Avaya G250-BRI Скачать руководство пользователя | Manualshive

Страница: 17 / 23

background image

Avaya G250 and G250-BRI Branch Office Media Gateways w/FIPS Non-Proprietary Security Policy
Version 1.2 Wednesday, 14 December, 2005

© 2005 Avaya Inc.

May be reproduced only in its original entirety [without revision]. Page 17 of 23

CID 106595

Key

Description/Usage

Radius Secret

Used for hashing password with MD5. One secret common to both
primary and Secondary Radius server.

OSPF Secret

Used for authentication OSPF messages with the Peer OSPF routers.
Secret exchanged hashed using MD5. One secret defined per peer
router identity.

PPPoE CHAP/PAP Secret

Used for authentication to PPPoE server.

SNMPv3 user authentication password

SNMPv3 operator MD5 authentication password used for
authenticating the User and Read-Only User roles.

Fixed Serial Number secret

The TDES key used for the serial number exchange protocol.

Ephemeral Serial Number secret

The TDES key used for the serial number exchange protocol.

X9.31 PRNG State

Internal state for X9.31 PRNG

Table 8 – CSPs and private keys

The following are the public keys contained in the module:

Key

Description/Usage

IKE Ephemeral DH Phase
–1 public keys

Generated for VPN IKE Phase 1 key establishment.

IKE Ephemeral DH Phase
–2 public keys

Generated for VPN IKE Phase 2 PFS key renewal.

Image download
certificate (Avaya root CA
RSA public key)

Used for authentication of software download. The Avaya Root certificate is hard-
code in Gateway image and used directely for authentication of the chain of trust of
the Avaya Signing Authority that is downloaded together with the software.

License download public
key

Used for authentication of license file validity. The license signing authority public
key is hard-code in Gateway image and used directely for authentication of the
digital signature embedded in the license file.

Table 9 – Public keys

5.4.

Definition of CSPs Modes of Access

Table 10

below defines the relationship between access to CSPs and the services. The modes of

access shown in the table include:

•

Read: the data item is read from memory.

•

Write: the data item is written into memory.

•

Zeroize: the data item is actively overwritten.

«
...
15
16
17
18
19
...
»

Содержание G250-BRI

Страница 1: ...eproduced only in its original entirety without revision Page 1 of 23 CID 108398 Avaya G250 and G250 BRI Branch Office Media Gateways w FIPS Non Proprietary Security Policy Avaya Inc Revision Date 14 December 2005 Version 1 2 ...

Страница 2: ... 6 3 PORTS AND INTERFACES 8 3 1 G250 PORTS AND INTERFACES 8 3 2 G250 BRI PORTS AND INTERFACES 10 4 IDENTIFICATION AND AUTHENTICATION POLICY 11 4 1 ASSUMPTION OF ROLES 11 4 2 STRENGTHS OF AUTHENTICATION MECHANISMS 12 5 ACCESS CONTROL POLICY 13 5 1 SERVICES 13 5 2 ROLES AND SERVICES 15 5 3 DEFINITION OF CRITICAL SECURITY PARAMETERS CSPS 16 5 4 DEFINITION OF CSPS MODES OF ACCESS 17 6 OPERATIONAL ENVI...

Страница 3: ...be administered from a central location The G250 and G250 BRI share common hardware and firmware compatibility other than that G250 BRI contains additional ISDN B circuitry with 2 ISDN BRI trunks plus 1 Analog trunk versus 4 Analog trunks in G250 The rules in this policy generally apply to all the above devices Exceptions are explicitly rendered by device name otherwise general cryptographic modul...

Страница 4: ...module cryptographic boundary includes all of the components within the physical enclosure of the chassis without any expansion modules plugged in The figure below Figure 2 illustrates G250 BRI cryptographic module Figure 2 G250 BRI Cryptographic module 1 Security Level The module cryptographic module meets the overall requirements applicable to Level 1 security of FIPS 140 2 Security Requirements...

Страница 5: ...umber exchange c AES CBC 128 192 256 bit for IPSec and IKE encryption d SHA 1 for hashing download image digest license file digest e HMAC SHA 1 for message authentication codes for IKE and IPSEC f DES CBC for encryption of IPSec and IKE only supported for communication with legacy systems transitional phase only valid until May 19 2007 g Diffie Hellman key agreement protocol groups 2 5 14 used to...

Страница 6: ... d Avaya Media Encryption AEA for encryption decryption e SSH v2 use of MD5 DH group 786 2048 non compliant TDES non compliant DES in non FIPS mode only commercially available key establishment protocol f HMAC SHA 1 used in non compliant manner in SNMPv3 in non FIPS mode only 2 3 Entering FIPS Mode To enter FIPS mode the Crypto Officer must follow the procedure outlined in the Table 2 below Step D...

Страница 7: ...need to be removed New secret need to be assigned to Radius and PPPoE 21 Activate enhanced security mode 22 Define an Access Control list that block packets with IP destination address of any of the module interfaces for the following protocols TELNET FTP TFTP SNMP Activate the ACL on the inbound direction of all clear text interfaces 23 Configure packet forwarding static routes dynamic routes lea...

Страница 8: ...igure 3 G250 faceplate The G250 cryptographic module provides the physical ports and logical interfaces defined in Table 3 below Interface Qty Logical interface definition Comments 1 ETH LAN POE 8 Data input data output status output control input power outout Supports local area network connectivity 2 ETH WAN 1 Data input data output status output control input Supports wide area network connecti...

Страница 9: ...e administration 7 USB 1 Control inputs Status output Power output Supports cryptographic module administration for modem dial in connection Disabled in FIPS Approved mode 8 Media Module Connectors 2 Data input data output status output control input Provide the ability to communicate using Serial TDM Data Ethernet PCI CPU Device Bus facilitates Power 9 AC Power Input 1 Power Input Provides power ...

Страница 10: ...a input data output status output control input Supports wide area network connectivity 3 CCA 1 Power output Contact Closure Adjunct Powers two contact closure relays 4 Analog Line 2 Analog Phones Line1 Line2 Data input output power output Line 2 ceases to be a data input output from the module and is directly connected to Analog Trunk providing a power interface when an emergency state occurs a P...

Страница 11: ...Control Input Resets the device 13 ASB Button 1 Control Input When pressed with the reset button cause the device to boot from an alternate firmware image bank 14 System LEDs 4 Status Output Indicates Power Modem connection through Console interface CPU activity and Alarm state 15 LEDs on ETH WAN 2 Status Output Link state and activity indication on the associated data interface 16 LEDs on ETH LAN...

Страница 12: ...D5 hash of the packet and the secret An entity authenticates to the module for the purpose of permitting denying access to services PPPoE client Role based operator authentication Chap Pap Secrets Simple password authentication is used for PAP based authentication Gateway use MD5 function to hash the challenge and the secret value in the response message to PPPoE Server An entity that facilitates ...

Страница 13: ...to power cycle via a remote command Read all status indications obtain all statuses securely via IPSEC console port and LEDs on the front panel of a Gateway This service also reports about the status of the bypass capability Bypass status is reported by CLI commands show ip active lists crypto show ip crypto list show crypto ipsec transform set available from the console and remote telnet Read sub...

Страница 14: ...n over an Ethernet link Radius authentication authenticate communication between the module and a primary or secondary Radius server Unauthenticated Services Show status provide the status of the cryptographic module the status is shown using the LEDs on the front panel Constantly lit CPU led indicates normal operation Flashing CPU led indicates operation in error state Self tests execute the suit...

Страница 15: ... Radius Client IKE Peer OSPF Router peer PPPoE client Serial Number Peer Enable FIPS mode X Firmware Update X CSPs Management X X User Management X Module configuration X X Reset X X Read all status indications X Read subset of status indications X X X Module configuration backup X X Module configuration Restore X Zeroization X IKE negotiation X X X X IPSec traffic processing X X X X Serial Number...

Страница 16: ...DH exchange Generated for VPN IKE Phase 1 key establishment IKE Session Phase 1 Secret SKEYID_d Phase 1 key used to derive keying material for IPSec Sas IKE Session Phase 1 HMAC Key SKEYID_a Key used for integrity and authentication of the ISAKMP SA IKE Session Phase 1 Encrypted Key SKEYID_e Shared key used for extraction of encryption keys protecting the ISAKMP SA IKE Session Phase 1 TDES key Key...

Страница 17: ...9 31 PRNG Table 8 CSPs and private keys The following are the public keys contained in the module Key Description Usage IKE Ephemeral DH Phase 1 public keys Generated for VPN IKE Phase 1 key establishment IKE Ephemeral DH Phase 2 public keys Generated for VPN IKE Phase 2 PFS key renewal Image download certificate Avaya root CA RSA public key Used for authentication of software download The Avaya R...

Страница 18: ...tions OSPF routing PPPoE Service Radius Authentication Serial Number Exchange PRNG keys RWZ ZW Z R IKE Pre shared Keys RWZ W Z Z R Pre shared Session Key SKEYID Z Z RW Ephemeral DH private key Z Z RW Ephemeral DH shared secret Z Z RW HASH_I HASH_R Z Z RW IKE session Phase 1 Secret SKEYID_d Z Z RW IKE Phase 1 HMAC Key SKEYID_a Z Z RW IKE Session Phase 1 SKEYID_e Z Z RW IKE Session Phase 1 TDES Z Z ...

Страница 19: ...oot password RW RW R W R R R R R W R OSPF Secret WZ WZ Z Z R Radius Secret WZ WZ Z R PPPoE Chap PAP Secret WZ W Z Z R SNMPv3 authentication password WZ R R WZ R R R R R Z Fixed Serial Number secret W Z R Ephemeral Serial Number secret Z Z RW IKE Ephemeral DH public keys Z Z RW IKE Ephemeral DH Phase 2 public keys Z Z RW Avaya root CA RSA public key RW License RSA public key R RW Table 10 CSP Acces...

Страница 20: ... Software Integrity Test 32 bit CRC verification and Booter Integrity Test 32 bit CRC verification Critical Functions Tests Non Volatile Random Memory NVRAM Integrity test EEPROM Integrity Test 3 The cryptographic module shall perform the Conditional Self Tests Continuous Random Number Generator RNG test performed on all RNGs supporting crypto activities in FIPS Approved mode Done for PRNG x9 31 a...

Страница 21: ...Details Production grade components and production grade enclosure N A N A Table 8 Inspection Testing of Physical Security Mechanisms 9 Mitigation of Other Attacks Policy The FIPS 140 2 Area 11 requirements are not applicable because the cryptographic module has not been designed to mitigate specific attacks outside of the scope of FIPS 140 2 Other Attacks Mitigation Mechanism Specific Limitations...

Страница 22: ...e Adjunct CLI Command Line Interface CNA Converged Network Analyzer DES Data Encryption Standard DH Diffie Hellman DSS Digital Signature Standard FTP File Transfer Protocol HMAC Hash Message Authentication Code IKE Internet Key Exchange IP Internet Protocol ISDN Integrated Services Digital Network LAN Local Area Network KAT Known Answer Test OSPF Open Shortest Path First PFS Perfect Forward Secrec...

Страница 23: ...S Non Proprietary Security Policy Version 1 2 Wednesday 14 December 2005 2005 Avaya Inc May be reproduced only in its original entirety without revision Page 23 of 23 CID 106595 TFTP Trivial File Transfer Protocol USB Universal Serial Bus WAN Wide Area Network ...

Отзывы:

Нет отзывов

Похожие инструкции для G250-BRI

Бренд: Safeline Страницы: 76

Бренд: TANDBERG Страницы: 58

Бренд: Anybus Страницы: 2

Бренд: ZyXEL Communications Страницы: 323

Бренд: MikroTik Страницы: 22

Бренд: Siemens Страницы: 2

Бренд: Siemens Страницы: 8

VersiComm VC1COMMA

Бренд: Siemens Страницы: 22

SIRIUS 3RK3141 Series

Бренд: Siemens Страницы: 19

SIMATIC RTLS4330G

Бренд: Siemens Страницы: 28

Бренд: Siemens Страницы: 48

Sinamics Connect Series

Бренд: Siemens Страницы: 101

Бренд: Siemens Страницы: 124

Бренд: Siemens Страницы: 866

Бренд: Luminext Страницы: 8

Бренд: Promise Technology Страницы: 58

Бренд: Inovonics Страницы: 3

Бренд: Ness Страницы: 7

Бренды по названию

0 1 2 3 4 5 6 7 8 9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Популярные бренды

Загрузить еще бренды