Home >Documents >MQ EAL4 ST - · PDF fileMQSC Message Queue Script Commands ... WebSphere MQ EAL4 Security...

MQ EAL4 ST - · PDF fileMQSC Message Queue Script Commands ... WebSphere MQ EAL4 Security...

Date post:21-Jul-2018
Category:
View:219 times
Download:0 times
Share this document with a friend
Transcript:
  • WebSphere MQ

    EAL4 Security Target

    Common Criteria Testing Laboratory 7125 Columbia Gateway Drive, Suite 300 Columbia, MD 21046

    Date: 25 July 2006 Issue: 1.0 Reference: LFF/MQ/EAL4/ST/28

    Copyright IBM 2006

  • WebSphere MQ EAL4 Security Target Issue: 1.0

    This Page Intentionally Left Blank.

    Copyright IBM 2006 Page ii

  • WebSphere MQ EAL4 Security Target Issue: 1.0

    Table of Contents

    GLOSSARY AND TERMINOLOGY............................................................................................................... IV

    1 INTRODUCTION........................................................................................................................................ 1 1.1 OVERVIEW ............................................................................................................................................. 1 1.2 DESCRIPTION.......................................................................................................................................... 2

    1.2.1 WMQ Server...................................................................................................................................... 3 1.2.2 WMQ Clients..................................................................................................................................... 3

    1.2.2.1 WMQ C Client ........................................................................................................................................ 4 1.2.2.2 WMQ JMS and Base Java Clients............................................................................................................ 4

    1.2.3 Message Queue Interface (MQI)....................................................................................................... 4 1.3 CC CONFORMANCE ................................................................................................................................ 5 1.4 STRENGTH OF FUNCTIONS ...................................................................................................................... 5 1.5 REFERENCES .......................................................................................................................................... 5 1.6 STRUCTURE ............................................................................................................................................ 5

    2 TOE DESCRIPTION................................................................................................................................... 6 2.1 QUEUE MANAGER .................................................................................................................................. 8

    2.1.1 Object Authority Manager (OAM) .................................................................................................... 9 2.1.2 QM Kernel......................................................................................................................................... 9 2.1.3 Application Interface (AI) ................................................................................................................. 9 2.1.4 Data Abstraction and Persistence (DAP).......................................................................................... 9

    2.2 COMMAND LINE INTERFACE................................................................................................................... 9 2.3 COMMON SERVICES.............................................................................................................................. 10 2.4 MESSAGE CHANNEL AGENT (MCA) .................................................................................................... 10 2.5 TOE ENVIRONMENT............................................................................................................................. 10

    3 TOE SECURITY ENVIRONMENT ........................................................................................................ 12 3.1 INTRODUCTION..................................................................................................................................... 12 3.2 THREATS .............................................................................................................................................. 12

    3.2.1 Threats countered by the TOE ........................................................................................................ 12 3.2.2 Threats countered by the TOE Environment ................................................................................... 12

    3.3 ORGANISATIONAL SECURITY POLICIES (OSPS).................................................................................... 12 3.4 ASSUMPTIONS ...................................................................................................................................... 13

    3.4.1 Physical aspects .............................................................................................................................. 13 3.4.2 Personnel Aspects ........................................................................................................................... 13

    4 SECURITY OBJECTIVES....................................................................................................................... 14 4.1 SECURITY OBJECTIVES FOR THE TOE .................................................................................................. 14 4.2 SECURITY OBJECTIVES FOR THE TOE ENVIRONMENT.......................................................................... 14

    5 SECURITY REQUIREMENTS................................................................................................................ 16 5.1 TOE SECURITY FUNCTIONAL REQUIREMENTS ..................................................................................... 16

    5.1.1 Security Audit (FAU)....................................................................................................................... 17 5.1.2 Cryptography (FCS)........................................................................................................................ 17 5.1.3 Access Control (FDP) ..................................................................................................................... 19 5.1.4 Security Management (FMT) .......................................................................................................... 20 5.1.5 Protection of the TSF (FPT)............................................................................................................ 21

    5.2 STRENGTH OF FUNCTION (SOF) .......................................................................................................... 21 5.3 TOE SECURITY ASSURANCE REQUIREMENTS ...................................................................................... 21 5.4 SECURITY REQUIREMENTS FOR THE IT ENVIRONMENT ........................................................................ 21

    5.4.1 Security Audit (FAU)....................................................................................................................... 22

    Copyright IBM 2006 Page ii

  • WebSphere MQ EAL4 Security Target Issue: 1.0

    5.4.2 Identification and Authentication (FIA) .......................................................................................... 22 5.4.3 Security Management (FMT) .......................................................................................................... 22 5.4.4 Protection of the TSF (FPT)............................................................................................................ 22

    6 TOE SUMMARY SPECIFICATION....................................................................................................... 23 6.1 IT SECURITY FUNCTIONS (SF).............................................................................................................. 23

    6.1.1 Access Control ................................................................................................................................ 23 6.1.2 Audit ................................................................................................................................................ 23 6.1.3 TOE Protection ............................................................................................................................... 24

    6.2 ASSURANCE MEASURES ....................................................................................................................... 24 7 RATIONALE.............................................................................................................................................. 27

    7.1 CORRELATION OF THREATS, POLICIES, ASSUMPTIONS AND OBJECTIVES ............................................. 27 7.2 SECURITY OBJECTIVES RATIONALE ..................................................................................................... 28

    7.2.1 Threats ............................................................................................................................................ 28 7.2.2 Security Policy ................................................................................................................................ 29 7.2.3 Assumptions .................................................................................................................................... 30

    7.3 SECURITY REQUIREMENTS RATIONALE................................................................................................ 31 7.3.1 Security Functional Requirements Rationale.................................................................................. 31 7.3.2 Security Environment Requirements Rationale........................................

Click here to load reader

Reader Image
Embed Size (px)
Recommended