Motorola S2500 Manuel utilisateur

Motorola Network Router (MNR)

S2500

Security Policy

Document Version 1.3

Revision Date: 1/13/2009

MNR S2500 Security Policy

Version 1.3, Revision Date: 1/13/2009

Page 2

TABLE OF CONTENTS

1. MODULE OVERVIEW .........................................................................................................................................3

2. SECURITY LEVEL................................................................................................................................................4

3. MODES OF OPERATION.....................................................................................................................................4

4. PORTS AND INTERFACES .................................................................................................................................8

5. IDENTIFICATION AND AUTHENTICATION POLICY.................................................................................8

6. ACCESS CONTROL POLICY............................................................................................................................10

AUTHENTICATED SERVICES.....................................................................................................................................10

UNAUTHENTICATED SERVICES:...............................................................................................................................10

ROLES AND SERVICES..............................................................................................................................................11

DEFINITION OF CRITICAL SECURITY PARAMETERS (CSPS)......................................................................................12

DEFINITION OF CSPS MODES OF ACCESS ................................................................................................................13

7. OPERATIONAL ENVIRONMENT....................................................................................................................15

8. SECURITY RULES..............................................................................................................................................15

9. CRYPTO OFFICER GUIDANCE.......................................................................................................................16

10. PHYSICAL SECURITY POLICY ....................................................................................................................17

PHYSICAL SECURITY MECHANISMS.........................................................................................................................17

11. MITIGATION OF OTHER ATTACKS POLICY...........................................................................................17

12. DEFINITIONS AND ACRONYMS...................................................................................................................17

MNR S2500 Security Policy

Version 1.3, Revision Date: 1/13/2009

Page 3

1. Module Overview

The MNR S2500 router, also referred to as the S2500, is a multi-chip standalone cryptographic

module encased in a commercial grade metal case made of cold rolled steel. The module

cryptographic boundary is the routers enclosure which includes all components, including the

encryption module which is a separate part. Figure 1 illustrates the cryptographic boundary of

the MNR S2500 router. In the photo, blank plates cover slots that can hold optional network

interface cards. The FIPS validated firmware versions are XS-15.1.0.75, XS-15.1.0.76, XS-

15.2.0.20, and XS-15.4.0.60.

S2500 Base Unit S2500 Encryption ModuleConfigurations

P/N Tanapa

Number Revision P/N Tanapa

Number Revision

FW Version

1 ST2500B CLN1713E B ST2516A CLN8262C C XS-15.1.0.75

2 ST2500B CLN1713E B ST2516A CLN8262C C XS-15.1.0.76

3 ST2500B CLN1713E B ST2516A CLN8262C C XS-15.2.0.20

4 ST2500B CLN1713E B ST2516A CLN8262C C XS-15.4.0.60

Table 1. MNR S2500 Router Version Numbers

Figure 1 – MNR S2500 Router Cryptographic Module Boundary

Optional Interface Cards

(not included in cryptographic module boundary)

MNR S2500 Security Policy

Version 1.3, Revision Date: 1/13/2009

Page 4

2. Security Level

The cryptographic module meets the overall requirements applicable to Level 1 security of

FIPS 140-2.

Security Requirements Section Level

Cryptographic Module Specification 1

Module Ports and Interfaces 1

Roles, Services and Authentication 1

Finite State Model 1

Physical Security 1

Operational Environment N/A

Cryptographic Key Management 1

EMI/EMC 3

Self-Tests 1

Design Assurance 1

Mitigation of Other Attacks N/A

Table 2 – Module Security Level Specification

3. Modes of Operation

Approved mode of operation

In FIPS mode, the cryptographic module supports the following FIPS-Approved algorithms as

follows:

Hardware Implementations

a. Triple-DES– CBC mode (112 or 168 bit) for IPsec and FRF.17 encryption (Cert. #588)

b. AES - CBC mode(128, 192, 256 bit) for IPsec and FRF.17 encryption (Cert. #625)

c. HMAC-SHA-1 for IPsec and FRF.17 authentication (Cert. #342)

d. SHA-1 for message hash (Cert. #693)

MNR S2500 Security Policy

Version 1.3, Revision Date: 1/13/2009

Page 5

Firmware Implementations

a. Triple-DES– CBC mode (112 and 168 bit) for IKE and SSHv2 encryption (Cert. #581)

b. AES - CBC (128, 192, 256 bit), ECB (128), and CFB (128) modes for IKE and SSHv2

encryption (Cert. #611)

c. HMAC-SHA-1 for IKE and SSHv2 authentication (Cert. # 322)

d. SHA-1 for message hash (Cert. # 659)

e. RSA v1.5 1024 bit – for public/private key pair generation and digital signatures (Cert.

#283)

f. DSA 1024 bit – for public/private key pair generation and digital signatures (Cert. #237)

g. ANSI X9.31 Deterministic Random Number Generator (DRNG) (Cert .#349)

The MNR S2500 router supports the commercially available IKE and Diffie-Hellman protocols

for key establishment, IPsec (ESP) and FRF.17 protocols to provide data confidentiality using

FIPS-approved encryption and authentication algorithms and SSHv2 for secure remote access.

Allowed Algorithms

•Diffie-Hellman: (allowed for key agreement per Annex D, key agreement methodology

provides 80 to 112 bits of encryption strength)

•Hardware non-deterministic RNG: Provides seed for approved deterministic RNG

•MD5: for hashing (Provides interoperability within supported protocols)

•HMAC-MD5

Non-FIPS approved algorithms

In a Non FIPS mode of operation, the cryptographic module provides non-FIPS Approved

algorithms as follows:

•DES for encryption/decryption

•Non approved SW RNG

•Diffie-Hellman (Group 1 - 768 bit)

MNR S2500 Security Policy

Version 1.3, Revision Date: 1/13/2009

Page 6

Entering FIPS Mode

To enter FIPS mode, the Crypto Officer must follow the procedure outlined in Table 3 below.

For details on individual router commands, use the online help facility or review the Enterprise

OS Software User Guide, version 15.4 and the Enterprise OS Software Reference Guide, version

15.4.

Step Description

1. Configure the parameters for the IKE negotiations using the IKEProfile command. For FIPS

mode, only the following values are allowed: Diffie-Hellman Group (Group 2 or Group 5),

Encryption Algorithm (AES or 3DES), Hash Algorithm (SHA), and Authentication Method

(PreSharedKey).

2. Manually establish via the local console port the pre-shared key (PSK) to be used for the IKE

protocol using:

ADD –CRYPTO FipsPreSharedKey <peer_ID> <pre-shared_key> <pre-shared_key>

The PSK must be at least 80 bits in length with at least 80 bits of entropy.

3. Configure Ipsec and FRF.17 selector lists using the command

ADD –CRYPTO SelectorLIst

For FIPS mode, the selector list must be configured to encrypt all packets on an encrypted port,

e.g. ADD –CRYPTO SelectorLIst s1 1 Include ANY 0.0.0.0/0 0.0.0.0/0

4. If Ipsec is used, configure Ipsec transform lists using the ADD –CRYPTO TransformLIst

command. For FIPS mode, only the following values are allowed: Encryption Transform (ESP-

3DES, or ESP-AES) and Authentication Transform (ESP-SHA).

5. If FRF.17 is used, configure FRF.17 transform lists using the ADD –CRYPTO

TransformLIst command. For FIPS mode, only the following values are allowed: Encryption

Transform (FRF-3DES, or FRF-AES) and Authentication Transform (FRF-SHA).

6. For each port for which encrypted is required, bind a dynamic policy to the ports using

ADD [!<portlist>] –CRYPTO DynamicPOLicy <policy_name> <priority>

<mode> <selctrlist_name> <xfrmlist_name> [<pfs>] [<lifetime>] [<preconnect>]

To be in FIPS mode, the selector list and transform list names must be defined as in previous

steps.

7. For each port for which encryption is required, enable encryption on that port using

SETDefault [!<portlist>] –CRYPTO CONTrol = Enabled

8. FIPS-140-2 mode achieved

Table 3 – FIPS Approved mode configuration

To review the cryptographic configuration of the router, use the following command:

MNR S2500 Security Policy

Version 1.3, Revision Date: 1/13/2009

Page 7

SHOW –CRYPTO CONFiguration

This command shows a detailed summary of the cryptographic configuration and allows a user

to verify that encryption is enabled on user-determined ports and that only FIPS-Approved

algorithms are used for encryption and authentication.

MNR S2500 Security Policy

Version 1.3, Revision Date: 1/13/2009

Page 8

4. Ports and Interfaces

Table 4 below provides a listing of the physical ports and logical interfaces for

the MNR S2500 router.

The MNR S2500 base unit provides a single 10/100 Mbps Ethernet interface and a console port.

The MNR S2500 router incorporates two I/O slots for WAN and LAN connectivity and one slot

for analog connectivity.

Physical Port Qty Logical interface definition Interface Card Comments

Ethernet 1 Data input, data output, status

output, control input Part of the 2500 Base

system LAN port that provides

connection to Ethernet

LANs using either

10BASE-T or

100BASE-TX Ethernet

Console 1 Status output, control input Part of the S2500 Base

system RS-232 interface

LAN/WAN 0, 1 or

2 Data input, data output, status

output, control input, power

output

Optional Ethernet and

WAN modules

Analog 0, 1 Data input, data output, status

output, control input, power

output

Optional conventional-

to-IP (E&M)

Power Plug 1 Power input N/A External Power input

port

LEDs 7 Status Output N.A Provides LED status

output

Table 4 – S2500 physical ports and logical interfaces

5. Identification and Authentication Policy

Assumption of roles

The MNR S2500 router supports five distinct operator roles: Crypto Officer (SuperUser),

Admin, Network Manager, User and Maintenance. The first four roles require user

authentication via user name and password when accessing the router via any interface. The

unauthenticated maintenance role is entered only via the router console port.

The MNR S2500 router enforces the separation of roles by providing specific services only to

users who have been authenticated to a role with the required privilege to access those services.

The role-based authentication capabilities will be described here, although the role based-

authentication is not required to comply with Level 1 requirements.

An operator must enter a username and its password to log in. Passwords are alphanumeric

MNR S2500 Security Policy

Version 1.3, Revision Date: 1/13/2009

Page 9

strings consisting of 7 to 15 characters chosen from the 94 standard keyboard characters. Upon

correct authentication, the role is selected based on the username of the operator. At the end of a

session, the operator must log-out.

When a router power cycles, sessions are terminated. A user must reauthenticate to access the

router.

Multiple concurrent operators. Each operator has an independent session with the router, either

though Telnet, SSH, or via the console. Once authenticated to a role, each operator can access

only those services for that role. In this way, separation is maintained between the role and

services allowed for each operator.

The definition of all supported roles is shown in Table 5 below.

Role Type of

Authentication Authentication Data Description

Crypto Officer

(Super User) Role-based operator

authentication.

Username and Password. The

module stores user identity

information internally or if

configured,

The owner of the cryptographic

module with full access to services of

the module.

Network

Manager Role-based operator

authentication.

Username and Password. The

module stores user identity

information internally.

A user of the cryptographic module

with almost full access to services of

the module.

Admin Role-based operator

authentication Username and Password. The

module stores user identity

information internally.

An assistant to the Crypto Officer

that has read only access to a subset

of module configuration and status

indications.

User Role-based operator

authentication Username and Password. The

module stores user identity

information internally.

A user of the cryptographic module

that has read only access to a subset

of module configuration and status

indications.

Maintenance None (see comment) N/A Maintenance role can be entered via

the external console port

(unauthenticated) or via EOS

software command (requires

Network Manager authentication)

Table 5 – Roles and Required Identification and Authentication

Authentication Mechanism Strength of Mechanism

Username and Password The probability that a random attempt will succeed or

a false acceptance will occur is 1/94^7 which is less

than 1/1,000,000.

Table 6 – Strengths of Authentication Mechanisms

MNR S2500 Security Policy

Version 1.3, Revision Date: 1/13/2009

Page 10

6. Access Control Policy

Authenticated Services

•Firmware Update: load firmware images digitally signed by RSA (1024 bit) algorithm.

•Key Entry: Enter Pre-Shared Keys (PSK)

•User Management: Add/Delete and manage passwords operators

•Reboot: force the module to power cycle via a command

•Zeroization: actively destroy all plaintext CSPs and keys

•Crypto Configuration: Configure IPsec and FRF.17 services

•IKE: Key establishment utilizing the IKE protocol

•IPsec tunnel establishment: IPsec protocol

•FRF.17 tunnel establishment: Frame Relay Privacy Protocol

•SSHv2 for remote access to the router

•Network configuration: Configure networking capabilities

•Enable Ports: Apply a security policy to a port

•File System: Access file system

•Authenticated Show status: Provide status to an authenticated operator

•Access Control: Provide access control for all operators

Unauthenticated Services:

•Unauthenticated Show status: provide the status of the cryptographic module – the status

is shown using the LEDs on the front panel.

•Power-up Self-tests: execute the suite of self-tests required by FIPS 140-2 during power-

up not requiring operator intervention.

•Monitor: Perform various hardware support services

Table des matières

Autres manuels Motorola Routeur réseau

Motorola

Motorola Netopia 4686-XL Manuel utilisateur

Motorola

Motorola 49901 - Vanguard 340 Router Manuel utilisateur

Motorola

Motorola 2247 Manuel utilisateur

Motorola

Motorola Netopia 7000 Manuel utilisateur

Motorola

Motorola EX-3524 Manuel utilisateur

Motorola

Motorola PTP 300 Series Manuel utilisateur

Motorola

Motorola HMDC5025 Manuel utilisateur

Motorola

Motorola WE800G - Wireless EN Bridge Mode d'emploi

Motorola

Motorola 2108-N9 Manuel utilisateur

Motorola

Motorola PTP 300 Series Guide de référence rapide

Motorola

Motorola MD1600 Manuel utilisateur

Motorola

Motorola Wireless Broadband Platform Manuel utilisateur

Motorola

Motorola MG7315 Manuel utilisateur

Motorola

Motorola 110502USM001 - Vanguard 60 Router Manuel utilisateur

Motorola

Motorola MC92603 Manuel utilisateur

Motorola

Motorola SURFboard SBG941 Series Manuel utilisateur

Motorola

Motorola PTP 300 Series Manuel utilisateur

Motorola

Motorola HOTZONE DUO 1.0 Manuel utilisateur

Motorola

Motorola WE800G - Wireless EN Bridge Manuel utilisateur

Motorola

Motorola PTP 600 Series Manuel utilisateur

Motorola

Motorola BR700 - EN Broadband Router Manuel utilisateur

Motorola

Motorola BSR 2000 Manuel utilisateur

Motorola

Motorola 7640-47 Manuel

Motorola

Motorola PTP 300Series Guide de référence rapide

Manuels Routeur réseau populaires d'autres marques

Allnet

Allnet ALL0333AU Manuel utilisateur

HomeSeer

HomeSeer HT-SEL Manuel utilisateur

Sercomm

Sercomm Genesis OC3505D Manuel utilisateur

Billion

Billion BIPAC 5102 Series Manuel utilisateur

TP-Link

TP-Link TD-8817 Manuel utilisateur

Digi

Digi IX14 Manuel utilisateur

Cisco

Cisco NCS 540 Manuel

XAVi

XAVi X8821e Manuel utilisateur

BEC

BEC 6200WZL Manuel utilisateur

MikroTik

MikroTik hAP ac3 Series Manuel utilisateur

Korenix

Korenix JetNet 5428G Series Manuel utilisateur

NETGEAR

NETGEAR FS526T - Switch Manuel utilisateur

Korenix

Korenix JetNet 5710G Series Manuel utilisateur

Automated Logic

Automated Logic ZN551 Manuel du propriétaire

Cisco

Cisco ASR 1000 Series Manuel de l'opérateur

EnGenius

EnGenius ESR-9710 Manuel utilisateur

Cisco

Cisco 805 Series Instructions d'utilisation et de sécurité

LevelOne

LevelOne FBR-1416 Manuel utilisateur