Security Target
Version 1.1
2022-03-08
38
The D Models satisfy the following SFRs:
•
FDP_PDC_EXT.3/VI(D)- Authorized Connection Protocols (Video Output) (D Models)
•
FDP_SPR_EXT.1/DVI-I(D)
–
Sub-Protocol Rules (DVI-I Protocol) (D Models)
6.3
Identification and Authentication (FIA_UAU.2/
FIA_UID.2)
Authentication is required to perform administrator functions such as configuring the keyboard/mouse
device filtering (i.e. CDF) blacklist. The authorized administrator is identified and authenticated through
the logon function. The authorized administrator logs on by entering the Administrator Logon mode as
described in the administrator guide and providing a valid password. The administrator guide states that
the administrator must change the password after the first successful logon.
6.4
Security Management
The TOE provides management functions to configure the keyboard/ mouse filtering (i.e. CDF), to return
the device to factory setting, to view audit logs and to change the administrator password; and restricts
access to these management functions to the authorized administrator.
6.4.1
FMT_MOF.1
–
Management of Security Functions Behavior
The TOE restricts the management functions such as the ability to modify the HID device filtering blacklist
to the authorized administrator. The authorized administrator must successfully authenticate by
providing a valid password. There is no login name parameter for the login function. Customers are
provided with a default password. The administrator guide states that the administrator must change the
password after the first successful logon. The password is case sensitive and new passwords must contain
at least 1 lower case letter, at least 1 upper case letter, at least 1 numeric character, and at least 1 special
character. The supported special characters are: !"#$%&' ()*+,-./ :;<=>? @ [\]^_ ` {|}~ (including
“
space
”
).
Additionally, the password length must be at least 8 characters but no longer than 22 characters. With
three failed attempts to log in, the administrator logon mode will be terminated and locked for 15
minutes. With nine failed log in attempts, the Secure KVM Switch will become permanently inoperable.
There is no mechanism to restore a lost/forgotten password.
6.4.2
FMT_SMF.1
–
Specification of Management Functions
The TOE provides security management functions to configure the keyboard/mouse device filtering (i.e.
CDF), to return the device to factory setting, to view audit logs and to change the administrator password.
The TOE provides the authorized administrator with the ability to assign blacklist definitions for keyboard/
mouse devices. Once successfully authenticated, the Administrator can choose to add a device to the
keyboard/ mouse devices blacklist.
If a device is on the whitelist, the TOE considers the device as authorized. Otherwise, if the device is on
the blacklist or is not on any list it is considered unauthorized. If a device is on both blacklist and whitelist,
the USB device will be considered a blacklisted device.
