Xerox WorkCentre 5632/5638/5645/5655 - Common Criteria

Xerox WorkCentre 5632/5638/5645/5655/5665/5675/5687
Multifunction Systems Security Target
6.1.3. Authentication (TSF_ AUT)
FIA_UAU.2, FIA_UAU.7, FIA_UID.2, FIA_AFL.1 (AUT 1), FIA_AFL.1 (AUT 2),
FIA_AFL.1 (AUT 3), FMT_SMR.1
The system administrator must authenticate by entering a password prior to being
granted access to the system administration functions (see 6.1.9). While the system
administrator is typing the password , the TOE obscures 7 each character entered to
hide the value entered. Identification of the system administrator at the Local User
Interface is explicit -- the administrator will identify themselves by entering the username
“admin” in the authentication window. Identification of the system administrator at the
Web user Interface is explicit -- the administrator will identify themselves by entering the
username “admin” in the authentication dialog window.
The authentication process will be delayed at the Local User Interface, for 3 minutes if 3
wrong passwords were entered in succession. If a wrong password is entered at the
web interface, the TOE will give an error message that has to acknowledge before
another attempt to complete the authentication process can be made.
There are no more roles than “System Administrator” which can authenticate.
The Web user interface can be configured such that authentication of the system
administrator is based upon individual credentials. If configured for local authentication
the system requires the system administrator to enter a username and password. The
system will authenticate the user against an internal database. Alternatively the system
may be configured such that authentication is performed remotely by the network’s
domain controller. In this case, the SA must enter a valid fully-qualified username and
password. In both cases, privileged user status is granted based upon successful
authentication.
6.1.4. Network Identification (TSF_NET_ID)
FIA_AFL.1 (AUT 3), FIA_UAU.2, FIA_UID.2, FIA_UAU.7
The TOE can prevent unauthorized use of the installed network options (network
scanning, scan-to-email, and LanFax); the network options available are determined
(selectable) by the system administrator. To access a network service, the user is
required to provide a user name and password which is then validated by the
designated authentication server (a trusted remote IT entity). The user is not required to
login to the network; the account is authenticated by the server as a valid user. The
remote authentication services supported by the TOE are: CAC two-factor local
authentication, LDAP v4, Kerberos v5 (Solaris), Kerberos v5 (Windows 2000/2003),
NDS (Novell 4.x, 5.x), and SMB (Windows NT.4x/2000/2003). The cryptography used
by remote authentication services has been scoped out of the evaluation.
7 The LUI obscures input with the asterisk character. The specific character used to obscure input at the WebUI is browser dependent
72
Copyright 2009 Xerox Corporation, All rights reserved