Ricoh Aficio MP 6001 SP Security Target - Page 30

of

87

This TOE claims the data protection against the non-volatile memory medium that is not allowed to be

attached nor removed by administrator, and FCS_CKM.1 and FCS_COP.1 are added.

While FDP_ACC.1(a) and FDP_ACF.1(a) in the PP require access control to D.DOC, this ST specifies that

only user documents, which are included in the D.DOC equivalent document, shall be subject to access

control, and it is not required that access control to the deleted documents, temporary documents and their

fragments be implemented. Because the TOE does not provide any function to access those documents and

fragments, and because the TOE's Residual Data Overwrite Function makes them unavailable before they are

read by users, it is not necessary to provide access control to those documents and fragments. Therefore,

FDP_ACC.1(a) and FDP_ACF.1(a) in this ST satisfy the requirements demanded in the PP.

While FDP_ACF.1.1(a) and FDP_ACF.1.2(a) in the PP require the access control SFP to the document data

that is defined for each SFR package in the PP, this ST instantiates the abstract security attributes in the PP

and describes the security attributes that are actually used for this TOE as access control to the user

documents and user jobs. This is not deviated from the PP.

FDP_ACF.1.2(a) in ST, operations to user documents vary depending on the type of documents and each

TOE function (application type). For this TOE, however, the access control process to user with permission

is always the same even when operated from the Operation Panel, printer driver, Web browser or fax driver.

This is not deviated from the PP but instantiated.

For FDP_ACF.1.4(a), a rule that rejects the operations of user documents and user jobs by supervisor is

added. Supervisor is not identified in the PP and is the special user for this TOE.

The PP only allows the specified users to operate the user documents and user jobs, and this is not deviated

from the PP.

While FDP_ACF.1.3(b) in the PP allows the user with administrator permission to operate the TOE function,

this ST only allows the Fax Reception Function which is the one of this TOE functions. The TOE allows the

MFP administrator to delete the user documents and user jobs (common access control SFP, FDP_ACC.1(a)

and FDP_ACF.1(a)), and as a result, the TSF restrictively allows the MFP administrator to access to the TOE

functions. Therefore, the requirement for FDP_ACF.1.3(b) in the PP is satisfied at the same time. The fax

reception process, which is accessed when receiving from telephone line, is regarded as the user with

administrator permission. Therefore, FDP_ACF.1.3(b) in this ST satisfies FDP_ACF.1.3(b) in the PP.

The TOE is 2600.1-PRT, 2600.1-SCN, 2600.1-CPY, 2600.1-FAX, 2600.1-DSR, and 2600.1-SMI

conformant.

2600.1-NVS is not selected because this TOE does not have any non-volatile memory medium that can be

detachable.

This TOE, in accordance with the PP, extends the functional requirement Part 2 due to the addition of the

restricted forwarding of data to external interfaces (FPT_FDI_EXP).

For conforming to the PP, some sections in this document are literally translated to make it easier for readers

to understand when translating English into Japanese. However, this translation is not beyond the

requirements of the PP conformance.

Copyright (c) 2011 RICOH COMPANY, LTD. All rights reserved.

Section	Page
1 ST Introduction	7
1.1 ST Reference	7
1.2 TOE Reference	7
1.3 TOE Overview	9
1.3.1 TOE Type	9
1.3.2 TOE Usage	9
1.3.3 Major Security Features of TOE	11
1.4 TOE Description	11
1.4.1 Physical Boundary of TOE	11
1.4.2 Guidance Documents	14
1.4.3 Definition of Users	17
1.4.3.1. Direct User	19
1.4.3.2. Indirect User	19
1.4.4 Logical Boundary of TOE	20
1.4.4.1. Basic Functions	20
1.4.4.2. Security Functions	23
1.4.5 Protected Assets	24
1.4.5.1. User Data	24
1.4.5.2. TSF Data	25
1.4.5.3. Functions	25
1.5 Glossary	25
1.5.1 Glossary for This ST	25
2 Conformance Claim	28
2.1 CC Conformance Claim	28
2.2 PP Claims	28
2.3 Package Claims	28
2.4 Conformance Claim Rationale	29
2.4.1 Consistency Claim with TOE Type in PP	29
2.4.2 Consistency Claim with Security Problems and Security Objectives in PP	29
2.4.3 Consistency Claim with Security Requirements in PP	29
3 Security Problem Definitions	32
3.1 Threats	32
3.2 Organisational Security Policies	33
3.3 Assumptions	33
4 Security Objectives	35
4.1 Security Objectives for TOE	35
4.2 Security Objectives of Operational Environment	36
4.2.1 IT Environment	36
4.2.2 Non-IT Environment	37
	37
4.3 Security Objectives Rationale	38
4.3.1 Correspondence Table of Security Objectives	38
4.3.2 Security Objectives Descriptions	39
5 Extended Components Definition	43
5.1 Restricted forwarding of data to external interfaces (FPT_FDI_EXP)	43
6 Security Requirements	45
6.1 Security Functional Requirements	45
6.1.1 Class FAU: Security audit	45
6.1.2 Class FCS: Cryptographic support	48
6.1.3 Class FDP: User data protection	49
6.1.4 Class FIA: Identification and authentication	53
6.1.5 Class FMT: Security management	56
6.1.6 Class FPT: Protection of the TSF	62
6.1.7 Class FTA: TOE access	62
6.1.8 Class FTP: Trusted path/channels	63
6.2 Security Assurance Requirements	63
6.3 Security Requirements Rationale	64
6.3.1 Tracing	64
6.3.2 Justification of Traceability	65
6.3.3 Dependency Analysis	71
6.3.4 Security Assurance Requirements Rationale	73

Ricoh Aficio MP 6001 SP Security Target - Page 30

Copyright c 2011 RICOH COMPANY, LTD. All rights reserved.

Page 30 highlights