.8 February 23, 2012, Addressed FVOR comments
1.9 March 15, 2012, Code update to address a PJL vulnerability
1.10 July 17, 2012, Added the X748 as an additional MFP model
1.11 September 22, 2014, Assurance Continuity for new code version

Lexmark Multi-Function Printers Security Target
3
TABLE OF CONTENTS
1. SECURITY TARGET INTRODUCTION.................................................................9
1.1 Security Target Reference..........................................................................................9
1.2 TOE Reference............................................................................................................ 9
1.3 Evaluation Assurance Level.......................................................................................9
1.4 Keywords.....................................................................................................................9
1.5 TOE Overview............................................................................................................. 9
1.5.1 Usage and Major Security Features........................................................................... 9
1.5.2 TOE type.................................................................................................................. 10
1.5.3 Required Non-TOE Hardware/Software/Firmware................................................. 10
1.6 TOE Description .......................................................................................................10
1.6.1 Users ........................................................................................................................ 12
1.6.2 Objects (Assets)....................................................................................................... 13
1.6.2.1 User Data .............................................................................................................. 13
1.6.2.2 TSF Data............................................................................................................... 14
1.6.2.3 Functions............................................................................................................... 14
1.6.3 Operations................................................................................................................ 15
1.6.4 Channels................................................................................................................... 15
1.7 Physical Boundary....................................................................................................15
1.8 Logical Boundary......................................................................................................15
1.8.1 Audit Generation...................................................................................................... 15
1.8.2 Identification and Authentication ............................................................................ 15
1.8.3 Access Control......................................................................................................... 15
1.8.4 Management............................................................................................................. 16
1.8.5 Operator Panel Lockout........................................................................................... 16
1.8.6 Fax Separation ......................................................................................................... 16
1.8.7 Hard Disk Encryption.............................................................................................. 16
1.8.8 Disk Wiping............................................................................................................. 16
1.8.9 Secure Communication............................................................................................ 16
1.8.10 Self Test................................................................................................................. 16
1.9 TOE Data...................................................................................................................16
1.9.1 TSF Data.................................................................................................................. 16
1.9.2 Authentication Data................................................................................................. 19
1.9.3 Security Attributes................................................................................................... 19
1.9.4 User Data ................................................................................................................. 20
1.10 Evaluated Configuration........................................................................................20
1.11 Rationale for Non-Bypassability and Separation.................................................22
2. CONFORMANCE CLAIMS..................................................................................... 24
2.1 Common Criteria Conformance.............................................................................. 24
2.2 Protection Profile Conformance.............................................................................. 24
2.3 Security Requirement Package Conformance .......................................................24
3. SECURITY PROBLEM DEFINITION ................................................................... 25
3.1 Introduction...............................................................................................................25
3.2 Assumptions...............................................................................................................25
3.3 Threats.......................................................................................................................25

Lexmark Multi-Function Printers Security Target
4
3.4 Organisational Security Policies..............................................................................26
4. SECURITY OBJECTIVES........................................................................................27
4.1 Security Objectives for the TOE .............................................................................27
4.2 Security Objectives for the Operational Environment..........................................27
5. EXTENDED COMPONENTS DEFINITION ......................................................... 29
5.1 Extended Security Functional Components........................................................... 29
5.1.1 FPT_FDI_EXP Restricted forwarding of data to external interfaces...................... 29
FPT_FDI_EXP.1............................................................................................................... 30
5.2 Extended Security Assurance Components............................................................ 30
6. SECURITY REQUIREMENTS................................................................................ 31
6.1 TOE Security Functional Requirements ................................................................31
6.1.1 Security Audit (FAU) .............................................................................................. 31
6.1.1.1 FAU_GEN.1 Audit Data Generation.................................................................... 31
6.1.1.2 FAU_GEN.2 User Identity Association ............................................................... 33
6.1.2 Cryptographic Support (FCS).................................................................................. 33
6.1.2.1 FCS_CKM.1 Cryptographic Key Generation....................................................... 33
6.1.2.2 FCS_CKM.4 Cryptographic Key Destruction...................................................... 33
6.1.2.3 FCS_COP.1 Cryptographic Operation ................................................................. 33
6.1.3 User Data Protection (FDP)..................................................................................... 34
6.1.3.1 FDP_ACC.1 Subset Access Control..................................................................... 34
6.1.3.2 FDP_ACF.1 Security Attribute Based Access Control ........................................34
6.1.3.3 FDP_RIP.1 Subset Residual Information Protection............................................ 37
6.1.4 Identification and Authentication (FIA) ..................................................................37
6.1.4.1 FIA_AFL.1 Authentication Failure Handling....................................................... 37
6.1.4.2 FIA_ATD.1 User Attribute Definition ................................................................. 37
6.1.4.3 FIA_UAU.1 Timing of Authentication................................................................. 37
6.1.4.4 FIA_UAU.7 Protected Authentication Feedback................................................. 38
6.1.4.5 FIA_UID.1 Timing of Identification ....................................................................38
6.1.4.6 FIA_USB.1 User-Subject Binding ....................................................................... 38
6.1.5 Security Management (FMT) .................................................................................. 39
6.1.5.1 FMT_MOF.1 Management of Security Functions Behaviour.............................. 39
6.1.5.2 FMT_MSA.1 Management of Security Attributes............................................... 39
6.1.5.3 FMT_MSA.3 Static Attribute Initialisation.......................................................... 39
6.1.5.4 FMT_MTD.1 Management of TSF Data.............................................................. 39
6.1.5.5 FMT_SMF.1 Specification of Management Functions........................................ 41
6.1.5.6 FMT_SMR.1 Security Roles ................................................................................ 41
6.1.6 Protection of the TSF (FPT) .................................................................................... 43
6.1.6.1 FPT_FDI_EXP.1 Restricted forwarding of data to external interfaces................ 43
6.1.6.2 FPT_STM.1 Reliable Time Stamps...................................................................... 43
6.1.6.3 FPT_TST.1 TSF Testing....................................................................................... 43
6.1.7 TOE Access (FTA).................................................................................................. 43
6.1.7.1 FTA_SSL.3 TSF-Initiated Termination................................................................ 43
6.1.8 Trusted Path/Channels (FTP)................................................................................... 43
6.1.8.1 FTP_ITC.1 Inter-TSF Trusted Channel................................................................ 43
6.2 TOE Security Assurance Requirements................................................................. 43

Lexmark Multi-Function Printers Security Target
5
6.3 CC Component Hierarchies and Dependencies..................................................... 44
7. TOE SUMMARY SPECIFICATION....................................................................... 46
7.1 Security Functions ....................................................................................................46
7.1.1 Audit Generation...................................................................................................... 46
7.1.2 Identification and Authentication ............................................................................ 47
7.1.2.1 Backup Password.................................................................................................. 48
7.1.3 Access Control......................................................................................................... 48
7.1.3.1 Internal Account Building Blocks ........................................................................ 52
7.1.3.2 LDAP+GSSAPI and PKI Auth Building Blocks..................................................52
7.1.3.3 Common Processing .............................................................................................52
7.1.3.4 Function Access Control....................................................................................... 53
7.1.3.5 Postscript Access Control..................................................................................... 54
7.1.4 Management............................................................................................................. 55
7.1.4.1 Reports Menu........................................................................................................ 55
7.1.4.2 Network/Ports Menu............................................................................................. 55
7.1.4.3 Security Menu....................................................................................................... 55
7.1.4.4 Settings Menu .......................................................................................................58
7.1.4.5 Security Reset Jumper........................................................................................... 59
7.1.5 Operator Panel Lockout........................................................................................... 60
7.1.6 Fax Separation ......................................................................................................... 60
7.1.7 Hard Disk Encryption.............................................................................................. 61
7.1.8 Disk Wiping............................................................................................................. 61
7.1.9 Secure Communications ..........................................................................................62
7.1.10 Self Test................................................................................................................. 62
8. PROTECTION PROFILE CLAIMS........................................................................63
8.1 TOE Type Consistency.............................................................................................63
8.2 Security Problem Definition Consistency...............................................................63
8.3 Security Objectives Consistency..............................................................................63
8.4 Security Functional Requirements Consistency ....................................................63
8.5 Security Assurance Requirements Consistency..................................................... 64
9. RATIONALE .............................................................................................................. 65
9.1 Rationale for IT Security Objectives....................................................................... 65
9.1.1 Rationale Showing Threats to Security Objectives ................................................. 65
9.1.2 Rationale Showing Policies to Security Objectives................................................. 66
9.1.3 Rationale Showing Assumptions to Environment Security Objectives................... 67
9.2 Security Requirements Rationale............................................................................68
9.2.1 Rationale for Security Functional Requirements of the TOE Objectives................ 68
9.2.2 Security Assurance Requirements Rationale........................................................... 71
9.3 TOE Summary Specification Rationale..................................................................71

Lexmark Multi-Function Printers Security Target
6
LIST OF FIGURES
Figure 1 - TOE Model ................................................................................................... 12
LIST OF TABLES
Table 1 - Technical Characteristics of the MFP Models.............................................. 11
Table 2 - Technical Characteristics of the Integrated Printer Models.......................... 11
Table 3 - Notational prefix conventions....................................................................... 12
Table 4 - Users ............................................................................................................. 13
Table 5 - User Data ...................................................................................................... 13
Table 6 - TSF Data....................................................................................................... 14
Table 7 - Functions....................................................................................................... 14
Table 8 - TSF Data....................................................................................................... 16
Table 9 - Authentication Data...................................................................................... 19
Table 10 - Security Attributes.................................................................................... 20
Table 11 - User Data .................................................................................................. 20
Table 12 - Source-Destination Combinations............................................................ 22
Table 13 - Assumptions.............................................................................................. 25
Table 14 - Threats....................................................................................................... 25
Table 15 - Organizational Security Policies for the TOE .......................................... 26
Table 16 - Security Objectives for the TOE............................................................... 27
Table 17 - Security Objectives of the Operational Environment............................... 27
Table 18 - Audit data requirements............................................................................ 31
Table 19 - Cryptographic Operations......................................................................... 33
Table 20 - Common Access Control SFP Rules ........................................................ 35
Table 21 - Management of Security Functions Behaviour......................................... 39
Table 22 - TSF Data................................................................................................... 40
Table 23 - FMT_SMR.1 Detail.................................................................................. 42
Table 24 - EAL2+ Assurance Requirements.............................................................. 44
Table 25 - TOE SFR Dependency Rationale ............................................................. 44
Table 26 - Access Control Items................................................................................ 49
Table 27 - TOE Function Access Control SFP Rules................................................ 53
Table 28 - Network/Ports Menu TSF Data ................................................................55

Lexmark Multi-Function Printers Security Target
7
Table 29 - Security Menu TSF Data .......................................................................... 55
Table 30 - General Settings Menu TSF Data ............................................................. 58
Table 31 - Fax Settings Menu TSF Data.................................................................... 58
Table 32 - Email Settings Menu TSF Data ................................................................ 59
Table 33 - Print Settings/Setup Settings Menu TSF Data.......................................... 59
Table 34 - Threats, Policies and Assumptions to Security Objectives Mapping ....... 65
Table 35 - Threats to Security Objectives Rationale.................................................. 66
Table 36 - Policies to Security Objectives Rationale................................................. 67
Table 37 - Assumptions to Security Objectives Rationale......................................... 67
Table 38 - SFRs to Security Objectives Mapping...................................................... 68
Table 39 - Security Objectives to SFR Rationale....................................................... 69
Table 40 - SFRs to TOE Security Functions Mapping .............................................. 71
Table 41 - SFR to SF Rationale.................................................................................. 72
ACRONYMS LIST
AES.................................................................................Advanced Encryption Standard
AIO.....................................................................................................................All In One
BSD..................................................................................Berkeley Software Distribution
CAC................................................................................................ Common Access Card
CAVP ....................................................Cryptographic Algorithm Validation Program
CC...........................................................................................................Common Criteria
CM.........................................................................................Configuration Management
EAL .......................................................................................Evaluation Assurance Level
ESP.................................................................................Encapsulating Security Payload
FTP................................................................................................. File Transfer Protocol
GSSAPI...............................Generic Security Services Application Program Interface
HTTP..................................................................................HyperText Transfer Protocol
I&A................................................................................. Identification & Authentication
IPSec.........................................................................................Internet Protocol Security
IPv4......................................................................................... Internet Protocol version 4
IPv6......................................................................................... Internet Protocol version 6
ISO..........................................................................International Standards Orgaization
IT .................................................................................................Information Technology
KDC.............................................................................................Key Distribution Center
LAN................................................................................................... Local Area Network
LDAP.................................................................. Lightweight Directory Access Protocol
MB.......................................................................................................................MegaByte
MFD ................................................................................................Multi-Finction Device

Lexmark Multi-Function Printers Security Target
8
MFP...............................................................................................Multi-Function Printer
NTP...............................................................................................Network Time Protocol
OSP...................................................................................Organizational Security Policy
PIV..................................................................................... Personal Identity Verification
PJL ..................................................................................................Printer Job Language
PKI ...........................................................................................Public Key Infrastructure
PP............................................................................................................Protection Profile
RFC ..............................................................................................Request For Comments
SASL.............................................................Simple Authentication and Security Layer
SFP ............................................................................................. Security Function Policy
SFR..............................................................................Security Functional Requirement
SMTP .............................................................................Simple Mail Transport Protocol
ST................................................................................................................Security Target
TFTP ................................................................................. Trivial File Transfer Protocol
TOE...................................................................................................Target of Evaluation
TSF............................................................................................... TOE Security Function
UI..................................................................................................................User Interface
URL........................................................................................ Uniform Resource Locator
USB.................................................................................................... Universal Serial Bus

Lexmark Multi-Function Printers Security Target
9
1. Security Target Introduction
This Security Target (ST) describes the objectives, requirements and rationale for the Lexmark
X548, XS548, X748, X792, XS796, X925, XS925, X950, X952, X954, XS955 and 6500e
Scanner (with T650, T652, or T654 Printer) Multi-Function Printers. The language used in this
Security Target is consistent with the Common Criteria for Information Technology Security
Evaluation, Version 3.1 and all international interpretations through March 17, 2011. As such,
the spelling of terms is presented using the internationally accepted English.
1.1 Security Target Reference
Lexmark X548, XS548, X748, X792, XS796, X925, XS925, X950, X952, X954, XS955 and
6500e Scanner (with T650, T652, or T654 Printer) Multi-Function Printers Security Target,
version 1.11, September 22, 2014.
1.2 TOE Reference
Lexmark X548 (LHS40.VK.P440), XS548 (LHS40.VK.P440), X748 (LHS40.NY.P440), X792
(LHS40.MR.P440), XS796 (LHS40.MR.P440), X925 (LHS40.HK.P440), XS925
(LHS40.HK.P440), X950 (LHS40.TQ.P440), X952 (LHS40.TQ.P440), X954
(LHS40.TQ.P440), XS955 (LHS40.TQ.P440) and 6500e Scanner (LHS40.JR.P440) (with T650
(LHS40.JR.P440), T652 (LHS40.JR.P440), or T654 (LHS40.JR.P440) Printer) Multi-Function
Printers
1.3 Evaluation Assurance Level
Assurance claims conform to EAL2 (Evaluation Assurance Level 2) augmented with
ALC_FLR.2 from the Common Criteria for Information Technology Security Evaluation,
Version 3.1.
1.4 Keywords
Hardcopy, Paper, Document, Printer, Scanner, Copier, Facsimile, Fax, Document Server,
Document Storage and Retrieval, Nonvolatile storage, Residual data, Temporary data, Disk
overwrite, Network interface, Shared communications medium, Multifunction Device,
Multifunction Product, All-In-One, MFD, MFP
1.5 TOE Overview
1.5.1 Usage and Major Security Features
The MFPs are multi-functional printer systems with scanning, fax, and networked capabilities. Their
capabilities extend to walk-up scanning and copying, scanning to fax, scanning to email, and
servicing print jobs through the network. The MFPs feature an integrated touch-sensitive operator
panel.
The major security features of the TOE are:
1. All Users are identified and authenticated as well as authorized before being granted
permission to perform any restricted TOE functions.
2. Administrators authorize Users to use the functions of the TOE.
3. User Document Data are protected from unauthorized disclosure or alteration.
4. User Function Data are protected from unauthorized alteration.

Lexmark Multi-Function Printers Security Target
10
5. TSF Data, of which unauthorized disclosure threatens operational security, are protected
from unauthorized disclosure.
6. TSF Data, of which unauthorized alteration threatens operational security, are protected
from unauthorized alteration.
7. Document processing and security-relevant system events are recorded, and such records
are protected from disclosure or alteration by anyone except for authorized personnel.
1.5.2 TOE type
Miscellaneous (Multifunction Hard Copy Device)
1.5.3 Required Non-TOE Hardware/Software/Firmware
The TOE is a complete MFP, including the firmware and hardware. To be fully operational, any
combination of the following items may be connected to the TOE:
1. A LAN for network connectivity. The TOE supports IPv4 and IPv6.
2. A telephone line for fax capability.
3. IT systems that submit print jobs to the MFP via the network using standard print
protocols.
4. IT systems that send and/or receive faxes via the telephone line.
5. An IT system acting as the remote syslog recipient of audit event records sent from the
TOE.
6. LDAP server to support Identification and Authentication (I&A). This component is
optional depending on the type(s) of I&A mechanisms used.
7. Card reader and cards to support PKI authentication using Common Access Card (CAC)
or Personal Identity Verification (PIV) cards. This component is optional depending on
the type(s) of I&A mechanisms used. The supported card readers are:
a. Omnikey 5121 SmartCard Reader,
b. Omnikey 5321 SmartCard Reader,
c. Omnikey 5125 SmartCard Reader,
d. Omnikey 3121 SmartCard Reader,
e. Any other Omnikey SmartCard Readers that share the same USB Vendor IDs
and Product IDs with the above readers (example Omnikey 3021),
f. SCM SCR 331.
1.6 TOE Description
The TOE provides the following functions related to MFPs:
1. Printing – producing a hardcopy document from its electronic form
2. Scanning – producing an electronic document from its hardcopy form
3. Copying – duplicating a hardcopy document