 ICACT20230161 Slide.01
[Big Slide]
[YouTube] |
Chrome  Click!! |
 |
Hello everyone. We will be grateful for this opportunity to share our research on information security in ICACT 2023 25th International Conference on Advanced Communications Technology. And let me introduce myself. I’m Chia-Chi Lin from National Taiwan University of Science and Technology. The topic of this paper is “Development of Security Target for Router Based on ENISA Common Criteria Framework”. Mainly according to the Common Criteria framework the article lists the security target document of router products. |
| ICACT20230161 Slide.02
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
This is today's outline. In this presentation, divided into Introduction, Methods, Evaluation and Conclusion. |
| ICACT20230161 Slide.03
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
First, in Introduction. |
| ICACT20230161 Slide.04
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
The ENISA has published the EUCC scheme, abbreviated as CC, an international framework agreement based on the ISO/IEC 15408 Common Criteria for Information Technology Security Evaluation. It provides a basis for producing products for the information and communication technology (ICT) industry and increases network equipment security.
This research takes a network device router as an example to develop a security standard document related to the router according to the CC framework. It proposes a functional list that conforms to the CC framework.
|
| ICACT20230161 Slide.05
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Next, in Method. |
| ICACT20230161 Slide.06
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
The Common Criteria provides a framework for information security, with three main sections introducing the CC Framework, Part1 is Introduction and General Model, Part2 is Security Functional Requirements, and Part3 is Security Assurance Requirements. |
| ICACT20230161 Slide.07
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Protection Profile, abbreviated as PP, is a profile of the security requirements of a particular type of information and communication product, basically related to the user's specific use. And PPs are primarily produced for users or groups of users, such as government agencies. |
| ICACT20230161 Slide.08
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
The Security Target document is mainly for evaluating specific information technology products. The Common Criteria and Protection Profile are used as references to develop security targets related to information technology products.
For developers who create security products, it is almost necessary to make security products pass some recognized security certifications. Usually, developers who create a security product need to write an ST document as a security reference. When the developer explains the security product, when there are any security functions, they must be described in the ST file.
This ST document is mainly for evaluators to evaluate whether the product’s security functions are reliable. The product security functions described by the developer must be in line with the requirements of these security functions.
|
| ICACT20230161 Slide.09
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
The process of developing a ST document is divided into three parts. Take routers as an example of our information technology products. First, we need to define the security problem that the router encounters and the security objectives that this product needs to achieve. Finally, we need to achieve the required security objectives based on the security requirements in CC and PP as references. The flow chart of the Security Target document is shown in the Figure. |
| ICACT20230161 Slide.10
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
In the ST document, the security problem of TOE should be defined first. The security problem that TOE probably will face is listed in the document, which is usually divided into three categories: Threats、Assumptions and Organizational Security Policies. The threats for the Network Devices are grouped according to the functional areas of the device. Assumptions are made in identifying the threats and security requirements for Network Devices. Organizational security policies are rules, practices, and procedures imposed by an organization to address its security needs. |
| ICACT20230161 Slide.11
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Security objectives require reference to PP to list the threats that may occur on the router. In this research, the collaborative Protection Profile for Network Devices is used as the base PP reference. |
| ICACT20230161 Slide.12
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Then the next step is the security requirements, which are mainly divided into security functional requirements and security assurance requirements. |
| ICACT20230161 Slide.13
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
First, explain the security functional requirements, abbreviated as SFR. |
| ICACT20230161 Slide.14
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
A list of SFRs based on the security objectives of the threat selection. And the required SFR can be found in CC Part 2. There are eleven types, as shown in the table. |
| ICACT20230161 Slide.15
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
The developer can find the functional class first, and then find the functional family, and the functional component. Then the component has the functional elements. The component is the SFR. |
| ICACT20230161 Slide.16
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Then introduce the security assurance requirements, abbreviated as SAR. |
| ICACT20230161 Slide.17
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Determining the SAR starts with selecting the evaluation assurance level, abbreviated as EAL to be achieved. The required EAL table can be found in CC Part 3. |
| ICACT20230161 Slide.18
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Evaluation |
| ICACT20230161 Slide.19
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
The ST document defines the list of requirements the device must meet. And we compare regulated ST documentation with unregulated routers. Regulated ST is as baseline. This research selects an unregulated ST file for evaluation and testing. |
| ICACT20230161 Slide.20
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
This research takes routers as an example. Find the ones related to the router in the security function as the baseline ST document. Take Security Audit Class as an example, and then divide it into three items: FAU_GEN.1 Audit data generation, FAU_GEN.2 User Identity Association, and FAU_STG_EXT.1 Protected Audit Event Storage. In line with the category of routers, these same categories can be expanded into more detailed security function components, that is, SFR, as baseline components. |
| ICACT20230161 Slide.21
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
The evaluation method is to list all the security components of the router as the baseline ST document and the security components of the unregulated ST document, as shown in the figure. The FAU comparison in the above figure is an example, as shown in the red line. A total of 1 Item matches 1, so it is marked as 1/1; a total of 2 items denoted by the green line match 0, so it is marked as 0/2; a total of 3 items denoted by the blue line match 2, so it is marked as 2/3. The figure below is the same method. |
| ICACT20230161 Slide.22
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
In the conclusion. |
| ICACT20230161 Slide.23
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Finally, analyzing the gap between regulated and unregulated routers, we found that the match rate of unregulated routers was 53.1%. This means that the security features of unregulated routers are nearly half of what was initially envisioned for the baseline. Developers can add and consider many security requirements to make routers more secure.
There will be many security threats and new security regulations in the future. Developers should update the ST document to address future security issues, which is how future security products can be updated. |
| ICACT20230161 Slide.24
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
|
| ICACT20230161 Slide.25
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Well, this is the end of my presentation. If you have any questions, please feel free to tell me or send me an e-mail. Thank you for listening. |
