Ricoh Aficio MP C305 User manual

Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
Aficio MP C305 series
Security Target
Author : RICOH COMPANY, LTD.
Date : 2012-11-28
Version : 1.00
Portions of Aficio MP C305 series Security Target are reprinted with written
permission from IEEE, 445 Hoes Lane, Piscataway, New Jersey 08855, from
IEEE 2600.1, Protection Profile for Hardcopy Devices, Operational
Environment A, Copyright © 2009 IEEE. All rights reserved.
This document is a translation of the evaluated and certified security target
written in Japanese.

Page 1 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
Revision History
Version Date Author Detail
1.00 2012-11-28 RICOH COMPANY, LTD. Publication version.

Page 2 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
Table of Contents
1 ST Introduction ..................................................................................................................... 7
1.1 ST Reference .................................................................................................................. 7
1.2 TOE Reference ............................................................................................................... 7
1.3 TOE Overview................................................................................................................ 8
1.3.1 TOE Type ...................................................................................................................8
1.3.2 TOE Usage.................................................................................................................8
1.3.3 Major Security Features of TOE............................................................................. 11
1.4 TOE Description........................................................................................................... 11
1.4.1 Physical Boundary of TOE ......................................................................................11
1.4.2 Guidance Documents...............................................................................................14
1.4.3 Definition of Users...................................................................................................17
1.4.3.1. Direct User........................................................................................................17
1.4.3.2. Indirect User.....................................................................................................18
1.4.4 Logical Boundary of TOE ........................................................................................19
1.4.4.1. Basic Functions ................................................................................................19
1.4.4.2. Security Functions............................................................................................22
1.4.5 Protected Assets.......................................................................................................24
1.4.5.1. User Data..........................................................................................................24
1.4.5.2. TSF Data...........................................................................................................24
1.4.5.3. Functions ..........................................................................................................25
1.5 Glossary........................................................................................................................25
1.5.1 Glossary for This ST................................................................................................25
2 Conformance Claim............................................................................................................. 29
2.1 CC Conformance Claim................................................................................................ 29
2.2 PP Claims..................................................................................................................... 29
2.3 Package Claims............................................................................................................ 29
2.4 Conformance Claim Rationale ..................................................................................... 30
2.4.1 Consistency Claim with TOE Type in PP...............................................................30
2.4.2 Consistency Claim with Security Problems and Security Objectives in PP .........30
2.4.3 Consistency Claim with Security Requirements in PP..........................................31
3 Security Problem Definitions.............................................................................................. 34

Page 3 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
3.1 Threats .........................................................................................................................34
3.2 Organisational Security Policies.................................................................................. 35
3.3 Assumptions................................................................................................................. 35
4 Security Objectives.............................................................................................................. 37
4.1 Security Objectives for TOE......................................................................................... 37
4.2 Security Objectives of Operational Environment........................................................ 38
4.2.1 IT Environment .......................................................................................................38
4.2.2 Non-IT Environment ...............................................................................................39
4.3 Security Objectives Rationale...................................................................................... 40
4.3.1 Correspondence Table of Security Objectives.........................................................40
4.3.2 Security Objectives Descriptions ............................................................................41
5 Extended Components Definition....................................................................................... 45
5.1 Restricted forwarding of data to external interfaces (FPT_FDI_EXP) ....................... 45
6 Security Requirements........................................................................................................ 47
6.1 Security Functional Requirements.............................................................................. 47
6.1.1 Class FAU: Security audit.......................................................................................47
6.1.2 Class FCS: Cryptographic support .........................................................................50
6.1.3 Class FDP: User data protection ............................................................................51
6.1.4 Class FIA: Identification and authentication.........................................................56
6.1.5 Class FMT: Security management..........................................................................59
6.1.6 Class FPT: Protection of the TSF............................................................................65
6.1.7 Class FTA: TOE access............................................................................................66
6.1.8 Class FTP: Trusted path/channels..........................................................................66
6.2 Security Assurance Requirements............................................................................... 66
6.3 Security Requirements Rationale................................................................................ 67
6.3.1 Tracing .....................................................................................................................67
6.3.2 Justification of Traceability.....................................................................................69
6.3.3 Dependency Analysis...............................................................................................75
6.3.4 Security Assurance Requirements Rationale.........................................................77
7 TOE Summary Specification............................................................................................... 78
7.1 Audit Function ............................................................................................................. 78
7.2 Identification and Authentication Function ................................................................ 80

Page 4 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
7.3 Document Access Control Function ............................................................................. 83
7.4 Use-of-Feature Restriction Function ........................................................................... 85
7.5 Network Protection Function....................................................................................... 85
7.6 Residual Data Overwrite Function.............................................................................. 86
7.7 Stored Data Protection Function ................................................................................. 86
7.8 Security Management Function .................................................................................. 87
7.9 Software Verification Function .................................................................................... 91
7.10 Fax Line Separation Function ..................................................................................... 91

Page 5 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
List of Figures
Figure 1 : Example of TOE Environment.......................................................................................................9
Figure 2 : Hardware Configuration of the TOE ............................................................................................12
Figure 3 : Logical Scope of the TOE ............................................................................................................19
List of Tables
Table 1 : Identification Information of TOE ...................................................................................................7
Table 2 : Guidance for English Version-1 .....................................................................................................15
Table 3 : Guidance for English Version-2 .....................................................................................................15
Table 4 : Guidance for English Version-3 .....................................................................................................16
Table 5 : Definition of Users.........................................................................................................................17
Table 6 : List of Administrative Roles ..........................................................................................................17
Table 7 : Definition of User Data..................................................................................................................24
Table 8 : Definition of TSF Data...................................................................................................................24
Table 9 : Specific Terms Related to This ST.................................................................................................25
Table 10 : Rationale for Security Objectives.................................................................................................40
Table 11 : List ofAuditable Events...............................................................................................................48
Table 12 : List of Cryptographic Key Generation.........................................................................................51
Table 13 : List of Cryptographic Operation ..................................................................................................51
Table 14 : List of Subjects, Objects, and Operations among Subjects and Objects (a).................................52
Table 15 : List of Subjects, Objects, and Operations among Subjects and Objects (b).................................52
Table 16 : Subjects, Objects and Security Attributes (a)...............................................................................52
Table 17 : Rules to Control Operations on Document Data and User Jobs (a) .............................................53
Table 18 : Additional Rules to Control Operations on Document Data and User Jobs (a)............................54
Table 19 : Subjects, Objects and Security Attributes (b)...............................................................................55
Table 20 : Rule to Control Operations on MFPApplications (b)..................................................................55
Table 21 : List of Authentication Events of Basic Authentication.................................................................56
Table 22 : List of Actions for Authentication Failure....................................................................................56
Table 23 : List of Security Attributes for Each User That Shall Be Maintained ...........................................57
Table 24 : Rules for Initial Association of Attributes....................................................................................59
Table 25 : User Roles for Security Attributes (a) ..........................................................................................60
Table 26 : User Roles for Security Attributes (b)..........................................................................................61
Table 27 : Authorised Identified Roles Allowed to Override Default Values................................................62
Table 28 : List of TSF Data...........................................................................................................................62
Table 29 : List of Specification of Management Functions...........................................................................64
Table 30 : TOE Security Assurance Requirements (EAL3+ALC_FLR.2)....................................................67
Table 31 : Relationship between Security Objectives and Functional Requirements ...................................68
Table 32 : Results of Dependency Analysis of TOE Security Functional Requirements..............................75
Table 33 : List of Audit Events......................................................................................................................78
Table 34 : List of Audit Log Items................................................................................................................79
Table 35 : Unlocking Administrators for Each User Role.............................................................................82

Page 6 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
Table 36 : Stored DocumentsAccess Control Rules for Normal Users ........................................................83
Table 37 : Encrypted Communications Provided by the TOE ......................................................................85
Table 38 : List of Cryptographic Operations for Stored Data Protection......................................................87
Table 39 : Management of TSF Data ............................................................................................................87
Table 40 : List of Static Initialisation for Security Attributes of Document Access Control SFP.................90

Page 7 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
1 ST Introduction
This section describes ST Reference, TOE Reference, TOE Overview and TOE Description.
1.1 ST Reference
The following are the identification information of this ST.
Title : Aficio MP C305 series Security Target
Version : 1.00
Date : 2012-11-28
Author : RICOH COMPANY, LTD.
1.2 TOE Reference
This TOE is a digital multifunction product (hereafter "MFP") with "HDD Option Type C305" option
installed.
The TOE is identified by the MFP names and the versions of components that constitute the TOE. The
identification information of the TOE is shown below. Although there are several MFP names depending on
sales companies, their components are identical.
Table 1 : Identification Information of TOE
MFP Names Ricoh Aficio MP C305,
Savin MP C305,
Lanier MP C305,
nashuatec MP C305,
Rex-Rotary MP C305,
Gestetner MP C305,
infotec MP C305
Software
System/Copy 1.08
Network Support 12.25.3
Fax 03.00.00
RemoteFax 01.03.00
NetworkDocBox 1.00
Web Support 1.04
Web Uapl 1.02
animation 1.00
TOE Versions
Scanner 01.05

Page 8 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
Printer 1.05
PCL 1.07
PCL Font 1.13
Data Erase Onb 1.03m
GWFCU3.5-5(WW)(*1) 03.00.00
Engine 1.08:02
OpePanel 1.16
Hardware
Ic Key 01020714
Ic Hdd 01
(*1): "Fax Option Type C305" option must be installed on the MFP if the version of GWFCU3.5-5(WW) is
not displayed.
Keywords : Digital MFP, Documents, Copy, Print, Scanner, Network, Office, Fax
1.3 TOE Overview
This section defines TOE Type, TOE Usage and Major Security Features of TOE.
1.3.1 TOE Type
This TOE is an MFP, which is an IT device that inputs, stores, and outputs documents.
1.3.2 TOE Usage
The operational environment of the TOE is illustrated below and the usage of the TOE is outlined in this
section.

Page 9 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
Figure 1 : Example of TOE Environment
The TOE is used by connecting to the local area network (hereafter "LAN") and telephone lines, as shown in
Figure 1. Users can operate the TOE from the Operation Panel of the TOE or through LAN communications.
Below, explanations are provided for the MFP, which is the TOE itself, and hardware and software other
than the TOE.
MFP
A machinery that is defined as the TOE. The MFP is connected to the office LAN, and users can perform the
following operations from the Operation Panel of the MFP:
- Various settings for the MFP,
- Copy, fax, storage, and network transmission of paper documents,
- Print, fax, network transmission, and deletion of the stored documents.
Also, the TOE receives information via telephone lines and can store it as a document.
LAN
Network used in the TOE environment.

Page 10 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
Client computer
A computer that performs as a client of the TOE if it is connected to the LAN, and users can remotely
operate the MFP from the client computer. The possible remote operations from the client computer are as
follows:
- Various settings for the MFP using a Web browser installed on the client computer,
- Operation of documents using a Web browser installed on the client computer,
- Storage and printing of documents using the printer driver installed on the client computer,
- Storage and faxing of documents using the fax driver installed on the client computer.
Telephone line
A public line for the TOE to communicate with external faxes.
Firewall
A device to prevent the office environment from network attacks via the Internet.
FTP Server
A server used by the TOE for folder transmission of the stored documents in the TOE to its folders.
SMB Server
A server used by the TOE for folder transmission of the stored documents in the TOE to its folders.
SMTP Server
A server used by the TOE for e-mail transmission.
External Authentication Server
A server that identifies and authenticates the TOE user with Windows authentication (Kerberos
authentication method). This server is only used when External Authentication is applied. The TOE
identifies and authenticates the user by communicating with the external authentication server via LAN.
RC Gate
An IT device used for @Remote. The function of RC Gate for @Remote is to relay communications
between the MFP and maintenance centre. A transfer path to other external interface for input information
from the RC Gate via network interface is not implemented in the TOE. The RC Gate products include
Remote Communication Gate A, Remote Communication Gate Type BM1, and Remote Communication
Gate Type BN1.

Page 11 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
1.3.3 Major Security Features of TOE
The TOE stores documents in it, and sends and receives documents to and from the IT devices connected to
the LAN. To ensure provision of confidentiality and integrity for those documents, the TOE has the
following security features:
- Audit Function
- Identification and Authentication Function
- Document Access Control Function
- Use-of-Feature Restriction Function
- Network Protection Function
- Residual Data Overwrite Function
- Stored Data Protection Function
- Security Management Function
- Software Verification Function
- Fax Line Separation Function
1.4 TOE Description
This section describes Physical Boundary of TOE, Guidance Documents, Definition of Users, Logical
Boundary of TOE, and Protected Assets.
1.4.1 Physical Boundary of TOE
The physical boundary of the TOE is the MFP, which consists of the following hardware components
(shown in Figure 2): Operation Panel Unit, Engine Unit, Fax Controller Unit, Controller Board, HDD, Ic
Hdd, Network Unit, USB Port, SD Card Slot, and SD Card.

Page 12 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
Figure 2 : Hardware Configuration of the TOE
Controller Board
The Controller Board is a device that contains Processors, RAM, NVRAM, Ic Key, and FlashROM. The
Controller Board sends and receives information to and from the units and devices that constitute the MFP,
and this information is used to control the MFP. The information to control the MFP is processed by the
MFP Control Software on the Controller Board. The following describes the components of the Controller
Board:
- Processor
A semiconductor chip that performs basic arithmetic processing for MFP operations.
- RAM
A volatile memory medium which is used as a working area for image processing such as
compressing/decompressing the image data. It can also be used to temporarily read and write
internal information.
- NVRAM
A non-volatile memory medium in which TSF data for configuring MFP operations is stored.
- Ic Key
A security chip that has the functions of random number generation, cryptographic key generation

Page 13 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
and digital signature. It has the memory medium inside, and the signature root key is installed
before the TOE is shipped.
- FlashROM
A non-volatile memory medium in which the following software components are installed:
System/Copy, Network Support, Fax, RemoteFax, NetworkDocBox, Web Support, Web Uapl,
animation, Scanner, Printer, PCL, PCL Font, and Data Erase Onb. These are part of the TOE and
are included in the MFP Control Software.
Operation Panel Unit (hereafter "Operation Panel")
The Operation Panel is a user interface installed on the TOE and consists of the following devices: key
switches, LED indicators, an LCD touch screen, and Operation Control Board. The Operation Control Board
is connected to the key switches, LED indicators, and LCD touch screen. The Operation Panel Control
Software is installed on the Operation Panel Control Board. The Operation Panel Control Software performs
the following:
1. Transfers operation instructions from the key switches and the LCD touch screen to the
Controller Board.
2. Controls the LEDs and displays information on the LCD touch screen according to display
instructions from the Controller Board.
OpePanel, which is one of the components that constitute the TOE, is the identifier for the Operation Panel
Control Software.
Engine Unit
The Engine Unit consists of Scanner Engine that is an input device to read paper documents, Printer Engine
that is an output device to print and eject paper documents, and Engine Control Board. The Engine Control
Software is installed in the Engine Control Board. The Engine Control Software sends status information
about the Scanner Engine and Printer Engine to the Controller Board, and operates the Scanner Engine or
Printer Engine according to instructions from the MFP Control Software. Engine, which is one of the
components that constitute the TOE, is the identifier for the Engine Control Software.
Fax Controller Unit (FCU)
The Fax Controller Unit is a unit that has a modem function for connection to a telephone line. It also sends
and receives fax data to and from other fax devices using the G3 standard for communication. The Fax
Controller Unit sends and receives control information about the Controller Board and the FCU and fax data.
FCU Control Software is installed on the FCU. GWFCU3.5-5(WW), which is one of the components that
constitute the TOE, is the identifier for the FCU Control Software.
HDD
The HDD is a hard disk drive that is a non-volatile memory medium. It stores documents, login user names
and login passwords of normal users.

Page 14 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
Ic Hdd
The Ic Hdd is a board that implements data encryption and decryption functions. It is provided with
functions for HDD encryption realisation.
Network Unit
The Network Unit is an external interface to an Ethernet (100BASE-TX/10BASE-T) LAN.
USB Port
The USB Port is an external interface to connect a client computer to the TOE for printing directly from the
client computer. During installation, this interface is disabled.
SD Card/SD Card Slot
There are SD Card Slots for customer engineer and for users.
The SD Card Slot for customer engineer is used when the customer engineer installs the TOE. A cover is
placed on the SD Card Slot during the TOE operation so that an SD Card cannot be inserted into or removed
from the slot.
The SD Card Slot for users is used by users to print documents in the SD Card. The slot is set to disabled at
the installation.
1.4.2 Guidance Documents
The following sets of user guidance documents are available for this TOE: [English version-1], [English
version-2], and [English version-3]. Selection of the guidance document sets depends on the sales area and/or
sales company. Guidance document sets will be supplied with individual TOE component. Details of the
document sets are as follows.
[English version-1]

Page 15 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
Table 2 : Guidance for English Version-1
TOE
Components Guidance Documents for Product
MFP - MP C305SP/C305SPF
Aficio MP C305SP/C305SPF
User Guide D118-7501
- MP C305SP/C305SPF
Aficio MP C305SP/C305SPF
Read This First D118-7504
- Notes for Security Guide D143-7348
- Manuals
MP C305SP/MP C305SPF/Aficio MP C305SP/MP C305SPF
A D118-7576
- Printer/Scanner Drivers and Utilities
RICOH Aficio MP C305SP/MP C305SPF LANIER MP C305SP/MP C305SPF
SAVIN MP C305SP/MP C305SPF D118-7570A
- SOFTWARE LICENSE AGREEMENT D645-7901
- Notes for Users D127-7523
- Notes for Administrators: Using this
Machine in a Network Environment
Compliant with IEEE Std. 2600.1TM-2009 D118-7524
- Notes on Security Functions D127-7526
- Help 83NHCFENZ1.30 v129
FCU - Fax Option Type C305
(Machine Code: D649)
Installation Procedure
For Machine Code:
D117 / D118 Copiers D649-8610
[English version-2]
Table 3 : Guidance for English Version-2
TOE
Components Guidance Documents for Product
MFP - MP C305SP/C305SPF
Aficio MP C305SP/C305SPF
Read This First D118-7503
- Notes for Security Guide D143-7348
- SOFTWARE LICENSE AGREEMENT D645-7901

Page 16 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
- Manuals
MP C305SP/MP C305SPF/Aficio MP C305SP/MP C305SPF
A D118-7576
- Printer/Scanner Drivers and Utilities
RICOH Aficio MP C305SP/MP C305SPF MP C305SP/MP C305SPF
infotec MP C305SP/MP C305SPF D118-7571A
- Notes for Users D127-7801
- Safety Information A232-8561A
- Notes for Administrators: Using this
Machine in a Network Environment
Compliant with IEEE Std. 2600.1TM-2009 D118-7523
- Notes on Security Functions D127-7525
- Help 83NHCFENZ1.30 v129
[English version-3]
Table 4 : Guidance for English Version-3
TOE
Components Guidance Documents for Product
MFP - MP C305SP/C305SPF
Aficio MP C305SP/C305SPF
User Guide D118-7501
- MP C305SP/C305SPF
Aficio MP C305SP/C305SPF
Read This First D118-7505
- Notes for Security Guide D143-7349
- User Information on Electrical & Electronic
Equipment D127-6601
- Manuals
MP C305SP/MP C305SPF/Aficio MP C305SP/MP C305SPF
A D118-7576
- Printer/Scanner Drivers and Utilities
RICOH Aficio MP C305SP/MP C305SPF Gestetner MP C305SP/MP C305SPF
LANIER MP C305SP/MP C305SPF D118-7572A
- Notes for Users D127-7524
- SOFTWARE LICENSE AGREEMENT D645-7901
- Notes for Administrators: Using this
Machine in a Network Environment
Compliant with IEEE Std. 2600.1TM-2009 D118-7524
- Notes on Security Functions D127-7526

Page 17 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
- Help 83NHCFENZ1.30 v129
1.4.3 Definition of Users
This section defines the users related to the TOE. These users include those who routinely use the TOE
(direct users) and those who do not (indirect users). The direct users and indirect users are described as
follows:
1.4.3.1. Direct User
The "user" referred to in this ST indicates a direct user. This direct user consists of normal users,
administrators, and RC Gate. The following table (Table 5) shows the definitions of these direct users.
Table 5 : Definition of Users
Definition of
Users Explanation
Normal user A user who is allowed to use the TOE. A normal user is provided with a login user
name and can use Copy Function, Fax Function, Scanner Function, Printer Function,
and Document Server Function.
Administrator A user who is allowed to manage the TOE. An administrator performs management
operations, which include issuing login names to normal users.
RC Gate
An IT device connected to networks. RC Gate performs the @Remote Service Function
of the TOE via RC Gate communication interface. Copy Function, Fax Function,
Scanner Function, Printer Function, Document Server Function, and Management
Function cannot be used.
The administrator means the user registered for TOE management. According to its roles, the administrator
can be classified as the supervisor and the MFP administrator. Up to four MFP administrators can be
registered and selectively authorised to perform user management, machine management, network
management, and file management. Therefore, the different roles of the management privilege can be
allocated to multiple MFP administrators individually. The "MFP administrator" in this ST refers to the MFP
administrator who has all management privileges (Table 6).
Table 6 : List of Administrative Roles
Definition of
Administrator Management Privileges Explanation
Supervisor Supervisor Authorised to modify the login password of the
MFP administrator.
MFP administrator User management privilege Authorised to manage normal users. This
privilege allows configuration of normal user
settings.

Page 18 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
Machine management
privilege
Authorised to specify MFP device behaviour
(network behaviours excluded). This privilege
allows configuration of device settings and
view of the audit log.
Network management
privilege
Authorised to manage networks and configure
LAN settings. This privilege allows
configuration of network settings.
File management privilege Authorised to manage stored documents. This
privilege allows access management of stored
documents.
1.4.3.2. Indirect User
Responsible manager of MFP
The responsible manager of MFP is a person who is responsible for selection of the TOE administrators in
the organisation where the TOE is used.
Customer engineer
The customer engineer is a person who belongs to the organisation which maintains TOE operation. The
customer engineer is in charge of installation, setup, and maintenance of the TOE.

Page 19 of 91
Copyright (c) 2012 RICOH COMPANY, LTD. All rights reserved.
1.4.4 Logical Boundary of TOE
The Basic Functions and Security Functions are described as follows:
Figure 3 : Logical Scope of the TOE
1.4.4.1. Basic Functions
The overview of the Basic Functions is described as follows:
Copy Function
The Copy Function is to scan paper documents and copy scanned image data from the Operation Panel.
Magnification and other editorial jobs can be applied to the copy image. It can also be stored on the HDD as
a Document Server document.
Printer Function
The Printer Function is to print or store the documents received from the printer driver installed on the client
computer. It also allows users to print and delete the documents stored in the TOE from the Operation Panel
or the client computer.