Zte ZXR10 M6000 Series User manual

ZXR10M6000&T8000&8900E
SeriesRoutersandSwitchesRunningthe
ZXROSNGOperatingSystem
SecurityTarget
ZTECORPORATION
NO.55,Hi-techRoadSouth,ShenZhen,P .R.China
Postcode:518057
Tel:[phone]
Fax:[phone]
URL:http://ensupport.zte.com.cn
E-mail:[email protected]
Version:R1.6

LEGALINFORMATION
Copyright©2011ZTECORPORATION.
Thecontentsofthisdocumentareprotectedbycopyrightlawsandinternationaltreaties.Anyreproductionor
distributionofthisdocumentoranyportionofthisdocument,inanyformbyanymeans,withoutthepriorwritten
consentofZTECORPORATIONisprohibited.Additionally,thecontentsofthisdocumentareprotectedby
contractualcondentialityobligations.
Allcompany,brandandproductnamesaretradeorservicemarks,orregisteredtradeorservicemarks,ofZTE
CORPORATIONoroftheirrespectiveowners.
Thisdocumentisprovided“asis”,andallexpress,implied,orstatutorywarranties,representationsorconditions
aredisclaimed,includingwithoutlimitationanyimpliedwarrantyofmerchantability,tnessforaparticularpurpose,
titleornon-infringement.ZTECORPORATIONanditslicensorsshallnotbeliablefordamagesresultingfromthe
useoforrelianceontheinformationcontainedherein.
ZTECORPORATIONoritslicensorsmayhavecurrentorpendingintellectualpropertyrightsorapplications
coveringthesubjectmatterofthisdocument.ExceptasexpresslyprovidedinanywrittenlicensebetweenZTE
CORPORATIONanditslicensee,theuserofthisdocumentshallnotacquireanylicensetothesubjectmatter
herein.
ZTECORPORATIONreservestherighttoupgradeormaketechnicalchangetothisproductwithoutfurthernotice.
UsersmayvisitZTEtechnicalsupportwebsitehttp://ensupport.zte.com.cntoinquirerelatedinformation.
TheultimaterighttointerpretthisproductresidesinZTECORPORATION.
RevisionHistory
DateVersionRemark
2011/03/010.8Draftversion
2011/05/091.0Initialversion
2011/05/251.1Revisedaccordingto“20110524ASEEORs”
2011/06/131.2Added“dateandversionofST”toSTcover
2011/06/201.3Revisedaccordingto“EOR_ASE_07_03”
2011/07/041.4AddedT8000&8900ESeriesRouters
2011/07/271.5Fixed“versionnumberofguidancedocuments”
2011/08/191.6Minorrenement
SerialNumber:SJ-20110815105844-030
PublishingDate:2011/08/19（R1.6）

Contents
Chapter1STINTRODUCTION...................................................................1-1
1.1STIDENTIFICATION..........................................................................................1-1
1.1.1STTitle....................................................................................................1-1
1.1.2References..............................................................................................1-1
1.2TOEIDENTIFICATION.......................................................................................1-2
1.3TOEOVERVIEW...............................................................................................1-4
1.3.1IntendedusageandsecurityfeaturesoftheTOE.......................................1-4
1.3.2Non-TOEcomponents..............................................................................1-4
1.4TOEDESCRIPTION...........................................................................................1-5
1.4.1Physicalscope.........................................................................................1-6
1.4.2Logicalscope...........................................................................................1-7
1.4.3EvaluatedConguration............................................................................1-8
Chapter2CONFORMANCECLAIMS........................................................2-1
2.1COMMONCRITERIA(CC)CONFORMANCE......................................................2-1
Chapter3SECURITYPROBLEMDEFINITION.........................................3-1
3.1Threat...............................................................................................................3-1
3.2Assumption........................................................................................................3-2
3.2.1PersonnelAssumptions............................................................................3-2
3.2.2PhysicalEnvironmentAssumptions...........................................................3-2
3.2.3OperationalAssumptions..........................................................................3-3
3.3ORGANIZATIONALSECURITYPOLICIES..........................................................3-3
Chapter4SECURITYOBJECTIVES..........................................................4-1
4.1SECURITYOBJECTIVESFORTHETOE...........................................................4-1
4.2SECURITYOBJECTIVESFORTHEENVIRONMENT.........................................4-2
Chapter5SECURITYREQUIREMENTS....................................................5-1
5.1SECURITYFUNCTIONALREQUIREMENTS......................................................5-1
5.1.1Overview.................................................................................................5-1
5.1.2SecurityFunctionalRequirements.............................................................5-3
5.2SECURITYASSURANCEREQUIREMENTS......................................................5-11
5.2.1SecurityAssuranceRequirements............................................................5-11
Chapter6TOESUMMARYSPECIFICATION.............................................6-1
6.1TOESECURITYFUNCTIONS............................................................................6-1
6.1.1SecurityAuditing......................................................................................6-1
I

6.1.2Identication&Authentication...................................................................6-3
6.1.3SecurityManagement...............................................................................6-4
6.1.4TOEAccess.............................................................................................6-7
6.1.5Userdataprotection.................................................................................6-7
6.1.6TrustedChannel.......................................................................................6-9
Chapter7RATIONALE...............................................................................7-1
7.1RATIONALEFORSECURITYOBJECTIVES.......................................................7-1
7.1.1RationaleforSecurityObjectivesfortheTOE.............................................7-1
7.1.2RationaleforSecurityObjectivesfortheEnvironment.................................7-1
7.2SECURITYREQUIREMENTSRATIONALE.........................................................7-2
7.2.1RationaleforTOEsecurityfunctionalrequirements.....................................7-2
7.2.2RationaleforSecurityAssuranceRequirements.........................................7-6
7.2.3FunctionalRequirementDependenciesRationale......................................7-6
AppendixADocumentTerminology........................................................A-1
Tables..............................................................................................................I
II

Chapter1
STINTRODUCTION
TableofContents
STIDENTIFICATION..................................................................................................1-1
TOEIDENTIFICATION...............................................................................................1-2
TOEOVERVIEW........................................................................................................1-4
TOEDESCRIPTION..................................................................................................1-5
1.1STIDENTIFICATION
1.1.1STTitle
V1.6oftheSecurityTargetfortheZXR10M6000&T8000&8900ESeriesRoutersand
SwitchesrunningtheZXROSNGOperatingSystem.
1.1.2References
ThefollowingdocumentationwasusedtopreparethisST .
[CCp1]
CommonCriteriaforInformationTechnologySecurityEvaluation–Part1:
Introductionandgeneralmodel,datedJuly2009,Version3.1Revision3Final,CCMB-
2009-07-001
[CCp2]
CommonCriteriaforInformationTechnologySecurityEvaluation–Part2:
Securityfunctionalrequirements,datedJuly2009,Version3.1Revision3Final,
CCMB-2009-07-002
[CCp3]
CommonCriteriaforInformationTechnologySecurityEvaluation–Part3:
Securityassurancerequirements,datedJuly2009,Version3.1Revision3Final,
CCMB-2009-07-003
[CEM]
CommonEvaluationMethodologyforInformationTechnologySecurityEvaluation,dated
July2009,Version3.1Revision3Final,CCMB-2009-07-004
1-1
SJ-20110815105844-030|2011/08/19（R1.6）ZTECORPORATION

ZXR10M6000&T8000&8900ESecurityTarget
1.2TOEIDENTIFICATION
ThisSecurityTargetdescribestheM6000&T8000&8900ESeriesofRoutersandSwitches
runningtheZXROSNGOperatingSystemv1.00.20.
TheM6000&T8000&8900Eseriesconsistsofthefollowing:
Table1-1M6000&T8000&8900ESeriesModels
SeriesModelInterfaceDescriptionType
M6000-88xPFU
4xSFU
2xMPU
M6000-1616xPFU
4xSFU
2xMPU
M6000-nSeries
lMPUsupportedinterfaces:
à1xEthernetManagementInterface
à1xRS232Console
lPFUsupportedinterfaces:
à1-port10GbpsElectronicalEthernet
à4-port10GbpsElectronicalEthernet
à10-port1GbpsOpticalEthernet
à12-portGigabitOpticalInterface
à16-Port100MElectricalInterface
à40-portGigabitOpticalinterface
à48-portGigabitElectricalinterface
à1-PortIEEE1588LAN/WANInterface
à2-PortIEEE1588LAN/WANInterface
lSFUsupportedinterface:none
SR
M6000-3S3xPFU
2xMPU
M6000-5S5xPFU
2xSRU
M6000-8S8xPFU
2xSRU
2xSFU
M6000-nSSeries
lMPU/SRUsupportedinterfaces:
à1xEthernetManagementInterface
SR
1-2
SJ-20110815105844-030|2011/08/19（R1.6）ZTECORPORATION

Chapter1STINTRODUCTION
à1xRS232Console
lFPUsupportedinterfaces:
à2-port10GELAN/WANInterface
à12-portGigabitcomboInterface
lSFUsupportedinterface:none
T800016xPFU
4xSFU
2xMPU
T8000Series
lMPUsupportedinterfaces:
à1xEthernetManagementInterface
à1xRS232Console
lPFUsupportedinterfaces:
à1-port10GbpsElectronicalEthernet
à4-port10GbpsElectronicalEthernet
à10-port1GbpsOpticalEthernet
à16-Port100MElectricalInterface
à48-portGigabitElectricalinterface
lSFUsupportedinterface:none
CR
8902E2xMCS
2xLIC
8905E2xMCS
5xLIC
8908E2xMCS
8xLIC
8912E2xMCS
12xLIC
8900ESerieslMCSsupportedinterfaces:
à1xEthernetManagementInterface
à1xRS232Console
lLICsupportedinterfaces:
à8-port10GEOpticalEthernet
à12-port10GEOpticalinterface
à48-portGigabitElectricalinterface
à48portGigabitOpticalinterface
ESS
1-3
SJ-20110815105844-030|2011/08/19（R1.6）ZTECORPORATION

ZXR10M6000&T8000&8900ESecurityTarget
Themajordifferencebetweenmodelsisthetype,capacityandnumberofthephysical
interfacesdescribedintheabovetable.
1.3TOEOVERVIEW
1.3.1IntendedusageandsecurityfeaturesoftheTOE
TheTOEisZXR10M6000&T8000&8900Eseriesroutersandswitchesrunningthe
ZXROSNG1.00.20.
TheTOEenablesthedeliveryofmetroEthernetservicesandhigh-densityservice-aware
EthernetaggregationoverIP/MPLS-basednetworks.
Thesupportedprotocolsarelayer2/layer3encapsulationandInternetProtocol(IP),and
Ethernet.Otherprotocolsmaybesupportedbytheproduct,butarenotevaluated(see
section1.4.3).
ThemajorsecurityfeaturesoftheTOEare:
lHandlingofpacketowsusingtheRIPv2,OSPFv2,IS-ISandBGPv4protocols
lLocalandremoteadministration
lAuthentication,eitherintheTOEorthroughTACACS+orRADIUS.
lAdministratorProlestopermitordenyaccesstoahierarchicalbranchorspecic
commands.
lAudit
lManagementandcongurationoftheTOE
lMitigateDoSattacks
lURPF(UnicastReversePathForwarding)tolimitthemalicioustrafc
1.3.2Non-TOEcomponents
TheTOErequiresthefollowingITinitsenvironment:
Alocalorremoteconsoleforadministration(required)
Atleastoneisneeded,butbothareallowed.
lForalocalconsole:AnyplatformthatsupportsterminalemulationtotheANSIX3.64
standard;
lForaremoteconsole,anyplatformthatsupportsterminalemulationtotheANSIX3.64
standardandtheSSHprotocol.
ASNMP/SYSLOGserverforlogging(required)
Thismaybetwoplatformsoronecombinedplatform.
lFortheSNMPserver,anyplatformthatsupportsRFC3411-RFC3418(SNMPv3)
lFortheSYSLOGserver,anyplatformthatsupportsRFC3164(SYSLOGProtocol);
1-4
SJ-20110815105844-030|2011/08/19（R1.6）ZTECORPORATION

Chapter1STINTRODUCTION
AlllogsarestoredintheTOEwheneverthereisnewloggeneratedandthentheTOE
transferredtheloglestoSNMP/SYSLOGServerswithSNMP/SYSLOGnetworkprotocol
throughinternalnetworkinaconstantperiodtime.Thelogleisstoredunderthe‘data’
directoryoftheash/diskinsidetheTOE.Fordetailcontentofthelog,pleasereference
chapter5.1.2.1.
ANTPServer(required)
AnyplatformthatsupportsRFC1305(NTPv3)
ARADIUSorTACACS+serverforAAAservices(optional)
lFortheRADIUSServer,anyplatformthatsupportsRFC2865(Authentication&
Authorization)andRFC2866(Accounting)forRADIUS.
lFortheTACACS+Server,anyplatformthatsupportsTACACS+Version1.78
（DRAFT);
Atleasttwoexternalnetworksandaninternalnetwork
ThemajorfunctionalityoftheTOEistoforwarddatapacketsalongnetworks.Thereshould
beatleasttwodistinctnetworksornetworksegments:commonlytwoLANsorWANsor
aLANanditsISP’snetwork.Thereshouldalsobeaninternalnetworkthatconnectsthe
SNMP/SYSLOGserver,theNTPserverandtheRADIUS/TACACS+servertotheTOE.
1.4TOEDESCRIPTION
TheTOEisZXR10M6000&T8000&8900Eseriesroutersandswitchesrunningon
ZXROSNG.
M6000&T8000routerisadevicethatdeterminesthenextnetworkpointtowhichapacket
shouldbeforwardedtowarditsdestination.Itislocatedatanygateway(whereonenetwork
meetsanother).
M6000&T8000&8900Eroutersandswithesmaycreateormaintainatableoftheavailable
routesandtheirconditionsandusethisinformationalongwithdistanceandcostalgorithms
todeterminethebestrouteforagivenpacket.RoutingprotocolsincludeBGP ,RIPv2,
IS-ISandOSPF.IPpacketsareforwardedtotherouteroveroneormoreofitsphysical
networkinterfaces,whichprocessesthemaccordingtothesystem’scongurationand
stateinformationdynamicallymaintainedbytherouter.Thisprocessingtypicallyresultsin
theIPpacketsbeingforwardedoutoftherouteroveranotherinterface.
TheSeriessoftwareusesabasereal-timeoperatingsystem(OS).Theprimarycopyof
TOEsoftwareislocatedonaharddriveinthehardwareplatforms.Theremovablemedia
isshippedwitheachrouterandcontainsacopyoftheversionimage.
TheTOEconsistsoftwoplanes:ControlplaneandForwardingplane.
1-5
SJ-20110815105844-030|2011/08/19（R1.6）ZTECORPORATION

ZXR10M6000&T8000&8900ESecurityTarget
ControlPlane
Thecontrolplanereceivescongurationcommands,protocolinformationandkeep-alive
packetsfromotherplanestoimplementsthefollowingfunctions:
lCongurationofcommandparameter,displayingstatisticsandstatusinformation.
lLocalauthentication,RADIUSauthenticationandTACACS+authentication
lAuditloggingandSNMPtrappingandpreciseclocksynchronization
lGenerationofvarietyofcongurationitemssuchasroutingtables,IPandMAC
bindingtable,ACLtable,etc.
lImportantprotocolssuchasBGPv4/RIPv2/IS-IS/OSPFv2supportsvariety
ofauthenticationmethods(noauthentication,cleartextauthentication,MD5
authentication),.
Controlplanesendsprotocolpacketandtableentriestotheotherplane.
ForwardingPlane
Theforwardingplaneforwardstheuserdata,receivesprotocolpackets,keep-alive
packetsandcongurationtableentriesfromotherplanes.Theprotocolinformationand
keep-alivepacketaresenttothenetworkaccordingtotheirpriorities.TopreventIP
addresstheftfromleased-lineusers,theleased-lineIPaddressesareboundtospecic
MACaddresses.TorestricttheunknownuserstoaccesstheTOE,theACLisassigned
tothenetworkinterface.ByspecifyingtheURPFtotheimportingnetworkinterface
andcheckingtheconsistencyofthesourceroutingaddressandtheincominginterface,
TheTOEcanpreventIPspoongattacks.TopreventDoSattacks,theTOElimitsthe
up-sendingow,thetrafctocontrolplane,ratetoprotecttheCPUwhenthedataow
exceedingtheconguredthreshold,theexceededtrafcwillbedropped.ThentheTOE
dispatchesincomingpacketstocontrolplane.
Theforwardingplanealsoprovidesstatisticalinformationtotheotherplane.
1.4.1Physicalscope
TheTOEconsistsof:
laM6000seriesSR
laT8000seriesCR
la8900EseriesESS
lacopyofZXROSNGV1.00.20:locatedonacompactashcard/disk,whichcanbe
insertedintheSR/CR/ESSandisshippedwiththeSR/CR/ESS.Thecompleteversion
informationofZXROSNGV1.00.20areasfollows:
1-6
SJ-20110815105844-030|2011/08/19（R1.6）ZTECORPORATION

Chapter1STINTRODUCTION
àZXR10M6000-16ZTEZXR10Software,
Version:M6000v1.00.30(1.0.70),ZXROSNGV1.00.20,ReleasesoftwareBuildon
2011/06/0709:27:25
àZXR10T8000-16ZTEZXR10Software,
Version:T8000v1.00.12(1.0.70),ZXROSNGV1.00.20,ReleasesoftwareBuildon
2011/06/0709:27:25
àZXR108902ESoftware,8900&8900EVersion:V3.00.01.B08P06,ZXROSNGV1.00.20RE-
LEASESOFTWARECompiled2011-6-8,16:51:27
lguidancedocuments
àZXR10M6000&T8000&8900ESeriesRoutersandSwitchesRunning
ZXROSNG_AGD_OPEv1.7
àZXR10M6000&T8000&8900ESeriesRoutersandSwitchesRunning
ZXROSNG_AGD_PREv1.3
1.4.2Logicalscope
TheTOEisconnectedtoaninternal(trusted)networkandtwoormoreexternal(untrusted)
networks.
Theexternalnetworksarethenetworkstoberoutedandsupporttheprimaryfunctionofthe
TOE:thehandlingofpacketowsfromonenetworktoanother.Typically,packetowsare
passedthroughtheinternetworkingdeviceandforwardedtotheircongureddestination.
Thepacketowscanbemanipulatedandmonitoredaswell.Routingprotocolsusedare
RIPv2,OSPFv2,IS-IS,andBGPv4.
Theinternalnetworkmaycontainthefollowingentities:
lARADIUSorTACACS+ServerforIdentication&Authentication(optional)
lASNMP/SYSLOGserverforlogging(required)
lANTPServerforexternaltimesynchronisation(required)
lAlocalconsoleformanagementoraremoteconsoleformanagement.Thisremote
consoleconnectswiththeTOEthroughtheSSH.(required)
TheTOEprovidesthefollowingservices:
lHandlingofpacketows:asdescribedaboveusingtheRIPv2,OSPFv2,IS-IS,and
BGPv4protocolswhichcanpreventthecommunicationwithtrustedroutersfrom
modication,insertionandreplayerrors.Packetowscanberestrictedtocomeonly
fromauthorizedsourcesand/orgotoauthorizeddestinations.
lLocal(throughaconsoleport)andremote(protectedthroughSSHorSNMPv3)
accesstotheTOEforadministrators.Thesesessionsaredroppedaftera
congurableamountoftotalsessiontimeorafteracongurableamountofidletime
topreventaccesstounattendedopensessions.
lAuthentication:Accesspermissioniscontrolledusing:TACACS+;RADIUS;or
localauthentication.Aprole,whichisbasedonadministratornameandpassword
congurations,isappliedfortheadministratorauthorizationprocesses.ThisST
1-7
SJ-20110815105844-030|2011/08/19（R1.6）ZTECORPORATION

ZXR10M6000&T8000&8900ESecurityTarget
addressesonlytheclient-sidesupportofRADIUSandTACACS+:theservers
themselvesareout-of-scope.
lProles:Administratorprolesareconguredtopermitordenyaccesstoa
hierarchicalbranchorspeciccommands.
lAudit:TheTOEprovidesanauditfeatureforactionsrelatedtoauthenticationattempts
andadministratoractions
lManagement:TheTOEoffersadministratorsthecapabilitytoconguretheTOE
(primarilythepacketowhandlingandauditfeatures).
lMitigateDoSattacksthroughuseofreal-timestatisticscapabilitiesandURPF(Unicast
ReversePathForwarding)
1.4.3EvaluatedConfiguration
TheTOEhasmanyfeaturesthatcanbeconguredtobeonoroff.Thetablebelowlists
thesefeaturesandshowswhethertheyare:
lEvaluated:thismeansthatthefeaturecanbeenabled,anditwillworksecurely.
lNotPermitted:thismeansthatthefeaturemaynotbeenabled,asthiswillendanger
thesecurityoftheentireTOE.
lNotEvaluated:thismeansthatthefeaturecanbeenabled,thatenablingthisfeature
willnotendangerthesecurityoftheotherfeatures,buttheevaluationhasnot
determinedwhetherthefeatureitselfwillworksecurely.
Table1-2EvaluatedConguration
FeatureDescriptionEvaluatedNot
Permitted
Not
Evaluated
AAATACACS+RADIUS(Remote
AccessDial-InUserService)
×
ACLAccesscontrollists.×
DHCPDynamicHostControlProtocol
(DHCP)enablesyouto
automaticallyassignreusable
IPaddressestoDHCPclients.
×
IGMP××
IPv6××
MediaTypes
(non-Ethernet)
ADSL,ATM,FrameRelay,ISDN,
MPLS,PPP ,PPPoE,SDH,and
SONET.
×
NATNetworkAddressTranslationis
usedbyadevice(rewall,router
orcomputer)thatsitsbetweenan
internalnetworkandtherestofthe
world.
×
1-8
SJ-20110815105844-030|2011/08/19（R1.6）ZTECORPORATION

Chapter1STINTRODUCTION
FeatureDescriptionEvaluatedNot
Permitted
Not
Evaluated
NetFlow×
NTPv3NetworkTimeProtocolversion3×
QoSQualityofServicefeatures×
STPSpanningtreeprotocol×
RoutingProtocol
Disabled
RIPversion1××
RIPv2:RoutingInformation
Protocol(RIP)version2(MD5
authentication)
×
OSPFv2:OpenShortestPathFirst
(OSPFv2)Mode2
×
IS-IS:IntermediateSystem
to-IntermediateSystemProtocol.
×
RoutingProtocols
Permitted
BGPv4:BorderGatewayProtocol×
StaticRoutingStaticRoutingTable×
SSHv1SSHversion1clientandserver
support.
××
SSHv2SSHversion2clientandserver
support.
×
SNMPv2××
SNMPv3SimpleNetworkManagement
Protocol(SNMP):
×
SYSLOGCongurationanddeliveryof
SYSLOGmessages.
×
Telnet××
FTP/TFTP××
VLANNotevaluated:VirtualLAN×
MitigateDoS
attack
Denialofservice×
URPFUnicastReversePathForwarding×
VPNNotpermittedintheevaluated
conguration:WebVPN,IPSec,
IKE,L2TP(Layer2Tunneling
Protocol).
××
1-9
SJ-20110815105844-030|2011/08/19（R1.6）ZTECORPORATION

ZXR10M6000&T8000&8900ESecurityTarget
FeatureDescriptionEvaluatedNot
Permitted
Not
Evaluated
IPSECNotevaluated:IPSecprovides
condentiality,authenticityand
integrityforIPdatatransmitted
betweentrusted(private)networks
orremoteclientsoveruntrusted
(public)linksornetworks.
×
1-10
SJ-20110815105844-030|2011/08/19（R1.6）ZTECORPORATION

Chapter2
CONFORMANCECLAIMS
TableofContents
COMMONCRITERIA(CC)CONFORMANCE............................................................2-1
2.1COMMONCRITERIA(CC)CONFORMANCE
ThisSTconformsto:
lCC,version3.1R3,asdenedby[CCp1],[CCp2],[CCp3]and[CEM].
lCCPart2asCCPart2conformant
lCCPart3asCCPart3conformant
ThisSTconformstonoProtectionProle.
ThisSTconformstoEAL3+ALC_FLR.2,andtonootherpackages.
2-1
SJ-20110815105844-030|2011/08/19（R1.6）ZTECORPORATION

ZXR10M6000&T8000&8900ESecurityTarget
Thispageintentionallyleftblank.
2-2
SJ-20110815105844-030|2011/08/19（R1.6）ZTECORPORATION

Chapter3
SECURITYPROBLEM
DEFINITION
InordertoclarifythenatureofthesecurityproblemthattheTOEisintendedtosolve,this
sectiondescribesthefollowing:
1.Anyknownorassumedthreatstotheassetsagainstwhichspecicprotectionwithin
theTOEoritsenvironmentisrequired
2.AnyorganizationalsecuritypolicystatementsorruleswithwhichtheTOEmustcomply
3.Anyassumptionsaboutthesecurityaspectsoftheenvironmentand/orofthemanner
inwhichtheTOEisintendedtobeused.
ThischapteridentiesthreatsasT.THREAT,assumptionsasA.ASSUMPTIONandpolicies
asP .POLICY .
TableofContents
Threat........................................................................................................................3-1
Assumption................................................................................................................3-2
ORGANIZATIONALSECURITYPOLICIES................................................................3-3
3.1Threat
Athreatconsistsofathreatagent,anassetandanadverseactionofthatthreatagenton
thatasset.
1.Threatagentsareentitiesthatcanadverselyactonassets–thethreatagentsinthe
threatsbelowareunauthorizeduser,networkattacker,authorizeduserand
2.Assetsareentitiesthatsomeoneplacesvalueupon–theassetsareaccesstonetwork
services,
3.Adverseactionsareactionsperformedbyathreatagentonanasset–theadverse
actionsare:unauthorizedchangestoconguration,bothnetworkroutingconguration
andmanagementconguration.
Table3-1Threat
THREATDESCRIPTION
T.AUDIT_REVIEWActionsperformedbyusersmaynotbeknowntotheadministrators
duetoactionsnotbeingrecordedortheauditrecordsnotbeing
reviewedpriortothemachineshuttingdown,oranunauthorized
administratormodiesordestroysauditdata.
3-1
SJ-20110815105844-030|2011/08/19（R1.6）ZTECORPORATION

ZXR10M6000&T8000&8900ESecurityTarget
THREATDESCRIPTION
T.NO_PRIVILEGEAnunauthorizedusermaygainaccesstoinappropriatelyview,tamper,
modify,ordeleteTOESecurityFunctionalitydata.
T.MEDIATEAnunauthorizedentitymaysendimpermissibleinformationthrough
theTOEwhichresultsintheexploitationofresourcesonthenetwork.
T.NO_AUTH_SESSIONAusermaygainunauthorizedaccesstoanunattendedsessionand
altertheTOEsecurityconguration.
T.NO_AUTH_ACCESSAnunauthorizedusergainsmanagementaccesstotheTOEandalter
theTOEsecurityconguration.
3.2Assumption
Theassumptionsareorderedintothreegroups:PersonnelAssumptions,Physical
EnvironmentAssumptions,andOperationalAssumptions.
3.2.1PersonnelAssumptions
Table3-2PersonnelAssumption
ASSUMPTIONDESCRIPTION
A.NO_EVIL&TRAINTheauthorizedadministratorsarenotcareless,willfullynegligent,or
hostile,andwillfollowandabidebytheinstructionsprovidedbythe
TOEdocumentation,includingtheadministratorguidance;however,
theyarecapableoferror.Theadministratorsaretrainedinthe
appropriateuseoftheTOE.
3.2.2PhysicalEnvironmentAssumptions
Table3-3PhysicalAssumption
ASSUMPTIONDESCRIPTION
A.CONNECTIVITYAllTOEexternalinterfacesexceptforthenetworktrafc/datainterface
areattachedtotheinternal(trusted)network.Thisincludes:
1.RADIUS,TACACS+serverinterface(optional)
2.SNMP/SYSLOGinterface(required)
3.NTPinterface(required)
4.SSHinterfaceforremoteclient(atleastoneofthelocalor
remoteadministrationclientisrequired)
3-2
SJ-20110815105844-030|2011/08/19（R1.6）ZTECORPORATION

Chapter3SECURITYPROBLEMDEFINITION
ASSUMPTIONDESCRIPTION
A.PHYSICALTheTOEwillbelocatedinanenvironmentthatprovidesphysical
securitytopreventunauthorizedphysicalaccess,commensuratewith
thevalueoftheITassetsprotectedbytheTOEanduninterruptible
power,temperaturecontrolrequiredforreliableoperation.
3.2.3OperationalAssumptions
Table3-4OperationalAssumption
ASSUMPTIONDESCRIPTION
A.TIMESExternalNTPserviceswillbeavailable.
3.3ORGANIZATIONALSECURITYPOLICIES
Thissectiondescribestheorganizationalsecuritypoliciestobeenforcedwithrespectto
theTOEenvironment..
Table3-5OrganizationalSecurityPolicy
OSPDESCRIPTION
P .USERSTheTOEisadministeredbyoneormoreAdministratorswhohave
beengrantedrightstoadministertheTOE.Alladministratorsare
“vetted”tohelpensuretheirtrustworthiness,andadministrator
connectivitytotheTOEisrestricted.
P .ROUTETheTOEmustbeabletoacceptroutingdatafromtrustedrouters
3-3
SJ-20110815105844-030|2011/08/19（R1.6）ZTECORPORATION

ZXR10M6000&T8000&8900ESecurityTarget
Thispageintentionallyleftblank.
3-4
SJ-20110815105844-030|2011/08/19（R1.6）ZTECORPORATION