Motorola S2500 Скачать руководство пользователя

Страница: 11 / 18

MNR S2500 Security Policy

Version 1.3, Revision Date: 1/13/2009

Page

Roles and Services

Service

Crypto Officer

(SuperUser)

Network Manager

User

Admin

Maintenance

Firmware Update

Key Entry

User Management

IKE

IPsec Tunnel Establishment

FRF.17 Tunnel Establishment

SSHv2 X

Reboot X

Zeroization X

Crypto Configuration

Network Configuration

Enable Ports

File System

Authenticated Show Status

Unauthenticated Show Status

Power-up Self-Tests

Monitor X

Access Control

Table 7 – Services to Roles mapping

Содержание S2500

Страница 1: ...Copyright Motorola Inc 2009 May be reproduced only in its original entirety without revision Motorola Network Router MNR S2500 Security Policy Document Version 1 3 Revision Date 1 13 2009 ...

Страница 2: ...OLICY 8 6 ACCESS CONTROL POLICY 10 AUTHENTICATED SERVICES 10 UNAUTHENTICATED SERVICES 10 ROLES AND SERVICES 11 DEFINITION OF CRITICAL SECURITY PARAMETERS CSPS 12 DEFINITION OF CSPS MODES OF ACCESS 13 7 OPERATIONAL ENVIRONMENT 15 8 SECURITY RULES 15 9 CRYPTO OFFICER GUIDANCE 16 10 PHYSICAL SECURITY POLICY 17 PHYSICAL SECURITY MECHANISMS 17 11 MITIGATION OF OTHER ATTACKS POLICY 17 12 DEFINITIONS AND...

Страница 3: ...he photo blank plates cover slots that can hold optional network interface cards The FIPS validated firmware versions are XS 15 1 0 75 XS 15 1 0 76 XS 15 2 0 20 and XS 15 4 0 60 S2500 Base Unit S2500 Encryption Module Configurations P N Tanapa Number Revision P N Tanapa Number Revision FW Version 1 ST2500B CLN1713E B ST2516A CLN8262C C XS 15 1 0 75 2 ST2500B CLN1713E B ST2516A CLN8262C C XS 15 1 0...

Страница 4: ...l Environment N A Cryptographic Key Management 1 EMI EMC 3 Self Tests 1 Design Assurance 1 Mitigation of Other Attacks N A Table 2 Module Security Level Specification 3 Modes of Operation Approved mode of operation In FIPS mode the cryptographic module supports the following FIPS Approved algorithms as follows Hardware Implementations a Triple DES CBC mode 112 or 168 bit for IPsec and FRF 17 encry...

Страница 5: ...349 The MNR S2500 router supports the commercially available IKE and Diffie Hellman protocols for key establishment IPsec ESP and FRF 17 protocols to provide data confidentiality using FIPS approved encryption and authentication algorithms and SSHv2 for secure remote access Allowed Algorithms Diffie Hellman allowed for key agreement per Annex D key agreement methodology provides 80 to 112 bits of ...

Страница 6: ...For FIPS mode the selector list must be configured to encrypt all packets on an encrypted port e g ADD CRYPTO SelectorLIst s1 1 Include ANY 0 0 0 0 0 0 0 0 0 0 4 If Ipsec is used configure Ipsec transform lists using the ADD CRYPTO TransformLIst command For FIPS mode only the following values are allowed Encryption Transform ESP 3DES or ESP AES and Authentication Transform ESP SHA 5 If FRF 17 is u...

Страница 7: ...ge 7 SHOW CRYPTO CONFiguration This command shows a detailed summary of the cryptographic configuration and allows a user to verify that encryption is enabled on user determined ports and that only FIPS Approved algorithms are used for encryption and authentication ...

Страница 8: ... input data output status output control input power output Optional conventional to IP E M Power Plug 1 Power input N A External Power input port LEDs 7 Status Output N A Provides LED status output Table 4 S2500 physical ports and logical interfaces 5 Identification and Authentication Policy Assumption of roles The MNR S2500 router supports five distinct operator roles Crypto Officer SuperUser Ad...

Страница 9: ...module with full access to services of the module Network Manager Role based operator authentication Username and Password The module stores user identity information internally A user of the cryptographic module with almost full access to services of the module Admin Role based operator authentication Username and Password The module stores user identity information internally An assistant to the...

Страница 10: ...nel establishment IPsec protocol FRF 17 tunnel establishment Frame Relay Privacy Protocol SSHv2 for remote access to the router Network configuration Configure networking capabilities Enable Ports Apply a security policy to a port File System Access file system Authenticated Show status Provide status to an authenticated operator Access Control Provide access control for all operators Unauthentica...

Страница 11: ...Entry X X User Management X X IKE X X IPsec Tunnel Establishment X X FRF 17 Tunnel Establishment X X SSHv2 X X Reboot X X Zeroization X X Crypto Configuration X X Network Configuration X X Enable Ports X X File System X X Authenticated Show Status X X X X Unauthenticated Show Status X X X X X Power up Self Tests X X X X Monitor X X Access Control X X Table 7 Services to Roles mapping ...

Страница 12: ...emeral DH Phase 2 private key a Phase 2 Diffie Hellman private keys used in PFS for key renewal IPSEC Session keys 128 192 256 bit AES CBC and 168 bit TDES keys are used to encrypt and authenticate IPSEC ESP packets FRF 17 Session Keys 168 bit TDES CBC and 128 192 256 bit AES CBC keys are used to encrypt and authenticate FRF 17 Mode 2 SSH RSA Private Key Key used to authenticate oneself to peer SS...

Страница 13: ...uted to module used to authenticate peer IKE DH public key g a Generated for IKE Phase 1 key establishment IKE DH phase 2 public g a key Phase 2 Diffie Hellman public keys used in PFS for key renewal if configured SSH DH Key Generated for SSH key establishment Table 9 Public Keys Definition of CSPs Modes of Access Table 10 defines the relationship between access to CSPs and the different module se...

Страница 14: ...ticated Show Status Access Control KEK R R Z R IKE Pre shared Key W R Z W RW R SKEYID RW Z Z SKEYID_d RW Z SKEYID_a RW Z SKEYID_e RW Z Ephemeral DH Phase 1 private key RW Z Ephemeral Phase 2 DH private key RW Z IPSEC Session Keys RW R Z FRF 17 Session Keys RW R Z SSH RSA Private Key RW Z RW SSH DSA Private Key RW Z RW SSH Session Keys RW Z SSH DH Private Key RW Z Root Password RW Z User Admin RW Z...

Страница 15: ...e MNR S2500 router provides five distinct operator roles Crypto Officer SuperUser Admin Network Manager User and Maintenance The Crypto Officer role uses the root account 2 The MNR S2500 router encrypts message traffic using the AES or TDES algorithm 3 The MNR S2500 router performs the following tests A Power up Self Tests 1 Cryptographic algorithm tests Hardware Implementation a AES CBC Known Ans...

Страница 16: ...r on the module and verify successful completion of power up self tests from console port or inspection of log file 2 Authenticate to the module using the default user acting as the Crypto Officer with the default password and username 3 Verify that the Hardware and Firmware P Ns and version numbers of the module are the FIPS approved versions 4 Change the Network Manager Crypto Officer and User p...

Страница 17: ...itions and Acronyms AES Advanced Encryption Standard CBC Cipher Block Chaining CLI Command Line Interface CSP Critical Security Parameter DH Diffie Hellman DRNG Deterministic Random Number Generator FRF Frame Relay Forum FRF 17 Frame Relay Privacy Implementation Agreement FRPP Frame Relay Privacy Protocol HMAC Hash Message Authentication Code IKE Internet Key Exchange IP Internet Protocol IPsec In...

Страница 18: ...Revision Date 1 13 2009 Page 18 PFS Perfect Forward Secrecy RNG Random Number Generator SHA Secure Hash Algorithm SSH Secure Shell SNMP Simple Network Management Protocol Tanapa The part number that is built and stocked for customer orders ...

Результаты поиска

Содержание S2500

Отзывы:

Похожие инструкции для S2500

Бренды по названию

Популярные бренды

Motorola S2500, Руководство по безопасности

Результаты поиска

Содержание S2500

Отзывы:

Похожие инструкции для S2500

Бренды по названию

Популярные бренды