Ricoh Aficio MP 6001 SP Security Target - Page 66

of

87

(2)

Prevent reading the deleted documents, temporary documents and their fragments.

Deleted documents, temporary documents and their fragments are prevented from being read by

FDP_RIP.1.

(3)

Use trusted channels for sending or receiving user documents.

The user documents sent and received from the LAN interface are protected by FTP_ITC.1.

(4)

Management of the security attributes.

FMT_MSA.1(a) specifies the available operations (newly create, query, modify and delete) on the login

user name, and available operations (query and modify) on the document user list, and a specified user

is thus restricted to perform each operation.

FMT_MSA.3(a) sets the defined default value to the document user list and document type which are

the security attributes of the user document (object) when the user document is generated.

By

satisfying

FDP_ACC.1(a),

FDP_ACF.1(a),

FDP_RIP.1,

FTP_ITC.1,

FMT_MSA.1(a)

and

FMT_MSA.3(a), which are the security functional requirements for these countermeasures, O.DOC.NO_DIS

is fulfilled.

O.DOC.NO_ALT Protection of document alteration

O.DOC.NO_ALT is the security objective to prevent the documents from unauthorised alteration by persons

without a login user name, or by persons with a login user name but without an access permission to the

document. To fulfil this security objective, it is required to implement the following countermeasures.

(1)

Specify and implement the access control to user document.

FDP_ACC.1(a) and FDP_ACF.1(a) restrict the deletion (there is no "editing operation" of user

documents) of user document by the user role. Additionally, the normal users are restricted to delete the

user document by the operation permission granted to them. To normal users, the available document

type of user document is restricted by the executing MFP application, and the normal user can delete

only user document for which the deleting permission is granted. The MFP administrator is allowed to

delete the user documents. The supervisor is not allowed to delete the user documents.

(2)

Prevent deleting the deleted documents, temporary documents and their fragments.

Deleted documents, temporary documents and their fragments are prevented from being used by

FDP_RIP.1.

(3)

Use trusted channels for sending or receiving user documents.

The user documents sent and received from the LAN interface are protected by FTP_ITC.1.

(4)

Management of the security attributes.

FMT_MSA.1(a) specifies the available operations (newly create, query, modify and delete) on the login

user name, and available operations (query and modify) on the document user list, and a specified user

is thus restricted to perform each operation.

FMT_MSA.3(a) sets the defined default value to the document user list and document type which are

the security attributes of the user document (object) when the user document is generated.

By

satisfying

FDP_ACC.1(a),

FDP_ACF.1(a),

FDP_RIP.1,

FTP_ITC.1,

FMT_MSA.1(a)

and

FMT_MSA.3(a),

which

are

the

security

functional

requirements

for

these

countermeasures,

O.DOC.NO_ALT is fulfilled.

Copyright (c) 2011 RICOH COMPANY, LTD. All rights reserved.

Section	Page
1 ST Introduction	7
1.1 ST Reference	7
1.2 TOE Reference	7
1.3 TOE Overview	9
1.3.1 TOE Type	9
1.3.2 TOE Usage	9
1.3.3 Major Security Features of TOE	11
1.4 TOE Description	11
1.4.1 Physical Boundary of TOE	11
1.4.2 Guidance Documents	14
1.4.3 Definition of Users	17
1.4.3.1. Direct User	19
1.4.3.2. Indirect User	19
1.4.4 Logical Boundary of TOE	20
1.4.4.1. Basic Functions	20
1.4.4.2. Security Functions	23
1.4.5 Protected Assets	24
1.4.5.1. User Data	24
1.4.5.2. TSF Data	25
1.4.5.3. Functions	25
1.5 Glossary	25
1.5.1 Glossary for This ST	25
2 Conformance Claim	28
2.1 CC Conformance Claim	28
2.2 PP Claims	28
2.3 Package Claims	28
2.4 Conformance Claim Rationale	29
2.4.1 Consistency Claim with TOE Type in PP	29
2.4.2 Consistency Claim with Security Problems and Security Objectives in PP	29
2.4.3 Consistency Claim with Security Requirements in PP	29
3 Security Problem Definitions	32
3.1 Threats	32
3.2 Organisational Security Policies	33
3.3 Assumptions	33
4 Security Objectives	35
4.1 Security Objectives for TOE	35
4.2 Security Objectives of Operational Environment	36
4.2.1 IT Environment	36
4.2.2 Non-IT Environment	37
	37
4.3 Security Objectives Rationale	38
4.3.1 Correspondence Table of Security Objectives	38
4.3.2 Security Objectives Descriptions	39
5 Extended Components Definition	43
5.1 Restricted forwarding of data to external interfaces (FPT_FDI_EXP)	43
6 Security Requirements	45
6.1 Security Functional Requirements	45
6.1.1 Class FAU: Security audit	45
6.1.2 Class FCS: Cryptographic support	48
6.1.3 Class FDP: User data protection	49
6.1.4 Class FIA: Identification and authentication	53
6.1.5 Class FMT: Security management	56
6.1.6 Class FPT: Protection of the TSF	62
6.1.7 Class FTA: TOE access	62
6.1.8 Class FTP: Trusted path/channels	63
6.2 Security Assurance Requirements	63
6.3 Security Requirements Rationale	64
6.3.1 Tracing	64
6.3.2 Justification of Traceability	65
6.3.3 Dependency Analysis	71
6.3.4 Security Assurance Requirements Rationale	73

Ricoh Aficio MP 6001 SP Security Target - Page 66

O.DOC.NO_ALT Protection of document alteration

Page 66 highlights