Ricoh Aficio MP 6001 SP Security Target - Page 77

of

87

- If the MFP application executed from printer driver is the Printer Function, it is allowed to store the

Document Server user document.

- If the MFP application executed from fax driver is the Fax Function, it is allowed to store the fax

document.

For access to the user document by the normal user process, the login user name of normal user associated

with the normal user process and login user name of normal user in the document user list associated with

the user document are checked, and if they match, the above-specified operations are allowed for the normal

user process.

The TOE associates the user job with the login user name of the person who newly created the user job as a

security attribute.

For access to the user job by the normal user process, the login user name of normal user associated with the

normal user process and login user name of the person, who created the user job, associated with the user job

are checked, and if they match, the access control is performed and it is allowed for the normal user process

to delete the user job.

The access control is also performed for the MFP administrator process, and it is allowed for the MFP

administrator process to delete all of the stored user documents and created user jobs.

For the supervisor process, the access control is performed and operations on all of the stored user

documents and created user jobs are denied.

FDP_ACF.1(b) (Security attribute based access control)

The TOE defines the rule between the user role allowed to access the Copy Function, Printer Function,

Scanner Function, Fax Function and Document Server Function, and operations allowed to each user role as

shown in Table 21 and Table 22. It provides each user who is allowed to access to the MFP applications with

the appropriate operation according to this rule.

The TOE associates the normal user process with the login user name of normal user, and available function

list (the list of functions that the normal user is allowed to access) as a security attribute.

For access to the MFP application by the normal user process, the TOE checks if the available function list

associated with the normal user process contains the function type (any of the following: Copy Function,

Printer Function, Scanner Function, Fax Function and Document Server Function) that the normal user

attempts to use as the attribute of the MFP application. If it does, the access control is performed and the

normal user process is allowed to execute the function.

It is always allowed to execute the fax reception function that if it is operated using administrator permission.

FDP_RIP.1 (Subset residual information protection)

When a user deletes a user document, the TOE overwrites the area on the HDD where the digital image data

of the user document exists with the specific pattern. It also overwrites the area on the HDD where the

temporary document and its fragments that are created during the user job execution exist with the specific

pattern after the user job completes.

Copyright (c) 2011 RICOH COMPANY, LTD. All rights reserved.

Section	Page
1 ST Introduction	7
1.1 ST Reference	7
1.2 TOE Reference	7
1.3 TOE Overview	9
1.3.1 TOE Type	9
1.3.2 TOE Usage	9
1.3.3 Major Security Features of TOE	11
1.4 TOE Description	11
1.4.1 Physical Boundary of TOE	11
1.4.2 Guidance Documents	14
1.4.3 Definition of Users	17
1.4.3.1. Direct User	19
1.4.3.2. Indirect User	19
1.4.4 Logical Boundary of TOE	20
1.4.4.1. Basic Functions	20
1.4.4.2. Security Functions	23
1.4.5 Protected Assets	24
1.4.5.1. User Data	24
1.4.5.2. TSF Data	25
1.4.5.3. Functions	25
1.5 Glossary	25
1.5.1 Glossary for This ST	25
2 Conformance Claim	28
2.1 CC Conformance Claim	28
2.2 PP Claims	28
2.3 Package Claims	28
2.4 Conformance Claim Rationale	29
2.4.1 Consistency Claim with TOE Type in PP	29
2.4.2 Consistency Claim with Security Problems and Security Objectives in PP	29
2.4.3 Consistency Claim with Security Requirements in PP	29
3 Security Problem Definitions	32
3.1 Threats	32
3.2 Organisational Security Policies	33
3.3 Assumptions	33
4 Security Objectives	35
4.1 Security Objectives for TOE	35
4.2 Security Objectives of Operational Environment	36
4.2.1 IT Environment	36
4.2.2 Non-IT Environment	37
	37
4.3 Security Objectives Rationale	38
4.3.1 Correspondence Table of Security Objectives	38
4.3.2 Security Objectives Descriptions	39
5 Extended Components Definition	43
5.1 Restricted forwarding of data to external interfaces (FPT_FDI_EXP)	43
6 Security Requirements	45
6.1 Security Functional Requirements	45
6.1.1 Class FAU: Security audit	45
6.1.2 Class FCS: Cryptographic support	48
6.1.3 Class FDP: User data protection	49
6.1.4 Class FIA: Identification and authentication	53
6.1.5 Class FMT: Security management	56
6.1.6 Class FPT: Protection of the TSF	62
6.1.7 Class FTA: TOE access	62
6.1.8 Class FTP: Trusted path/channels	63
6.2 Security Assurance Requirements	63
6.3 Security Requirements Rationale	64
6.3.1 Tracing	64
6.3.2 Justification of Traceability	65
6.3.3 Dependency Analysis	71
6.3.4 Security Assurance Requirements Rationale	73

Ricoh Aficio MP 6001 SP Security Target - Page 77

Printer Function, Scanner Function, Fax Function and Document Server Function that the normal user

Page 77 highlights