2/4-port usb 3.0 4k displayport kvmp switch for atc (72 pages)
Summary of Contents for ATEN CS1182DP4C
Page 1
ATEN Secure KVM Switch Series (CAC Models) Security Target Version 1.1 2022-03-08 Prepared for: ATEN 3F, No. 125, Section 2, Datung Road, Sijhih District, New Taipei City, 221 Taiwan Prepared by: Common Criteria Testing Laboratory 6841 Benjamin Franklin Drive Columbia, Maryland 21046...
Page 2
Security Target Version 1.1 2022-03-08 Revision History Version Author Modifications Leidos Initial Version Leidos Incorporate vendor review comments Leidos Incorporate vendor review comments Leidos Updates based on evaluator comments Leidos Minor update to add adapters Leidos Updates for validator check-in comments Leidos Minor updates based on evaluator comments Leidos...
Security Target Version 1.1 2022-03-08 Table of Contents Security Target Introduction ......................... 1 Security Target, Target of Evaluation, and Common Criteria Identification ........1 Conformance Claims ........................2 Conventions ............................ 3 1.3.1 Terminology ..........................3 1.3.2 Acronyms ..........................5 TOE Description ............................ 7 Product Overview ...........................
Page 4
Security Target Version 1.1 2022-03-08 6.2.2 FDP_APC_EXT.1 (All Iterations); FDP_UDF_EXT.1/AO – Unidirectional Data Flow (Audio Output); FDP_UDF_EXT.1/KM – Unidirectional Data Flow (Keyboard/Mouse); FDP_UAI_EXT.1 User Authentication Isolation; FDP_UDF_EXT.1/VI – Unidirectional Data Flow (Video Output); ....35 6.2.3 FDP_CDS_EXT.1 – Connected Displays Supported ..............36 6.2.4 FDP_FIL_EXT.1/KM –...
Page 5
List of Figures and Tables Figure 1: Simplified Block Diagram of a 2-Port KVM TOE ................10 Figure 2: Representative ATEN Secure KVM Switch TOE Model in its environment ........12 Table 1: ATEN Secure KVM Switch TOE Models ................... 1 Table 2: Terms and Definitions ........................
Security Target Introduction This section identifies the Security Target (ST) and Target of Evaluation (TOE) identification, ST conventions, ST conformance claims, and the ST organization. The TOE is ATEN Secure KVM Switch Series (CAC Models) provided by ATEN. The Security Target contains the following additional sections: •...
Security Target Version 1.1 2022-03-08 Conformance Claims This ST and the TOE it describes are conformant to the following CC specifications: • Common Criteria for Information Technology Security Evaluation Part 2: Security Functional Components, Version 3.1 Revision 5, April 2017 •...
Security Target Version 1.1 2022-03-08 • TD0506 – Missing Steps to Disconnect and Reconnect Display Conventions The Security Functional Requirements included in this section are derived from Part 2 of the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5, with additional extended functional components.
Page 9
Security Target Version 1.1 2022-03-08 Term Definition A computing device connected to a PSD. May be a personal computer, server, Connected Computer tablet, or any other computing device. Connected Peripheral A Peripheral that is connected to a PSD. A physical or logical conduit that enables Devices to interact through respective Connection interfaces.
Security Target Version 1.1 2022-03-08 Term Definition TOE Security Functionality The combined hardware, software, and firmware capabilities of a TOE that are (TSF) responsible for implementation of its claimed SFRs. TOE Security Functionality Any external interface between the TOE and its Operational Environment that has Interface (TSFI) a security‐relevant purpose or is used to transmit security‐relevant data.
Page 11
Security Target Version 1.1 2022-03-08 Acronym Definition Personal Computer Peripheral Sharing Device Remote Port Selector Security Function Policy Universal Serial Bus...
TOE Overview The TOE is the ATEN Secure Switch series of products with CAC. The TOE allows users to connect a single set of peripherals to its console ports to interact with multiple computers that are connected to it via its computer ports.
Page 13
The tables below identify the interfaces of the Secure KVM console and computer ports according to model number. Table 4: ATEN Secure KVM Switch Console Interfaces and TOE Models Console Video Output Console...
Page 14
• CS1148D4C The ATEN Secure KVM products implement a secure isolation design for all models to share a single set of peripheral components. Each peripheral has its own dedicated data path. USB keyboard and mouse peripherals are filtered and emulated. The USB authentication device connection is on a separate circuit from the keyboard and mouse and, after filtering for qualification, has a direct connection path to the selected computer.
Page 15
Security Target Version 1.1 2022-03-08 The Secure KVM Switch products are designed to enforce the allowed and disallowed data flows between user peripheral devices and connected computers as specified in [PSD]. Data leakage is prevented across the TOE to avoid compromise of the user's information. The Secure KVM Switch products automatically clear the internal TOE keyboard and mouse buffers.
The ATEN Port Authentication Utility must be installed on a separate secure source computer using an installation wizard. The utility supports Microsoft Windows 8 and higher. The Port Authentication Utility computer connects to the TOE via USB connection to Computer Port 1.
Figure 2: Representative ATEN Secure KVM Switch TOE Model in its environment The ATEN Secure KVM devices do not include any wireless interfaces. The ATEN Secure KVM devices have been tested and found to comply with the radio frequency emissions limits for a Class A digital device, pursuant to Part 15 of the Federal Communications Commission rules.
Security Target Version 1.1 2022-03-08 2.4.1 Security Audit The TOE generates audit records for the authorized administrator actions. Each audit record records a standard set of information such as date and time of the event, type of event, and the outcome (success or failure) of the event.
In general, the [PSD] has presented a Security Problem Definition appropriate for peripheral sharing devices. The ATEN Secure KVM Switch Series supports KVM (USB Keyboard/Mouse, analog audio (out), DisplayPort, DVI-I and HDMI video) peripheral switch functionality by combining a 2/4/8 port KVM switch, an audio output port, and a USB authentication device (CAC port and smart card).
Security Target Version 1.1 2022-03-08 Security Objectives Like the Security Problem Definition, this Security Target includes by reference the Security Objectives from the [PSD], [MOD_VI_V1.0], [MOD_AO_V1.0], [MOD_KM_V1.0], and [MOD_UA_V1.0]. The [PSD], [MOD_AO_V1.0], and [MOD_VI_V1.0] security objectives for the operational environment are reproduced below, since these objectives characterize technical and procedural measures each consumer must implement in their operational environment.
Security Target Version 1.1 2022-03-08 IT Security Requirements This section defines the Security Functional Requirements (SFRs) and Security Assurance Requirements (SARs) that serve to represent the security functional claims for the Target of Evaluation (TOE) and to scope the evaluation effort. The SFRs have all been drawn from the Protection Profile: [PSD] and the modules: [MOD_AO_V1.0], [MOD_KM_V1.0], [MOD_UA_V1.0], and [MOD_VI_V1.0], and include some of the optional and selection- based SFRs.
Security Target Version 1.1 2022-03-08 Requirement Class Requirement Component FPT_PHP.1 – Passive Detection of Physical Attack FPT_PHP.3 – Resistance to Physical Attack FPT_STM.1 Reliable Time Stamps FPT_TST.1 – TSF Testing FPT_TST_EXT.1 – TSF Testing FTA: TOE Access FTA_CIN_EXT.1 – Continuous Indications 5.2.1 Security Audit (FAU) 5.2.1.1 Audit Data Generation (FAU_GEN.1) FAU_GEN.1.1...
Page 26
Security Target Version 1.1 2022-03-08 Table 8: Audio Filtration Specifications Frequency (kHz) Minimum Attenuation (dB) Maximum Voltage After Attenuation 23.9 127.65 mV 26.4 95.73 mV 30.8 57.68 mV 35.0 35.57 mV 38.8 22.96 mV 43.0 14.15 mV 46.0 10.02 mV 71.4 0.53 mV 71.4...
Page 27
Security Target Version 1.1 2022-03-08 FDP_APC_EXT.1.2/UA The TSF shall ensure that no data or electrical signals flow between connected computers whether the TOE is powered on or powered off. FDP_APC_EXT.1.3/UA The TSF shall ensure that no data transits the TOE when the TOE is powered off. FDP_APC_EXT.1.4/UA The TSF shall that no data transits the TOE when the TOE is in a failure state Application Note: This SFR is originally defined in the Base-PP but is refined and iterated to apply...
Page 28
Security Target Version 1.1 2022-03-08 FDP_FIL_EXT.1.3/UA The TSF shall consider all [PSD UA] whitelisted devices as authorized devices for [user authentication device] interfaces in peripheral device connections only if they are not on the [PSD UA] blacklist or otherwise unauthorized. 5.2.2.9 Peripheral Device Connection (FDP_PDC_EXT.1) FDP_PDC_EXT.1.1 The TSF shall reject connections with unauthorized devices upon TOE power up...
Page 29
Security Target Version 1.1 2022-03-08 • ‐ authorized devices as defined in the PP Module for Audio Output Devices, • ‐ authorized devices as defined in the PP Module for User Authentication Devices, • ‐ authorized devices as defined in the PP Module for Video/Display Devices, ] upon TOE power up and upon connection of a peripheral device to a powered- on TOE.
Page 30
Security Target Version 1.1 2022-03-08 5.2.2.13 Peripheral Device Connection (Video Output) (FDP_PDC_EXT.2/VI) FDP_PDC_EXT.2.1/VI The TSF shall allow connections with authorized devices as defined in [Appendix E of the VI Module] and [ • authorized devices as defined in the PP‐Module for Audio Output Devices, •...
Page 31
Security Target Version 1.1 2022-03-08 5.2.2.18 Residual Information Protection (Keyboard Data) (FDP_RIP.1/KM) FDP_RIP.1.1/KM The TSF shall ensure that any keyboard data in volatile memory is purged upon switching computers. 5.2.2.19 Residual Information Protection (FDP_RIP_EXT.1) FDP_RIP_EXT.1.1 The TSF shall ensure that no user data is written to TOE non‐volatile memory or storage.
Security Target Version 1.1 2022-03-08 5.2.2.27 User Authentication Isolation (FDP_UAI_EXT.1) FDP_UAI_EXT.1.1 The TSF shall isolate the user authentication function from all other TOE USB functions. 5.2.2.28 Unidirectional Data Flow (Audio Output) (FDP_UDF_EXT.1/AO) FDP_UDF_EXT.1.1/AO The TSF shall ensure [analog audio output data] transits the TOE unidirectionally from [the TOE analog audio output computer] interface to [the TOE analog audio output peripheral] interface.
Security Target Version 1.1 2022-03-08 5.2.4.3 Security Roles (FMT_SMR.1) FMT_SMR.1.1 The TSF shall maintain the roles [administrators]. FMT_SMR.1.2 The TSF shall be able to associate users with roles. 5.2.5 Protection of the TSF (FPT) 5.2.5.1 Failure with Preservation of Secure State (FPT_FLS_EXT.1) FPT_FLS_EXT.1.1 The TSF shall preserve a secure state when the following types of failures occur: failure of the power‐on self‐test and [failure of the anti-tamper function].
TOE Security Functional Requirements (DP Models) The following table identifies the [MOD_VI_V1.0] SFRs that are satisfied by DP Models, which include the following: • CS1182DP4C, • CS1184DP4C, • CS1188DP4C, •...
Security Target Version 1.1 2022-03-08 TOE Security Functional Requirements (H Models) The following table identifies the [MOD_VI_V1.0] SFRs that are satisfied by H models which includes the following: • CS1182H4C, • CS1184H4C, • CS1142H4C, and • CS1144H4C. Table 10: TOE Security Functional Components (H Models) Requirement Class Requirement Component FDP: User Data Protection...
Security Target Version 1.1 2022-03-08 TOE Security Functional Requirements (D Models) The following table identifies the [MOD_VI_V1.0] SFRs that are satisfied by D models which includes the following: • CS1182D4C, • CS1184D4C, • CS1188D4C, • CS1142D4C, • CS1144D4C, and • CS1148D4C.
Security Target Version 1.1 2022-03-08 TOE Security Assurance Requirements The security assurance requirements for the TOE are included by reference from the [PSD]. Table 12: Assurance Components Requirement Class Requirement Component Security Target (ASE) Conformance Claims (ASE_CCL.1) Extended Components Definition (ASE_ECD.1) ST Introduction (ASE_INT.1) Security Objectives (ASE_OBJ.2) Derived Security Requirements (ASE_REQ.2)
• peripheral device acceptance, • button jam test failure, and • all passing self-tests. During normal operation, the TOE provides administrator access to all audit records. ATEN's assistance is required to read audit records from an inoperable switch.
Security Target Version 1.1 2022-03-08 The logs are stored on EEPROM on the KVM PCBoard component of the TOE. The logs can be extracted by the authorized administrator by entering Administrator Logon mode, logging on, and then issuing the command [LIST]. The TOE extracts the log data and displays them using the text editor. The administrator can view the logs but cannot erase or delete any of the information.
Because of this, the single selected source video feed is always the same channel and indication of the selected channel is through the channel selection LEDs on the TOE chassis. The DisplayPort models CS1182DP4C, CS1184DP4C, and CS1188DP4C each support one connected display. While CS1142DP4C, CS1144DP4C, and CS1148DP4C each support two connected displays at a time.
Security Target Version 1.1 2022-03-08 The TOE emulates data from authorized USB Keyboard and Mouse protocol interfaces to USB connected computers. 6.2.5 FDP_FIL_EXT.1/UA – Device Filtering (User Authentication Devices) All TOE Secure KVM Switch models support configurable USB authentication device (CAC reader and smart card) peripheral devices.
Page 43
Security Target Version 1.1 2022-03-08 unauthorized. If there is no defined blacklist, the devices defined in the default built-in whitelist are allowed. If a device is not on any list, it is rejected. 6.2.6 FDP_PDC_EXT.1 – Peripheral Device Connection; FDP_PDC_EXT.2/AO – Peripheral Device Connection (Audio Output);...
TOE. During KVM operation, non-standard keyboards with integrated USB hubs and/or other USB-integrated devices may not be fully supported due to the strict security standards and policy for the ATEN Secure KVM Switch. If supported, only basic (HID) keyboard operations will function.
Security Target Version 1.1 2022-03-08 self-test, the KVM port focus will be switched to Port 1, and the CAC function of each port will be set to factory default (enabled). Audit logs are retained and a log is generated for Reset to Factory Default. The TOE also provides non-administrative users a front panel Reset button allowing the user to delete TOE stored configuration and settings.
DP Models The following TOE models support DP 1.2 video input and output, and one or two displays. Table 14: DP Models Configuration 2-Port 4-Port 8-Port Single Head CS1182DP4C CS1184DP4C CS1188DP4C DisplayPort Dual Head CS1142DP4C CS1144DP4C CS1148DP4C These models accept DisplayPort for the computer video display interface. The TOE will convert the DP signal to HDMI inside the TOE and then back to DisplayPort for output to the console display(s).
Security Target Version 1.1 2022-03-08 Table 15: H Models Configuration 2-Port 4-Port 8-Port Single Head CS1182H4C CS1184H4C HDMI Dual Head CS1142H4C CS1144H4C The TOEs video EDID read procedure is activated once during power‐on or reboot in order to read the connected display EDID information.
Security Target Version 1.1 2022-03-08 Security Management The TOE provides management functions to configure the user authentication device/ keyboard/ mouse filtering (i.e. CDF), to return the device to factory setting, to view audit logs and to change the administrator password; and restricts access to these management functions to the authorized administrator.
Security Target Version 1.1 2022-03-08 KVM port focus will be switched to Port 1, and the CAC function of each port will be set to factory default (enabled). The Reset to Factory Default does not affect or erase Log data nor does it affect the previously changed Administrator password.
TOE user and the guidance documentation instructs the user to stop using the TOE, remove it from service and contact ATEN. The KVM and RPS contain internal batteries with a minimum lifetime of five years, are non-replaceable, and cannot be accessed without opening the device enclosure.
Page 51
Security Target Version 1.1 2022-03-08 • Key stuck test (KVM front panel Push button jam test): the TOE will check that the status of all button values in the micro-controller to ensure the push buttons are operational. Upon a test failure, the TOE does not shut down, the front panel Port LED and CAC LED of that jammed button port will flash.
Security Target Version 1.1 2022-03-08 • Connecting a “tampered” RPS before KVM power-up → The KVM will detect that the RPS is tampered and reject the connection with RPS → The RPS LEDs flash. • Connecting a RPS with battery damaged or exhausted to KVM before KVM power-up → The KVM will detect the RPS battery status and reject the connection with RPS →...
Page 53
Security Target Version 1.1 2022-03-08 computer attached to its corresponding port has a USB CAC reader cable connected and CAC function is enabled (although the computer is not selected). If the CAC LED flashes when the corresponding port is selected, this indicates a non-qualified USB smart card/CAC reader is connected. The TOE has a reset button that resets the switch to the default settings when pressed.
Security Target Version 1.1 2022-03-08 Protection Profile Claims This ST is conformant to the Protection Profile [PSD], including the following optional and selection-based SFRs: FAU_GEN.1, FDP_RIP_EXT.2, FDP_SWI_EXT.2, FIA_UAU.2, FIA_UID.2, FMT_MOF.1, FMT_SMF.1, FMT_SMR.1, FPT_PHP.3, FPT_STM.1, and FTA_CIN_EXT.1. The ST is also conformant to the following PP-Modules •...
Page 56
Security Target Version 1.1 2022-03-08 Requirement Class Requirement Component Source FMT: Security FMT_SMF.1 – Specification of Management Functions [PSD] Management FMT_SMR.1 – Security Roles [PSD] FPT: Protection of the FPT_FLS_EXT.1 – Failure with Preservation of Secure State [PSD] FPT_NTA_EXT.1 – No Access to TOE [PSD] FPT_PHP.1 –...
Security Target Version 1.1 2022-03-08 Rationale This security target includes by reference the [PSD], [MOD_AO_V1.0], [MOD_KM_V1.0], [MOD_UA_V1.0], and [MOD_VI_V1.0] Security Problem Definitions, Security Objectives, and Security Assurance Requirements. The security target makes no additions to the [PSD] or listed modules assumptions. The [PSD] and listed module’s security functional requirements have been reproduced with the Protection Profile operations completed.
User Data Manufacturer, and Type Technology Part number System Controller Embedded Undisclosed Volatile May contain user data Host Controller ATEN SICG8021A Host Controller Embedded Undisclosed Volatile May contain user data Device Emulators ATEN SICG8022A System EEPROM EEPROM 512K bits Non-volatile...
Page 61
Security Target Version 1.1 2022-03-08 ITE IT66354 Remarks (1) The Embedded RAM may contain user data. The Embedded RAM is cleared and user keyboard/mouse data is purged when the Secure KVM powers-off or power-cycles, after switching ports, after a KVM reset (reboot), or a trigger of the tamper-proof mechanism is detected.
Need help?
Do you have a question about the CS1182DP4C and is the answer not in the manual?
Questions and answers