WebSphere MQ 7.1
EAL2
Security Target
IBM Hursley Park
Date:
Issue:
Reference:
February 19th, 2013
0.19
AA/190213/ST0.19
© Copyright IBM 2012, 2013
This Page Intentionally Left Blank.
© Copyright IBM 2012, 2013
Table of Contents
TABLE OF CONTENTS ..................................................................................................................................... II
GLOSSARY AND TERMINOLOGY ............................................................................................................... IV
1
INTRODUCTION ........................................................................................................................................ 1
1.1
OVERVIEW ............................................................................................................................................. 1
1.1.1 Platforms and Components ............................................................................................................... 1
1.1.2 Overview: Access Control ................................................................................................................. 4
1.1.3 Overview: Audit ................................................................................................................................ 4
1.1.4 Overview: Inter-system Communication ........................................................................................... 6
1.2
DESCRIPTION .......................................................................................................................................... 8
1.2.1 WMQ Server ...................................................................................................................................... 8
1.2.2 WMQ Clients ..................................................................................................................................... 9
1.2.3 Message Queue Interface (MQI) ..................................................................................................... 10
1.3
CC CONFORMANCE .............................................................................................................................. 10
1.4
REFERENCES ........................................................................................................................................ 10
1.5
STRUCTURE .......................................................................................................................................... 10
2
TOE DESCRIPTION ................................................................................................................................. 11
2.1
QUEUE MANAGER ................................................................................................................................ 13
2.1.1 Channel Authentication Records (CHLAUTH) ............................................................................... 13
2.1.2 Object Authority Manager (OAM) .................................................................................................. 14
2.1.3 QM Kernel ....................................................................................................................................... 15
2.1.4 Application Interface (AI) ............................................................................................................... 15
2.1.5 Data Abstraction and Persistence (DAP)........................................................................................ 15
2.1.6 Publish/Subscribe (P/S Engine) ...................................................................................................... 15
2.2
COMMAND LINE INTERFACE ................................................................................................................. 15
2.3
COMMON SERVICES.............................................................................................................................. 16
2.4
MESSAGE CHANNEL AGENT (MCA) .................................................................................................... 16
2.5
MQI CHANNEL ..................................................................................................................................... 16
2.6
TCP/IP LISTENER ................................................................................................................................. 17
2.7
TOE ENVIRONMENT............................................................................................................................. 17
3
SECURITY PROBLEM DEFINITION ................................................................................................... 20
3.1
INTRODUCTION ..................................................................................................................................... 20
3.2
THREATS .............................................................................................................................................. 20
3.2.1 Threats countered by the TOE......................................................................................................... 20
3.2.2 Threats countered by the TOE Environment ................................................................................... 20
3.3
ORGANISATIONAL SECURITY POLICIES (OSPS) .................................................................................... 20
3.4
ASSUMPTIONS ...................................................................................................................................... 20
3.4.1 Physical aspects .............................................................................................................................. 21
3.4.2 Personnel Aspects ........................................................................................................................... 21
4
SECURITY OBJECTIVES ....................................................................................................................... 22
4.1
4.2
5
SECURITY OBJECTIVES FOR THE TOE .................................................................................................. 22
SECURITY OBJECTIVES FOR THE TOE ENVIRONMENT .......................................................................... 22
SECURITY REQUIREMENTS................................................................................................................ 23
5.1
TOE SECURITY FUNCTIONAL REQUIREMENTS ..................................................................................... 23
5.1.1 Security Audit (FAU) ....................................................................................................................... 24
5.1.2 Access Control (FDP) ..................................................................................................................... 25
© Copyright IBM 2012, 2013
5.1.3 Security Management (FMT) .......................................................................................................... 28
5.1.4 Protection of the TSF (FPT) ............................................................................................................ 29
5.2
EXTENDED COMPONENTS DEFINITIONS................................................................................................ 29
5.3
TOE SECURITY ASSURANCE REQUIREMENTS ...................................................................................... 29
6
TOE SUMMARY SPECIFICATION ....................................................................................................... 30
6.1
IT SECURITY FUNCTIONS (SF) ............................................................................................................. 30
6.1.1 Access Control ................................................................................................................................ 30
6.1.2 Audit ................................................................................................................................................ 31
6.1.3 TOE Protection ............................................................................................................................... 32
7
RATIONALE .............................................................................................................................................. 32
7.1
CORRELATION OF THREATS, POLICIES, ASSUMPTIONS AND OBJECTIVES ............................................. 32
7.2
SECURITY OBJECTIVES RATIONALE ..................................................................................................... 33
7.2.1 Threats ............................................................................................................................................ 33
7.2.2 Security Policy ................................................................................................................................ 35
7.2.3 Assumptions..................................................................................................................................... 35
7.3
SECURITY REQUIREMENTS RATIONALE ................................................................................................ 36
7.3.1 Security Functional Requirements Rationale .................................................................................. 36
7.3.2 Security Assurance Requirements Rationale ................................................................................... 37
7.4
SFR DEPENDENCIES ............................................................................................................................. 38
7.5
TOE SUMMARY SPECIFICATION RATIONALE ....................................................................................... 40
7.5.1 TSF correspondence to SFRs .......................................................................................................... 40
© Copyright IBM 2012, 2013
Glossary and Terminology
ACL
Access Control List
Administrator
A user with membership to the mqm administrator group within the
operating system
AuthInfo Object
An Authentication Information (AuthInfo) object contains
authentication information used in Transport Layer Security (TLS)
encrypted transport of information.
Authorised User
A user who may, in accordance with the TSP, perform an operation.
CC
Common Criteria
Channel
Channels are communication objects that provide a communication
path from one queue manager to another.
Channel Authentication Record
A rule used either to determine the user identity of a
remote connection or to block a remote connection.
CipherSpec
On a TLS connection, the CipherSpec identifies the combination of
the encryption algorithm used to encipher data and the Message
Authentication Code algorithm used to generate the message digest.
The CipherSpec forms part of the CipherSuite.
CipherSuite
A CipherSuite is a suite of cryptographic algorithms used by an TLS
connection. It comprises the key exchange and authentication
algorithm used during the TLS handshake, the encryption algorithm
to encipher data and the Message Authentication Code algorithm
used to generate the message digest.
DAP
Data Abstraction and Persistence
DN
Distinguished Name. A name format described in the ITU-T
Recommendation X.501 standard and used in X.509 digital
certificate names. A digital certificate has at least two DN values: a
Subject DN (identifying the owner of the certificate) and an Issuer
DN (identifying the issuer of the certificate).
EAL
Evaluation Assurance Level
FIFO
First In First Out
FIPS
Federal Information Processing Standard
GSKit
Global Security Kit
ICC
IBM Crypto for C
IT
Information Technology
ITSEC
IT Security Evaluation Criteria
MCA
Message Channel Agent. A program that transmits prepared
messages from a transmission queue to a communication link, or
from a communication link to a destination queue.
© Copyright IBM 2012
Page iv
Message
A message is a string of bytes that is meaningful to the applications
that use it. Messages are used to transfer information from one
application program to another (or between different parts of the
same application).
MQ
Message Queue
MQI
Message Queue Interface
MQSC
Message Queue Script Commands
MDV
Maintenance Delivery Vehicle. This is a fix pack or a refresh pack.
A fix pack contains only fixes, a refresh pack contains fixes and new
function. MDVs are cumulative e.g. all fixes within MDV5 are
contained within MDV6.
Namelist
A namelist is a WebSphere MQ object that contains a list of cluster
names, queue names or authentication information object names. In
a cluster, it can be used to identify a list of clusters for which the
queue manager holds the repositories.
OAM
Object Authority Manager
Object
Objects are queue managers, queues, process definitions, namelists,
authentication information objects, channel objects, clntconn
channel objects, service objects and listener objects.
OCSP
Online Certificate Status Protocol: provides online checks for TLS
certificate revocation.
OS
Operating System
OSP
Organisational Security Policy
PCF
Programmable Command Format
Process Definitions A Process Definition object defines the attributes of an application
for the queue manager so that the queue manager can start the
application without operator intervention. e.g. at the occurrence of a
trigger.
Queue
A queue is a data structure used to store messages. Each queue is
owned by a queue manager.
Queue Manager
A Queue Manager supplies an application with WebSphere MQ
services. The Queue Manager is responsible for maintaining the
queues it owns, and for storing all the messages it receives onto the
appropriate queues.
SF
Security Function. A part or parts of the TOE that have been relied
upon for enforcing a closely related subset of rules from the TSP.
SFR
Security Functional Requirement
SHA
Secure Hash Algorithm
ST
Security Target
TLS
Transport Layer Security
© Copyright IBM 2012
Page v
TOE
Target Of Evaluation. An IT product or system and its associated
administrator and user guidance documentation that is the subject of
the evaluation.
Topic
A topic is the subject of the information that is published in a
publish/subscribe message.
TSF
TOE Security Function. A set consisting of all hardware, software
and firmware of the TOE that must be relied upon for the correct
enforcement of the TSP.
TSP
TOE Security Policy. A set of rules that regulate how assets are
managed, protected and distributed within the TOE.
© Copyright IBM 2012
Page vi
1
Introduction
This document is the Security Target (ST) for the Common Criteria (CC) evaluation of
WebSphere MQ version 7.1.
This document is the WebSphere MQ v7.1 EAL2 Security Target, version 0.19 and dated
February 19th, 2013.
1.1
Overview
IBM WebSphere® MQ is message queuing middleware. It connects all business software
together to form one enterprise by providing an open, scalable, industrial-strength
messaging backbone. The server systems are controlled by queue managers. The queue
managers can be networked together, and are also connected with remote end-user client
systems.
1.1.1
Platforms and Components
WebSphere MQ (WMQ) is divided into the operating system specific editions as follows:
WebSphere MQ for AIX;
WebSphere MQ for HP-UX IA64;
WebSphere MQ for Linux x86;
WebSphere MQ for Linux x86_64;
WebSphere MQ for Linux PPC;
WebSphere MQ for Linux zSeries;
WebSphere MQ for Oracle Solaris SPARC;
WebSphere MQ for Oracle Solaris x86_64; and
WebSphere MQ for Windows.
Each of the operating system specific Editions can support the following components
which are included within the Target of Evaluation :
 WMQ server (which includes the queue manager);
 WMQ C Client;
 WMQ XMS.NET/.NET/WCF clients (Windows only),
Each of the operating system specific Editions can support the following optional
components but these are not included within the Target of Evaluation:
 WMQ classes for JMS and WMQ classes for Java clients
These Java and JMS clients are not included because the underlying JVM security
software is not Common Criteria EAL2 certified.
In addition to the above components, there are tools and utilities to enable third party
development of applications. These applications are often referred to as ‘WebSphere MQ
Applications’. However, these are not within the scope of the evaluation. Similarly
© Copyright IBM 2012
Page 1
excluded from the scope of the evaluation are user exits (application or 3rd party vendor
software invoked by WebSphere MQ as extensions to the basic product function).
The following operating systems (OS) are supported within this evaluation. These are
assumed to be at the latest service level.
 AIX (V6.1)
 AIX (V7.1)
 HP-UX IA64 (V11.31)
 Microsoft Windows 7 Enterprise (32-bit and 64-bit versions)
 Microsoft Windows 7 Professional (32-bit and 64-bit versions)
 Microsoft Windows 7 Ultimate (32-bit and 64-bit versions)
 Microsoft Windows Server 2008 Enterprise Edition (32-bit and 64-bit versions)
 Microsoft Windows Server 2008 R2 Enterprise Edition
 Microsoft Windows Server 2008 R2 Standard Edition
 Microsoft Windows Server 2008 Standard Edition (32-bit and 64-bit versions)
 Microsoft Windows Vista Business (32-bit and 64-bit versions)
 Microsoft Windows Vista Enterprise (32-bit and 64-bit versions)
 Microsoft Windows Vista Ultimate (32-bit and 64-bit versions)
 Microsoft Windows Server 2003, Standard Edition (32-bit)
 Microsoft Windows Server 2003, Standard x64 Edition
 Microsoft Windows Server 2003, R2 Standard Edition (32-bit)
 Microsoft Windows Server 2003, R2 Standard x64 Edition
 Microsoft Windows Server 2003, Enterprise Edition (32-bit and 64-bit versions)
 Microsoft Windows Server 2003, Enterprise x64 Edition
 Microsoft Windows Server 2003, R2 Enterprise Edition (32-bit and 64-bit
versions)
 Microsoft Windows Server 2003, R2 Enterprise x64 Edition
 Microsoft Windows XP Professional
 Microsoft Windows XP Professional x64 Edition
 Linux for System p: Red Hat Enterprise Linux (RHEL) V5.0
 Linux for System p: Red Hat Enterprise Linux (RHEL) V6.0
 Linux for System p: SUSE Linux Enterprise Server V10
 Linux for System p: SUSE Linux Enterprise Server V11
 Linux for System x (32 bit and 64 bit): Red Hat Enterprise Linux (RHEL) V5.0
 Linux for System x (32 bit and 64 bit): Red Hat Enterprise Linux (RHEL) V6.0
© Copyright IBM 2012
Page 2
 Linux for System x (32 bit and 64 bit): SUSE Linux Enterprise Server V10
 Linux for System x (32 bit and 64 bit): SUSE Linux Enterprise Server V11
 Linux for System z: Red Hat Enterprise Linux (RHEL) V5.0
 Linux for System z: Red Hat Enterprise Linux (RHEL) V6.0
 Linux for System z: SUSE Linux Enterprise Server V10
 Linux for System z: SUSE Linux Enterprise Server V11
 Oracle Solaris SPARC: Oracle Solaris V10
 Oracle Solaris x86_64 : Oracle Solaris V10
It is assumed that all hardware used within the operating environment is secured such that
no potential vulnerabilities could be introduced that would circumvent the functionality
described within this ST.
WebSphere MQ will be tested in the following environments:

AIX 6.1 (PPC)

HP-UX 11.31 (IA64)

Linux for System p: Red Hat Enterprse Linux Advanced Server 5 (PPC)

Linux for System x: Red Hat Enterprse Linux Advanced Server 6 (x86_64)

Linux for System x: SUSE Linux Enterprise Server V11 (x86)

Linux for System z: Red Hat Enterprse Linux Advanced Server 5 (s390x)

Oracle Solaris 10 (SPARC)

Oracle Solaris 10 (x86_64)

Windows Server 2003 Standard Edition (x86_64)

Windows XP Professional (x86)
Not all versions of each operating system are tested. Correct Common Criteria compliant
operation on the other, untested, platforms is assumed on the basis that:

the same product code is used in all cases, and

the same product has been tested successfully on at least one substantially
similar operating system (i.e. a different version of the same operating system).
For example, AIX 7.1 is claimed on the basis that the same WebSphere MQ 7.1 product
code was successfully tested with AIX 6.1 and that there is no substantial difference
between the two AIX releases in the underlying operating system services used by
WebSphere MQ.
© Copyright IBM 2012
Page 3
1.1.1.1
Evaluated version
The evaluated version of WebSphere MQ will be 7.1.0.2.
1.1.1.2
Delivery mechanisms
As described in the Delivery Procedures document, there are multiple mechanisms by
which the end user can obtain WebSphere MQ.
For the purposes of this evaluation, the delivery mechanisms are:
1.1.2

A CD or DVD disk, physically shipped to the end user

The online IBM Download Director tool, which allows the product to be
downloaded and verified
Overview: Access Control
Access to an object is only given to a process acting on behalf of a user, if the associated
user and group identifiers (IDs) associated with the user have been granted permission to
access to that object. The user and group IDs are gained from the operating system and
cached in memory for any subsequent access requests. The user ID is contained within
the message descriptor, which is used to confirm the user and group permissions.
Permission is confirmed by checking that either the user identifier (UID) or group
identifier (GID) is contained within the object’s Access Control List (ACL), or that of a
recursive parent in a topic hierarchy.
Only administrators are able to modify the ACL or delete event messages. Administrators
are users that belong to the mqm or administrator groups within the Operating System
environment. Identification is performed in the same way as normal users.
On creation of an object, the queue manager sets default values for that object such that
only the ID associated with the process creating the object and the administrator are able
to access that object. This is done by adding the creators’ and administrators’ UID and
GIDs to the ACL of that object. Once an object has been created, then the administrator
can update the ACL to grant or revoke access via the command line interface.
1.1.3
Overview: Audit
The queue manager can be configured to generate event messages to record various
significant security auditing events. There are four different types of security auditing
event message, which are described in the subsections below. Each type of event message
is put onto a different event queue.
An event queue behaves in the same manner as all other queues and like other queues has
an ACL list, with access only given to the administrator (i.e. members of the mqm or
administrator group). If the event queue is unavailable for any reason, then the event
message will be lost but the audited action still occurs. An event queue might be
unavailable for many different reasons including:
 The queue has not been defined.
 The queue has been deleted.
© Copyright IBM 2012
Page 4
 The queue is full.
 The queue has been put-inhibited.
Only user who has been granted the appropriate MQ authorization by an MQ
administrator can define, delete or put-inhibit queues.
All audit event messages contain the following information:
 Date and Time;
 Type of event;
 Type of application that caused the event; and
 User identity.
The date and time information is retrieved from the Operating system each time an event
message is created. The User ID is gained from the process message descriptor.
Each event queue is protected to prevent unauthorised modification and deletion of audit
records. This is done in the same way as all other queues with only the administrator
(member of mqm or administrator group) being able to access the queue. Queue
administration is performed using the MQSC commands, which are initialised by entering
the runmqsc control command at the administrative interface.
Viewing of the audit records is performed via a third party application. Various
applications can be used to process MQ audit records. For example, IBM provides an
add-on named SupportPac MO71 which can process audit records and a monitoring
product named Tivoli OMEGAMON. Other vendors also produce similar tools.
1.1.3.1
Authorization failure events
Provided
that
authorization
failure
events
are
enabled
and
the
SYSTEM.ADMIN.QMGR.EVENT queue is available, then the queue manager generates
an event message for authorization failures.
1.1.3.2
Channel events
Provided that channel events are enabled and the SYSTEM.ADMIN.CHANNEL.EVENT
event queue is available, then the queue manager generates an event message for each
unsuccessful channel connection. These events can include:
 Channel connections blocked by the CHLAUTH rules;
 Channel connections blocked by a user exit; and
 Channel connections which fail for other reasons, such as a missing channel object
or a resource constraint.
For events relating to remote connection blocking via CHLAUTH records (section 2.1.1),
the event message additionally includes:
 Connection name (IP address);
 Client user ID, if the connection is from a client application;
 Queue manager name, if the connection is from a queue manager;
 Digital certificate Subject Distinguished Name, if the connection uses TLS.
© Copyright IBM 2012
Page 5
1.1.3.3
Command events
Provided
that
command
events
are
enabled
and
the
SYSTEM.ADMIN.COMMAND.EVENT event queue is available, then the queue
manager generates an event message for each command executed on the queue manager.
This records a complete audit history of every command issued on the queue manager,
together with the identity of the command issuer.
Command event messages additionally include:
 Which command that was issued
 The parameters of the command
1.1.3.4
Configuration events
Provided
that
configuration
events
are
enabled
and
the
SYSTEM.ADMIN.CONFIG.EVENT queue is available, then the queue manager
generates an event message whenever a queue manager object is created, deleted or
changed. This records a complete audit history of all changes made to the queue manager.
Configuration event messages additionally include:
 The name of the object which was modified (created/deleted/changed)
 The type of the object which was modified
 The attributes of the modified object
1.1.4
Overview: Inter-system Communication
When messages and data are transferred between remote WebSphere MQ queue
managers, and between WebSphere MQ clients and queue managers, the Transport Layer
Security (TLS) protocol may be applied to the communications channels used. TLS
provides advanced capabilities for identity authentication, data integrity checking, and
data encryption.
The WebSphere MQ Server and WMQ C Client use the GSKit software in the TOE
environment to enable support for TLS. GSKit is a set of tools and C/C++ programming
interfaces that can be used to add secure channels using the TLSv1 and TLSv1.2
protocols to TCP/IP applications (products). It provides the cryptographic functions, the
protocol implementation and key generation and management functionality for this
purpose.
The GSKit software must be configured such that
 only TLSv1 and TLSv1.2 are allowed
 only TLS CipherSuites whose CipherSpec parts consist of cryptographic
algorithms that are FIPS 140-2 [FIPS140-2] approved and
 the FIPS 140-2 [FIPS140-2] approved random number generator is used.
This configuration is called FIPS mode. Please note that the cryptographic algorithms
used for key exchange are not affected by these restrictions.
WebSphere MQ must initialize and use the GSKit software in FIPS mode.
© Copyright IBM 2012
Page 6
Furthermore, the GSKit software must be configured as per the additional restrictions
described in its Common Criteria Operating Guidance document, which include:
 GSKit environment variables will be ignored, and
 the current version of the FIPS 140-2 standard will be applied, and
 Residual Information Protection must be enabled, and
 Strict PKIX certificate validation will be used as per RFC 5280.
WebSphere MQ already complies with several of the GSKit Common Criteria provisions
by default, however it also provides configuration options which allow the above
additional restrictions to be enforced.
The environment must provide reliable timestamps for certificate and CRL verification.
The processing resources of the TOE must be located within controlled access facilities.
The GSKit digital certificates and keys necessary for the TLS channel are maintained in a
key database file. This key database file must be protected. This includes appropriate
protection of backup copies. In addition the passwords to access the key database file are
kept in a password stash file so that the digital keys can be accessed programmatically
and for configurations that do not have a human operator present for normal operations.
This password stash file must be protected by an ACL while it resides on the system and
by encryption when backed up.
The use of certificate revocation lists (CRLs) for certificate validation is optional. The
TOE can retrieve a CRL using LDAP, check that the signatures are valid, and, if they are,
will use this CRL for certificate validation. If CRLs are to be used, an LDAP client and
an LDAP server that provides a current CRL, which contains all revoked certificates,
must be available in the TOE environment.
The use of OCSP responder lookup for certificate revocation checking is also optional.
The TOE can request certificate checking at a responder invoked at a given URL, where
the certificate may be checked for revocation, and a response will be returned indicating
whether the certificate is valid for use, revoked or unknown. The OCSP responder in such
a situation is outside the ST, but the TOE includes making the request to an OCSP server
and processing the responses received.
The GSKit in the evaluated configuration must not use
 non-FIPS approved cryptographic functions of ICC version 8.0 for the CipherSpec
part of TLS CipherSuites,
 SSL (due to known weaknesses),
 “total anonymity mode” for TLS (i.e. server authentication is mandatory), and
WebSphere MQ classes for .NET (also referred to as WebSphere MQ base .NET), IBM
Message Service Client for .NET (also referred to as XMS.NET) and Custom Channel for
WebSphere MQ and Windows Communication Foundation (also referred to as
WebSphere MQ WCF) all use a common .NET implementation available only on
Windows. A WebSphere MQ .NET application can use TLS to obtain a secure
connection to a queue manager, with authentication, message integrity, and data
encryption. .NET clients can be used in 3 modes - connecting as a WebSphere MQ client
in a managed .NET environment, as a WebSphere MQ client making use of the
WebSphere MQ ‘C’ client, or directly to a WebSphere MQ server. Of these modes, use
© Copyright IBM 2012
Page 7
of the managed client mode is outside the ST as it does not support TLS client
connections.
1.2
Description
WebSphere MQ (WMQ) allows application programs to use message queuing or message
publication and subscription to participate in message-driven processing. Application
programs can communicate across different platforms by using WMQ. For example, AIX
and Oracle Solaris applications can communicate through WebSphere MQ. The
applications are shielded from the mechanics of the underlying communications.
Messages are used to transfer information from one application program to another (or
between different parts of the same application). The applications can be running on the
same platform, or on different platforms.
Each queue or publish/subscribe topic is owned by a queue manager. The queue manager
is responsible for maintaining the queues and topics it owns, and for storing all the
messages it receives onto the appropriate queues and topic-based storage. The messages
might be put on the queue or published to the topic by application programs, or by a
queue manager as part of its normal operation.
The TOE is indicated by the thick black line shown in Figure 2.1 of this ST.
Figure 1.1 shows an example of how different servers and clients can communicate with
one another. The operating systems on each of these can be independent of one another
and the applications can reside on the same machine as the queue manager without the
requirement for a client.
Application
Application
MQI or.NET API or
XMS API or WCF
custom channel
WebSphere
Server
Comm
Link
Application
MQ
Comm
Link
WebSphere MQ
Server
WebSphere MQ Clients
TCP/IP
TLS
TCP/IP
TLS
Client
Server A
Server B
Figure 1.1 Connections between MQ servers and WMQ clients
1.2.1
WMQ Server
The WMQ server contains the queue manager, which is responsible for maintaining the
queues and topics that it owns, and for storing all the messages it receives onto the
appropriate queues and topic-based storage. The server contains components that:
 Interface with the operating system to retrieve information (Common Services),
 Provides a command line interface for administration of the queues and topics;
 Provide an Application Interface (AI) for MQ applications running locally on the
same WMQ server. The libraries which provide this interface are known as the
“server bindings” libraries;
© Copyright IBM 2012
Page 8
 Interface to remote queue managers (Message Channel Agent (MCA)). This
component is responsible for sending and receiving of messages to remote queues.
Messages are transmitted between queue managers on a channel. Channels are
objects that provide a communication path from one queue manager to another; this
can be secured using TLS protocols.
1.2.2
WMQ Clients
The WebSphere MQ Client libraries are commonly known as the “client bindings”
libraries and are represented by the “WebSphere MQ Clients” section of Figure 1.1. A
client application is an MQ application which uses one the client bindings libraries to
exchange messages which a queue manager.
There are a range of types of WMQ clients. There are the WMQ C Client with procedural
language variants for e.g. COBOL and PL/1, the WMQ base.NET client with a C++
variant, the WMQ XMS Client, and the WCF custom channel. The
.NET/XMS.NET/WCF clients share .NET implementation technology with alternative
APIs exposed for application development and management.
1.2.2.1
WMQ C Client
The WMQ C client is part of the WebSphere MQ product that can be installed on its own,
on a separate machine from the server. A WMQ user application can be built and run on a
WMQ C client system and it can interact with one or more WMQ servers and can connect
to their queue managers by transmitting messages on channels that may be secured using
TLS protocols. The servers to which the client connects might or might not be part of a
cluster. The IBM® Global Security Kit (GSKit) provides the ability to use TLS
connections with cryptographic modules that have been FIPS 140-2 certified. WMQ C
client applications use the MQI.
1.2.2.2
WMQ WCF, XMS.NET and Base .NET Clients
WebSphere MQ classes for .NET (also referred to as WebSphere MQ base .NET or
WebSphere MQ .NET) allow a Windows application in a .NET language to connect to
WebSphere MQ as a WebSphere MQ client or to connect directly to a WebSphere MQ
server. When connecting as a client, a managed .NET implementation can be used, or a
wrapper on the WebSphere MQ ‘C’ client can be used. WebSphere MQ base .NET
encapsulates in an object-oriented model the Message Queue Interface (MQI), the native
WebSphere MQ API.
IBM Message Service Client for .NET (also referred to as XMS.NET) is a set of .NET
classes that implement a set of IBM interfaces designed to reflect Oracle’s Java Message
Service (JMS) interfaces to enable .NET programs to access WebSphere MQ systems. As
with WMQ classes for .NET, XMS.NET allows an application to connect to WMQ either
as a WMQ client or directly to a WMQ server.
Custom Channel for WebSphere MQ and Windows Communication Foundation is an
implementation of Microsoft’s WCF interfaces for custom transport channels supporting
services and applications. As with base .NET and XMS.NET, client and direct server
connections are available.
WebSphere .NET/XMS.NET/WCF clients can be installed as WebSphere MQ clients
either on the WebSphere MQ server machine or on a separate machine. A WebSphere
MQ .NET/XMS.NET/WCF application, when used in unmanaged mode (wrapping the
© Copyright IBM 2012
Page 9
WebSphere MQ ‘C’ Client), can use TLS to obtain a secure connection to a queue
manager, with authentication, message integrity, and data encryption. The
implementation of this is that described for the ‘C’ Client. Use of the managed client
mode is outside the ST of the TOE.
Note also that the .NET/XMS.NET/WCF interfaces can also be configured locally to
access a queue manager. This is achieved using a wrapper for the local C MQI. An
application chooses to use this local configuration by selecting a transport type called
“server bindings”. Since the .NET/XMS.NET/WCF layer wraps the C MQI, the
description of the MQI also applies to the .NET/XMS.NET/WCF APIs in the server
bindings mode.
1.2.3
Message Queue Interface (MQI)
WMQ provides the Message Queue Interface (MQI), a common applicationprogramming interface available wherever the applications run. This makes it easier to
port application programs from one platform to another and enables the MQI to be
running on a separate machine to the queue manager.
1.3
CC Conformance
This ST is [CC] Part 2 extended with FAU_GEN_MQ.1 and Part 3 conformant, with a
claimed Evaluation Assurance Level of EAL2 augmented with ALC_FLR.2.
1.4
References
[CC]
1.5
Common Criteria for Information Technology Security Evaluation,
Version 3.1, Revision 3, July 2009.
Structure
The structure of this document is:

Section 2 is the TOE description;

Section 3 provides a statement of the Security Problem Definition;

Section 4 provides the statement of IT security objectives;

Section 5 provides a statement of IT security requirements;

Section 6 provides the TOE summary specification, which includes the detailed
specification of the IT functions; and

Section 7 provides the rationale for the security objectives, security requirements
and TOE summary specification.
© Copyright IBM 2012
Page 10
2
TOE Description
The diagram below shows the physical scope and boundaries in relation to the
components within the TOE. It should be noted that the TOE includes the WMQ C
Client. The TOE is a subset of the product and the solid line within figure 2.1 illustrates
the boundary of the TOE in relation to the components. It should be noted that the
applications, application programs and operating systems referred to within this ST are
outside the scope of the evaluation.
Administrative commands on the queue manager can be supplied on the command line
using Message Queue Script Commands (MQSC), or using the WMQ Explorer GUI or
from an application using the Programmable Command Format (PCF). Henceforth, in
this document, a reference made to an MQSC command implicitly includes other ways to
submit the command. Note that the WMQ Explorer is not included within the scope of
this evaluation.
© Copyright IBM 2012
Page 11
External interface to the
operating system
External interface to applications (via
MQI or base Java or JMS bindings API)
MQ Server A
TOE boundary
Queue Manager
OAM
IT1
Common Services
AI
IT3
IT1
P/S Engine
DAP
CHLAUTH
QM Kernel
IT4
IT5
MCA
Command line interface
IT6
IT8
GSKit
TCP/IP Listener
TLS MQI Channel
IT2
from MQ Client
IT2
GSKit
IT6
TLS Message Channel
from MQ Server
GSKit
IT7
MQI Channel
IT7
IT6
MCA
Queue Manager
MQ Server B
Application
Administrator
WMQ C Client
Figure 2.1: TOE boundary
© Copyright IBM 2012
Page 12
Note that in Figure 2.1, the IBM .NET/XMS.NET/WCF client offerings are excluded;
since the only modes of operation for these clients which lie within the TOE act as
wrappers to the MQI, their presence in the diagram would not materially add anything
beyond what is shown.
When connecting applications to a queue manager over any type of client connection, an
MCAUSER is specified for each logical connection, from which the application
connection’s authorities are derived. Multiple logical connections from a client to a
server can flow across the same physical socket connection; each logical connection may
use a different MCAUSER. Therefore, multiple MCAUSER authorities may apply to
different application flows across a single physical connection.
2.1
Queue Manager
A queue manager is a system program that provides queuing and messaging services to
applications. It provides an application-programming interface so that programs can put
messages on, and get messages from, queues; and also publish messages to, and subscribe
to receive messages from, topics. A queue manager provides additional functions so that
administrators can create new queues and topics, alter the properties of existing queues
and topics, and control the operation of the queue manager. The actual creation and
deletion of queue managers are controlled by access control functions in the OS and
therefore are not within the scope of the evaluation. Management within queues and
topics is within the scope of the evaluation.
2.1.1
Channel Authentication Records (CHLAUTH)
Channel authentication records are a set of rules which allow a queue manager to do two
things:
1.
2.
Determine which user ID an inbound network connection should use, based upon
one or more of the following connection identity data:
◦
the channel name
◦
the Subject Distinguished Name of the remote personal certificate
◦
the remote client application user ID, if the connection is from a client
application
◦
the remote queue manager name, if the connection is from a queue manager
◦
the remote IP address of the connection
Determine whether an inbound network connection should be blocked, based upon
one or more of the above.
Channel authentication records can be defined only by users who have been granted
authority by an administrator. They are known as CHLAUTH records for short. More
information about them is detailed in the [HLD].
© Copyright IBM 2012
Page 13
2.1.1.1
TOE CHLAUTH configuration
For this TOE, the queue manager’s CHLAUTH records must be configured such that all
of the following conditions are met:

Queue manager CHLAUTH record processing must be enabled, i.e. the
CHLAUTH queue manager attribute is ENABLED.

SSLPEERMAP CHLAUTH records with non-empty DN filters must be used to
override the user ID of all permitted inbound connections to a user ID specified
in the SSLPEERMAP record.

A general fallback ADDRESSMAP rule must be defined to block all addresses,
so that any connection which fails to match a specific SSLPEERMAP rule is
blocked.
The rationale is that this configuration, combined with the earlier requirements for GSKit
configuration, ensures that:
2.1.2

All successful inbound connections use FIPS 140-2 validated TLS encryption.

The user ID to be used in OAM authority checking for the connection is derived
using the Subject DN of the remote personal certificate. Therefore any user ID
received from the remote side is always overridden in a manner determined by
the queue manager CHLAUTH configuration.

The remote personal certificate Subject DN is trustworthy because it has been
successfully validated using the administrator’s chosen trusted signer certificates
and in accordance with the FIPS 140-2 and TLS RFC standards.
Object Authority Manager (OAM)
Authorization for using MQI calls, commands, and access to objects, is provided by the
Object Authority Manager (OAM), which is enabled by default. Access to WebSphere
MQ objects is controlled by the OAM based upon User and Group IDs controlled by the
operating system. A command line interface to enable administrators to grant or revoke
authorizations described in Section 6.1.1 is used. The grant authority command gives a
user a specific granted authority and a revoke command removes the specified authority
from a user.
The OAM needs to be able to identify who is requesting access to a particular object.
WebSphere MQ uses the term principal to refer to the User identifier associated with a
user. The principal is established when the application first connects to the queue
manager; it is determined by the queue manager from the user ID associated with the
connecting application and from any applicable channel authentication mapping records.
WebSphere MQ propagates the user ID received from the system in the message header
of each message as identification of the user. This user ID is then checked against those
on the Access Control List (ACL) of the object.
The OAM also provides a query service to determine if a user ID is privileged with
respect to MQ administration. This is called by the CHLAUTH component to determine
whether a user ID matches a “*MQADMIN” CHLAUTH record.
© Copyright IBM 2012
Page 14
2.1.3
QM Kernel
In WebSphere MQ, event monitoring is performed by the QM Kernel. An
instrumentation event is a logical combination of conditions that is detected by a queue
manager. Such an event causes the queue manager or channel instance to put a special
message, called an event message, on an event queue. An event queue is like any other
MQ queue in the way access is controlled but it stores only event messages.
WebSphere MQ instrumentation events provide information about errors, warnings, and
other significant occurrences in a queue manager, and in particular authorisation failures.
2.1.4
Application Interface (AI)
The AI component provides an external interface to the TOE. It is responsible for
accepting calls from an application, and performing simple syntax checking on the
parameters. The native interface for WMQ is the MQI API.
Applications can access MQ objects by issuing MQI calls. The applications can also use
PCF commands to access these objects.
Base .NET applications use the .NET API provided by the WebSphere MQ classes for
.NET. XMS.NET applications use the API provided by the IBM Message Service Client
for .NET.
WCF applications use the API provided by Microsoft Windows
Communication Foundation, configured to use the WebSphere MQ custom channel.
2.1.5
Data Abstraction and Persistence (DAP)
The DAP component of the Queue Manager holds the attributes of objects such as
process definitions and queues or topics, and the messages on the queues or topic-based
storage. The DAP component is responsible for the local queue and topic attributes. None
of these are security attributes as defined within this ST.
2.1.6
Publish/Subscribe (P/S Engine)
WMQ contains integrated publish/subscribe capabilities. These are implemented by the
publish/subscribe engine, with the OAM being called to perform all underlying access
control checks against topic objects.
An introduction to publish/subscribe concepts and details of the publish/subscribe
function offered by WMQ may be found in [InfoCenter topic ps20010].
Only local publish/subscribe is included within the scope of this evaluation. Distributed
publish/subscribe – which includes the concepts of clusters and hierarchies – is not
included.
2.2
Command line Interface
The command line interface is used to enable administrators to provide management of
the queue manager. Only administrators (i.e. members of the mqm group on UNIX and
Windows and local system administrators on Windows) are authorised to issue control
commands. The mqm group is automatically created by the install process.
© Copyright IBM 2012
Page 15
Administrators can use control commands to administer WMQ. One of these control
commands is setmqaut, which is used to grant authorities to users to enable them to
access WMQ resources.
Administrators can use the control command runmqsc to enable the use of MQSC. This is
used to manage the message queues and other WMQ objects.
2.3
Common Services
The Common Services layer provides an Operating System (OS) independent, external
interface to those services that other components wish to use that contains platform
specific code. It performs no security checks and is simply a WMQ developer’s interface.
2.4
Message Channel Agent (MCA)
A message channel is a one-way link. It connects two queue managers via message
channel agents (MCAs). Its purpose is to transfer messages from one queue manager to
another. Message channels are not required by the client/server environment since the
clients use MQI Channels to transfer messages to and from the servers.
The Message Channel Agent is a program that transmits prepared messages from a
transmission queue to a communication link or from a communication link to a
destination queue. The transmitted messages can be secured through the use of TLS over
TCP/IP. All external data from and to the MCA is protected by the TLS function
provided by the GSKit software in the TOE environment.
The MCA calls the GSKit interface (IT6 in Figure 2.1) to send or receive encrypted
message data using TLS over TCP/IP. The SSLCIPH attribute of the WMQ channel
definition determines the encryption algorithm and hashing algorithm used to protect the
data against disclosure to, or modification by, an unauthenticated user. A queue
manager’s MCA will always check that an inbound channel connection is using the
correct SSLCIPH for its channel object and only authorized users can create or modify
channel objects, so an unauthenticated user cannot bypass the use of TLS. Refer to
[InfoCenter topic sy12870] for details of the available CipherSpec values and [InfoCenter
topic sc10950] for information about channel definitions.
The MCA calls the queue manager's CHLAUTH interface to perform channel
authentication checks for inbound connections.
2.5
MQI Channel
MQI channels are channels that connect a WMQ C client to a WMQ queue manager. It is
a two-way link and is mainly used for the transfer of MQI calls and responses.
All external data from and to the MQI Channel is protected by the TLS function provided
by the GSKit software in the TOE environment.
The MQI Channel calls the GSKit interface (IT6 in Figure 2.1) to send or receive
encrypted message data using TLS over TCP/IP. The SSLCIPH attribute of the WMQ
channel definition determines the encryption algorithm and hashing algorithm used to
protect the data against disclosure to, or modification by, an unauthenticated user. A
queue manager MQI Channel will always check that an inbound channel connection is
© Copyright IBM 2012
Page 16
using the correct SSLCIPH for its channel object and only authorized users can create or
modify channel objects, so an unauthenticated user cannot bypass the use of TLS. Refer
to [InfoCenter topic sy12870] for details of the available CipherSpec values and
[InfoCenter topic sc10950] for information about channel definitions.
The MQI Channel calls the queue manager's CHLAUTH interface to perform channel
authentication checks for inbound connections.
2.6
TCP/IP Listener
The TCP/IP listener waits for inbound socket connection from remote machines which
may be created due to MQI channels or MCA channels being started and directing their
communications to the port this listener is using.
The TCP/IP listener accepts inbound TCP/IP sockets, which are then used to transport
TLS connections. The MQI channel and MCA channel components implement all of the
necessary security functions to counter the threats described in section 3.2.1.
2.7
TOE Environment
The WebSphere MQ Server product and the WebSphere MQ C Client use the IBM®
Global Security Kit’s TLS API to request TLS connections. Only FIPS 140-2 certified
TLS CipherSpecs are permitted within the TOE. GSKit version 8.0.14.22 or later must be
present in the TOE environment because WebSphere MQ depends upon it for TLS
protocol support, however it was evaluated to EAL4 separately1. As such, this evaluation
will reuse the GSKit component evaluation and not perform any further evaluation of the
GSKit functions.
A WebSphere MQ channel secured using TLS can use differing encryption algorithms.
This is accomplished by specifying a CipherSpec on the channel definition on the WMQ
server or WMQ C client. WMQ supports three TLS CipherSpecs. However, EAL2
certification can only be obtained for those that are FIPS 140-2 certified. Hence WMQ
has to run in FIPS mode.
The CipherSpec parts of the TLS CipherSuites provided by GSKit operating in FIPS
mode contain algorithms that are FIPS 140-2 approved (ref: FIPS certificate 1433). The
following TLS CipherSuites are supported from WebSphere MQ:

TLS_RSA_WITH_3DES_EDE_CBC_SHA

TLS_RSA_WITH_AES_128_CBC_SHA

TLS_RSA_WITH_AES_256_CBC_SHA

TLS_RSA_WITH_AES_128_CBC_SHA256

TLS_RSA_WITH_AES_256_CBC_SHA256

TLS_RSA_WITH_AES_128_GCM_SHA256
1
GSKit has not yet completed evaluation (at EAL4). This evaluation will complete before the
WebSphere MQ evaluation.
© Copyright IBM 2012
Page 17

TLS_RSA_WITH_AES_256_GCM_SHA384

ECDHE_ECDSA_3DES_EDE_CBC_SHA256

ECDHE_RSA_3DES_EDE_CBC_SHA256

ECDHE_ECDSA_AES_128_CBC_SHA256

ECDHE_ECDSA_AES_256_CBC_SHA384

ECDHE_RSA_AES_128_CBC_SHA256

ECDHE_RSA_AES_256_CBC_SHA384

ECDHE_ECDSA_AES_128_GCM_SHA256

ECDHE_ECDSA_AES_256_GCM_SHA384

ECDHE_RSA_AES_128_GCM_SHA256

ECDHE_RSA_AES_256_GCM_SHA384
WMQ relies upon those responsible for the administration of the TOE and the TOE
environment to be competent and trustworthy individuals, capable of managing the TOE
and its environment and the security of the information it contains.
WMQ relies upon the OS to provide the security environment to protect both the client
and server.
Remote logins to the OS (such as telnet, rlogin, SSH and similar services) must not be
allowed.
The OS must provide a user ID for each application. The MQI bindings libraries will
query the OS to determine the user ID under which the application is running. On UNIX
and Linux systems, the authorisation routines in the OS check either the real (logged-in)
user ID, or the effective user ID associated with the application. On Windows, WMQ
uses the SID.
MQI applications which use the AI server bindings are not subject to CHLAUTH
processing, so the OS user ID is used to identify the application for the purposes of OAM
authority checks. It is assumed that the server OS provides reliable user ID information.
MQI client applications also query the OS for a user ID and send it over the network
connection to the server; however in this TOE the CHLAUTH records always override
the client user ID and so it cannot be used to spoof an identity.
The OS must enforce ACL entries on all system calls, including those for file and
directory access, in order to prevent unauthorised access to system resources.
The OS also provides reliable time and date information for certificate and CRL
verification, including optional OCSP certificate revocation checking. The OS also
ensures that all accesses to certificate and key stores are limited to authorized users.
CRLs can be retrieved using an LDAP client and server provided by the TOE
environment. The connection between the LDAP client and the LDAP server must be an
internal communication link within a trusted network.
OCSP certificate validation relies on an OCSP responder provided by the TOE
environment. Communication with the responder may be over any communication link,
© Copyright IBM 2012
Page 18
trusted or not. The actions of the OCSP responder and communication with it are outside
the ST.
The TOE environment includes an application to read audit records produced by the
TOE.
The GSKit key database file is protected by a password. In order to allow unattended
access to the key database file GSKit provides a stash file to store the password. This
stash file must be protected by an ACL or permission bits while it resides on the system
and by encrypting the stash file when it is backed up.
The GSKit key database file must have a randomly chosen strong password. The
password must be chosen according to the following minimum rules:

The password must be at least 14 characters long; and

The password must contain at least one lower case character; and

The password must contain at least one upper case character; and

The password must contain at least one digit or special character; and

Each character should not occur more than three times in the password; and

No more than two consecutive characters of the password should be identical.
The GSKit key database file must be created such that it is encrypted using TDEA (Triple
DES) and all changes to its contents must only use the runmqakm certificate
administration command operating in a FIPS-compliant manner. Specifically:

The GSKit key database must be created using the –FIPS and –strong command
line parameters.

All GSKit key database password change commands must specify the –FIPS and
–strong command line parameters.

All GSKit key database conversion commands must specify the –FIPS and –
strong command line parameter.

All GSKit certificate creation, certificate request creation and certificate signing
commands must specify the –sigalg parameter with a digital signature algorithm
of at least sha1 (or a stronger signature algorithm).

All GSKit certificate export commands must only export into a target database
which already exists and which is created and managed according to these rules.

All other GSKit key database commands must specify the –FIPS command line
parameter.

If cryptographic hardware is to be used for key database storage, the device and
its driver must be FIPS 140-2 certified.
© Copyright IBM 2012
Page 19
3
Security Problem Definition
3.1
Introduction
The statement of the Security Problem Definition describes the security aspects of the
environment in which it is intended that the TOE will be used and the manner in which it
is expected to be employed.
The statement of the Security Problem Definition therefore identifies the assumptions
made on the operational environment and the intended method for the product, defines
the threats that the product is designed to counter and the organisational security policies
which the product is designed to comply.
3.2
Threats
The assumed security threats are listed below:
3.2.1
3.2.2
3.3
Threats countered by the TOE
[T.ACCESS_RES]
An authorised user of the TOE gains access to an object
without the correct authority to access that object.
[T.ACCOUNT]
Unauthorised attempts to access objects for which the user has
no authority go undetected.
Threats countered by the TOE Environment
[T.ACCESS_TOE]
An unidentified user gains access to the TOE and its objects.
[T.CHANNEL]
Data transferred between platforms is disclosed to, or
modified by unauthenticated users or processes, either directly
or indirectly.
[T.ROLE]
A non-privileged user gains administrative privileges.
[T.OS]
The operating system on which the TOE is installed becomes
compromised.
Organisational Security Policies (OSPs)
The TOE complies with the following OSP:
[P.ACCESS]
3.4
The right to access a specific object is determined on the basis of:

The identity of the subject attempting to access the object; or

Membership of a group that has access rights to the object.
Assumptions
This section provides the minimum physical and procedural measures required to
maintain security of the WebSphere MQ product.
© Copyright IBM 2012
Page 20
3.4.1
3.4.2
Physical aspects
[A.OS]
It is assumed that the operating system of each system within the
TOE, including any failover backup servers and any shared
resources such as remote filesystems, has been configured in
accordance with the manufacturer’s installation guides and where
applicable, in its evaluated configuration. It is securely configured
such that the operating system protects the TOE from any
unauthorised users or processes.
[A.PROTECT]
It is assumed that all software and hardware, including peripheral
devices, have been approved for the transmittal of protected data.
Such items are to be physically protected against threats to the
confidentiality and integrity of the data.
Personnel Aspects
[A.ADMIN]
© Copyright IBM 2012
It is assumed that there are one or more competent individuals that
are assigned to manage the TOE and the security of the information
it contains. Such personnel are assumed not to be careless, wilfully
negligent or hostile.
Page 21
4
Security Objectives
4.1
Security Objectives for the TOE
4.2
[O.ACCESS]
The TOE must ensure that only those users with the correct authority
are able to access an object.
[O.ACCOUNT]
The TOE must provide a means of recording any unsuccessful
access attempts to the objects.
[O.MANAGE]
The TOE must allow administrators to effectively manage the TOE
and that this is only performed by authorised users.
Security Objectives for the TOE Environment
[O.AUDIT]
The operating system must ensure an audit tool is available to only
administrators to review the audit trail.
[O.IDENTIFY]
The operating system must ensure that all users are identified.
[O. PROTECT]
The TOE must ensure that data transferred between platforms is
secured from disclosure to or tampering by unauthenticated users.
The GSKit component in the TOE environment provides the TLS
protocol support necessary to satisfy this objective.
[O.ROLE]
The operating system must be able to associate users with roles and
maintain an administrator role.
[O.TIME]
The operating system must ensure that the clock is accurate and
reliable.
[O.TOE_PROTECTION] The operating system will provide protection to the TOE and
its assets from external interference, tampering, and disclosure.
[O.ADMIN]
Those responsible for the TOE are competent and trustworthy
individuals, capable of managing the TOE and the security of the
information it contains.
[O.CONFIG]
Those responsible for the TOE must ensure that each user on the
supporting operating system has a unique user ID and that the
operating system is configured to ensure that only approved groups
of users may access the system.
[O.OS]
Those responsible for the TOE must ensure that the supporting
operating system is installed and configured in accordance with the
manufacturer’s instructions, the evaluated configuration where
applicable and is secure.
[O.RECOVER]
Those responsible for the TOE’s environment must ensure that
procedures and/or mechanisms are provided to ensure that after
system failure or other discontinuity, recovery without a security
compromise is obtained.
© Copyright IBM 2012
Page 22
5
Security Requirements
This section specifies the Security Functional Requirements (SFRs) for the TOE and
organises the SFRs by class.
Within the text of each SFR, the selection and assignment operations (as defined within
[CC]) are italicised. Refinements are identified using bold text (e.g., added text) for
additions and strike-through text (e.g., deleted text) for deletions.
Note: FAU_GEN_MQ.1 is an extended IT security requirement, and has not been
specified using CC Part 2 functional components.
5.1
TOE Security Functional Requirements
The following table summarises the SFRs:
CLASS
FAMILY
COMPONENT
ELEMENT
FAU
FAU_GEN
FAU_GEN_MQ.1
FAU_GEN_MQ.1.1
FAU_GEN_MQ.1.2
FAU_STG
FAU_GEN.2
FAU_GEN.2.1
FAU_STG.1
FAU_STG.1.1
FAU_STG.1.2
FDP
FDP_ACC
FDP_ACC.1
FDP_ACC.1.1A
FDP_ACC.1.1B
FDP_ACF
FDP_ACF.1
FDP_ACF.1.1A
FDP_ACF.1.1B
FDP_ACF.1.2A
FDP_ACF.1.2B
FDP_ACF.1.3A
FDP_ACF.1.3B
FDP_ACF.1.4A
FDP_ACF.1.4B
FMT
© Copyright IBM 2012
FMT_MSA
FMT_MSA.1
FMT_MSA.1.1A
Page 23
FMT_MSA.1.1B
FMT_MSA.3
FMT_MSA.3.1A
FMT_MSA.3.1B
FMT_MSA.3.2A
FMT_MSA.3.2B
FPT
5.1.1
FMT_MTD
FMT_MTD.1
FMT_MTD.1.1
FMT_SMF
FMT_SMF.1
FMT_SMF.1.1
FPT_ITT
FPT_ITT.1
FPT_ITT.1.1
Security Audit (FAU)
FAU_GEN_MQ.1.1 The TSF shall be able to generate an audit record of the following
auditable events:

Authorization failures.

Unsuccessful channel connections.

Commands executed on the queue manager.

Modification of queue manager objects.
FAU_GEN_MQ.1.2 The TSF shall record within each audit record at least the
following information:

Date and time of the event, type of event and subject
identity; and

If the event was caused by an application, the type of
the application causing the event.

For unsuccessful channel connections blocked by
CHLAUTH rules:

Connection name (IP address);

Client user ID, if the connection is from a
client application;

Queue manager name, if the connection is
from a queue manager;

Digital certificate Subject Distinguished
Name, if the connection uses TLS;

For commands executed on the queue manager: the
command that was issued, including its parameters;
© Copyright IBM 2012
Page 24

For modification of queue manager objects: the
object name; the object type; and the object attributes.
5.1.2
FAU_GEN.2.1
For audit events resulting from actions of identified users, the TSF
shall be able to associate each auditable event with the identity of
the user that caused the event.
FAU_STG.1.1
The TSF shall protect the stored audit records in the audit trail
from unauthorised deletion..
FAU_STG.1.2
The TSF shall be able to prevent unauthorised modifications to the
stored audit records in the audit trail.
Access Control (FDP)
FDP_ACC.1.1A
FDP_ACC.1.1B
The TSF shall enforce the access control policy on processes
acting on behalf of users, objects and all operations among
processes acting on behalf of users and the following:

Queue Managers;

Queue objects;

Topic objects;

Process definition objects;

Namelist objects;

Authentication information objects;

Channel objects;

Client connection channel objects;

Service objects;

Listener objects;

Communication information objects;

Channel authentication (CHLAUTH) records.
The TSF shall enforce the CHLAUTH access control policy on
MCA processes acting on behalf of inbound connections and
connect operations on the following:

FDP_ACF.1.1A
© Copyright IBM 2012
queue managers
The TSF shall enforce the access control policy to objects based on
the following:
Page 25
Subject
Security Attributes
Process acting on behalf of a User/Group IDs
user
Object
Security Attributes
Queue manager objects
ACL
Queue objects
ACL
Topic objects
ACL
Process definition objects
ACL
Namelist objects
ACL
Authentication information
objects
ACL
Channel objects
ACL
Client connection channel
objects
ACL
Service objects
ACL
Listener objects
ACL
Communication
objects
information ACL
Channel
authentication ACL
(CHLAUTH) records
FDP_ACF.1.2A
The TSF shall enforce the following rules to determine if an
operation among controlled subjects and controlled objects is
allowed: if the subject’s user or group ID is present within the
object’s ACL for the requested access then access is permitted.
For topics, this is extended to ‘if the subject’s user or group ID is
present within the object’s ACL, or that of a recursive parent
object in a topic hierarchy, for the requested access then access is
permitted’.
For CHLAUTH records, this is replaced with ‘if the subject’s user
or group ID is present within the queue manager’s ACL for the
requested access then access is permitted’.
© Copyright IBM 2012
Page 26
FDP_ACF.1.3A
The TSF shall explicitly authorise access of subjects to objects
based on the following additional rules: no additional rules.
FDP_ACF.1.4A
The TSF shall explicitly deny access of subjects to objects based on
the following additional rules: no additional rules.
FDP_ACF.1.1B
The TSF shall enforce the CHLAUTH access control policy to
queue managers based on the following:
Subject
Security Attributes
Process acting on behalf of an Digital certificate Subject
inbound connection
Distinguished Name for the
TLS connection
Remote IP address
Object
Security Attributes
Queue manager
CHLAUTH records
FDP_ACF.1.2B
The TSF shall enforce the following rules to determine if a connect
operation among controlled inbound connection subjects and
controlled objects is allowed:
Locate the highest precedence CHLAUTH record which matches
these security attributes of the inbound connection:

Digital certificate Subject Distinguished Name for the
TLS connection

Remote IP address
If the matching CHLAUTH record is of type BLOCKUSER or
BLOCKADDR, deny the connection.
Otherwise, examine the USERSRC attribute of the CHLAUTH
record:
© Copyright IBM 2012

If the attribute has a value of NOACCESS, deny the
connection.

If the attribute has a value of MAP, the connection adopts
the user ID named in the MCAUSER attribute of the
CHLAUTH record. This user ID is used for all subsequent
OAM authority checks for all subsequent operations
Page 27
performed on behalf of the connection in relation to all
objects.

5.1.3
Otherwise, the attribute has a value of CHANNEL and the
connection adopts the user ID sent by the remote system.
This value is not used in the MQ TOE because it places too
much trust in the remote system, but is mentioned here for
completeness.
FDP_ACF.1.3B
The TSF shall explicitly authorise access of CHLAUTH subjects to
queue managers based on the following additional rules: no
additional rules.
FDP_ACF.1.4B
The TSF shall explicitly deny access of CHLAUTH subjects to
queue managers based on the following additional rules: no
additional rules.
Security Management (FMT)
FMT_MSA.1.1A
The TSF shall enforce the access control policy to restrict the ability
to modify the security attributes ACL to the administrator.
FMT_MSA_3.1A
The TSF shall enforce the access control policy to provide
restrictive default values for security attributes that are used
to enforce the SFP.
FMT_MSA.3.2A
The TSF shall allow the no roles to specify alternative initial
values to override the default values when an object or
information is created
FMT_MSA.1.1B
The TSF shall enforce the CHLAUTH access control policy to
restrict the ability to modify the security attributes CHLAUTH
records to the administrator.
FMT_MSA_3.1B
The TSF shall enforce the CHLAUTH access control policy
to provide restrictive default values for security attributes that
are used to enforce the SFP.
FMT_MSA.3.2B
The TSF shall allow no roles to specify alternative initial
values to override the default values when a CHLAUTH
record is created.
FMT_MTD.1.1
The TSF shall restrict the ability to delete the event messages
to the administrator.
FMT_SMF.1.1
The TSF shall be capable of performing the following
management functions: Object Security Attributes
management, TLS management and Event Messages
management.
© Copyright IBM 2012
Page 28
5.1.4
Protection of the TSF (FPT)
FPT_ITT.1.1
5.2
The TSF shall protect TSF data from disclosure and modification
when it is transmitted between separate parts of the TOE.
Extended Components Definitions
There is one extended requirement in this ST, FAU_GEN_MQ.1. The rationale for the
extended SFR definition is below.
5.3

Class – The FAU class was chosen because this SFR is directly related to audit
functionality.

Family – The requirement is part of the FAU_GEN family because it specifies
behaviour related to the audit events the TOE is capable of generating.

Component - This is the only component in the family. This is why the
component is identified as “1.”

Management – None. The FAU_GEN.1 component was not used in this ST
specifically because the TOE does not audit events for startup and shutdown of
the audit mechanism. The TOE does provide the ability for users to turn auditing
off or potentially select less than the auditable events listed in FAU_GEN_MQ.1.

Dependencies – FPT_STM.1. This is satisfied by the IT Environment.

Audit – No audit events are required.
TOE Security Assurance Requirements
The target evaluation assurance level for this product is EAL2 augmented with
ALC_FLR.2.
© Copyright IBM 2012
Page 29
6
TOE Summary Specification
6.1
IT Security Functions (SF)
6.1.1
Access Control
AC.1
The ACL for each WMQ object, or authority record, contains a list of user IDs
and groups and the authorities which each has to the object. The user/group
Ids are human readable strings entered by an administrator. Each authority
record consists of a header specifying the MQ object name and type to which
the record applies, followed by a list of access control entries. Each access
control entry contains the name and type of principal with access to the
specified object, along with the level of access that they have. The term
principal is used to mean either an operating system user ID, or an operating
system security group.
The various access/permission types, which vary per object type, may be
found in the WMQ customer documentation. For example, see the
documentation for the setmqaut command in the System Administration
Guide, which contains a table illustrating which access/permissions apply to
which WMQ objects.
The TSF shall ensure that access to an object is only given to a process acting
on behalf of a user, if the associated user and group IDs associated with the
user, has been granted permission to access to that object. The user and group
IDs are gained from the operating system and cached in memory for any
subsequent access requests. Each process contains the user ID within the
message descriptor part of the process, which is used to confirm the group
permissions. Permission is confirmed by checking that either the UID or GID
is contained within the object’s Access Control List (ACL), or that of a
recursive parent in a topic hierarchy.
AC.2
The TSF shall ensure that only the administrators are able to modify the ACL
or delete event messages. Administrators are users that belong to the mqm or
administrator groups within the Operating System environment. Identification
is performed in the same way as normal users.
AC.3
On creation of an object, the TSF shall set default values for that object such
that only the ID associated with the process creating the object and the
administrator are able to access that object. This is done by adding the creators
and administrators UID and GIDs to the ACL of that object. Once an object
has been created, then the administrator can update the ACL to grant or revoke
access via the command line interface.
AC.4
There are two types of CHLAUTH record: blocking records and mapping
records. A blocking record contains a user ID or IP address pattern which will
be denied TCP/IP connectivity to the queue manager. A mapping record
© Copyright IBM 2012
Page 30
contains patterns that can match the security attributes of a remote connection
and a method of determining the user ID to be used for subsequent authority
checks for that connection (the USERSRC field).
Each remote connection originates from a known source TCP/IP address. If
TLS is used in accordance with the MQ TOE, the remote connection will also
present a digital certificate to identify itself. These security attributes are used
to select a CHLAUTH record by comparing them with the patterns in each
CHLAUTH record.
The TSF shall ensure that access to a queue manager by a process acting on
behalf of an inbound remote connection is only permitted if the highest
precedence mapping CHLAUTH record which matches the security attributes
of the connection maps the connection onto a user ID which has been granted
connect authority in the ACL of the queue manager object.
If no mapping CHLAUTH record matches the security attributes of the
connection then the TSF shall block the connection and no access will be
permitted.
6.1.2
AC.5
The TSF shall ensure that only administrators are able to create, delete or
modify CHLAUTH records. The TSF shall ensure that each CHLAUTH
record is protected against unauthorised modification or deletion (as per AC.5)
from the moment of its creation.
AC.6
The administrator who creates the CHLAUTH record determines its initial
security attributes: no security attributes are inherited. Creation of the record
does not confer any additional authority upon the creator.
Audit
Audit.1
Provided that the event queue is not full, then the TOE shall generate an event
message for Authorisation failures, unsuccessful channel connections,
commands executed on the
queue manager and modification of queue
manager objects.
An authorization failure in this context is any unsuccessful access control
check - WMQ has determined that a particular user ID is not authorised to
access a WMQ object in the requested manner.
An unsuccessful channel connection in this context is any channel connection
which ends because the TLS handshake has rejected the remote digital
certificate, or because the connection matched a CHLAUTH record that
blocked the connection.
A command executed on the queue manager in this context is any MQSC or
PCF command.
© Copyright IBM 2012
Page 31
The Queue Manager will put an event message onto the event queue, which
behaves in the same manner as all other queues and like other queues has an
ACL list, with access only given to the administrator (i.e. members of the
mqm group). If the event queue becomes full, then no auditing will take place.
Audit.2
For each event message, the following information is recorded:

Date and Time;

Type of event;

Type of application that caused the event; and

User identity.
The date and time information is retrieved from the Operating system each
time an event message is created. The User ID is gained from the process
message descriptor. The Type of event in this case is authorisation failure.
Viewing of the audit records is performed via a third party application.
The possible types of application are listed in [InfoCenter topic fr19070]
Audit.3
6.1.3
TOE Protection
TP.1
7
The event queues will be protected to prevent unauthorised modification and
deletion of audit records. This is done in the same way as all other queues (see
AC.1) with only the administrator (member of mqm group) being able to
access the queue. Queue administration is performed using the MQSC
commands, which are initialised by entering the runmqsc control command at
the administrative interface.
The TSF shall ensure that WMQ channels from WMQ clients to a WMQ
server, or between two WMQ servers, are established using a TLS
CipherSuite listed in section 2.0. The TLS support provided by WMQ
provides authentication, message integrity checking, and data encryption for
transmitted data.
Rationale
This chapter presents the evidence used in the ST evaluation and supports the claims that
the ST is a complete and cohesive set of requirements.
7.1
Correlation of Threats, Policies, Assumptions and
Objectives
The following table provides a correspondence of the threats, policies, assumptions and
objectives:
© Copyright IBM 2012
Page 32
x
T.CHANNEL
x
T.OS
x
x
x
x
x
A.OS
x
x
x
x
x
x
x
x
x
x
x
A.PROTECT
x
A.ADMIN
x
x
Security Objectives Rationale
This section demonstrates that the security objectives stated in section 4 of this ST are
traceable to all of the aspects identified in the Security Problem Definition and are
suitable to cover them.
7.2.1
Threats
This section provides evidence demonstrating coverage of the threats by both the IT and
non-IT security objectives.
[T.ACCESS_RES]
An authorised user of the TOE gains access to an object without the correct authority to
access that object.
The objective O.ACCESS counters this directly by ensuring that only those users with the
correct authority can access an object. This is supported by O.MANAGE, which ensures
that privileged actions are performed effectively. The O.PROTECT objective supports
© Copyright IBM 2012
O.RECOVER
x
x
x
O.OS
O.CONFIG
O.ADMIN
O.TIME
O.TOE_PROTECTION
x
x
T.ROLE
7.2
x
x
T.ACCESS_TOE
P.ACCESS
x
O.ROLE
x
O.IDENTIFY
x
x
O.AUDIT
T.ACCOUNT
O.PROTECT
x
O.MANAGE
T.ACCESS_RES
O.ACCOUNT
O.ACCESS
Objectives:
Page 33
x
O.ACCESS in countering the threat by ensuring that data transferred between platforms
is secured.
[T.ACCOUNT]
Unauthorised attempts to access objects for which the user has no authority go
undetected.
Recording unsuccessful attempts to access objects is performed by O.ACCOUNT.
O.IDENTIFY supports this objective by ensuring that all users are identified before they
access the TOE and the identity can be used on making access decisions.
O.MANAGE further supports this by ensuring that the administrator manages the event
messaging security functions effectively. O.TIME ensures that the time information
recorded for each event is accurate. O.AUDIT ensures the administered has a tool to
review the audit trail and the tool is protected.
[T.CHANNEL]
Data transferred between platforms is disclosed to, or modified by unauthenticated users
or processes, either directly or indirectly.
The TOE ensures that data transferred between platforms i.e. along network cabling, is
suitably protected against physical or other (e.g. Sniffing) attacks that may result in the
disclosure, modification or delay of information transmitted between platforms. Objective
O.PROTECT ensures that this is achieved. O.OS ensures that the protocols used in the
transmission of data have been correctly configured within the operating systems.
[T.ACCESS_TOE]
An unidentified user gains access to the TOE and it’s objects.
O.IDENTIFY is the primary objective that counters this threat, by ensuring that all users
are identified. The environmental objective O.CONFIG supports O.IDENTIFY in
countering the threat by ensuring that all users have a valid and unique identity.
[T.ROLE]
A non-privileged user gains administrative privileges.
Only those users with the correct authority can invoke administrative privileges. O.ROLE
ensures that the users are associated with roles so enable the efficient management of
administrative users, and maintains an administrative role in order that the TOE can be
managed. This relies upon O.IDENTIFY and O.CONFIG, which ensure that each user is
identified. O.MANAGE ensures that only authorized users can effectively manage the
TOE.
[T.OS]
The operating system on which the TOE is installed becomes compromised.
© Copyright IBM 2012
Page 34
It is essential that the administrator manage the operating system in a secure manner so
that vulnerabilities do not exist, which may lead to compromise of the TOE. The
objectives O.OS, O.CONFIG and O.PROTECT all ensure that the operating system is
managed in a secure manner. O.ADMIN further supports this threat by ensuring that the
administrator is a competent individual that will apply the latest patch information and
therefore ensuring that any vulnerabilities to the TOE that become known are be
countered by application of the relevant patch.
7.2.2
Security Policy
This section provides evidence demonstrating coverage of the organisational security
policy by both the IT and non-IT security objectives.
[P.ACCESS]
The right to access a specific object is determined on the basis of:

The identity of the subject attempting to access the object; or

Membership of a group that has access rights to the object.
This policy is implemented through the objective O.ACCESS, which provides the means
of controlling access to objects by users and processes. O.MANAGE supports this policy
by the administrators ensuring that the policy is maintained.
The following environmental objectives further support the policy:

7.2.3
O.ADMIN, O.CONFIG and O.OS all ensure that the operating system is
configured in a secure manner so that no vulnerability may exist that enables an
unauthorised user to gain an authorised identity.
Assumptions
This section provides evidence demonstrating coverage of the assumptions by both the IT
and non-IT security objectives.
[A.OS]
It is assumed that the operating system of each system within the TOE, including any
failover backup servers and any shared resources such as remote filesystems, has been
configured in accordance with the manufacturer’s installation guides and where
applicable, in its evaluated configuration. It is securely configured such that the
operating system protects the TOE from any unauthorised users or processes.
O.OS is the primary environmental objective that satisfies the assumption. This ensures
that the administrator installs and configures the supporting operating systems in
accordance with:

© Copyright IBM 2012
The manufacturers instructions; and
Page 35

Any evaluated configurations were applicable.
O.ADMIN and O.CONFIG supports this by ensuring that the Administrator is a
competent and trustworthy person and that the users have been set up appropriately.
O.RECOVER ensures that following a system failure, the TOE is not operating in an
insecure state whereby an unauthorised user can gain access to objects they are not
authorised to access. O.TIME ensures that the time provided by the OS is accurate and
reliable. The O.TOE_PROTECTION objective ensures other operating system protects
the TOE from any unauthorised users or processes.
[A.PROTECT]
It is assumed that all software and hardware, including peripheral devices, have been
approved for the transmittal of data. Such items are to be physically protected against
threats to the confidentiality and integrity of the data.
The objective O.OS ensures that the underlying OS is installed and configured properly.
O.ADMIN ensures the administrators are capable of selecting and managing the OS such
that is the evaluated OS and can handle the transmittal of data.
[A.ADMIN]
It is assumed that there are one or more competent individuals that are assigned to
manage the TOE and the security of the information it contains. Such personnel are
assumed not to be careless, wilfully negligent or hostile.
O.ADMIN is the primary objective that meets this assumption, which ensures that the
administrator is a competent and trustworthy person whom is capable of managing the
TOE in a secure manner.
7.3
Security Requirements Rationale
7.3.1
Security Functional Requirements Rationale
This section demonstrates that the functional components selected for the TOE provide
complete coverage of the defined security objectives. The mapping of components to
security objectives is illustrated in the table below.
Security Objective
O.ACCESS
Functional Component
Subset Access Control (FDP_ACC.1)
Security Attribute Based Access Control (FDP_ACF.1)
Management of Security Attributes (FMT_MSA.1)
Static Attribute Initialisation (FMT_MSA.3)
Audit Data Generation (FAU_GEN_MQ.1)
© Copyright IBM 2012
Page 36
Security Objective
O.ACCOUNT
Functional Component
User Identity Association (FAU_GEN.2)
Protected Audit Trail Storage (FAU_STG.1)
Management of TSF Data (FMT_MTD.1)
O.MANAGE
Management of Security Attributes (FMT_MSA.1)
Static Attribute Initialisation (FMT_MSA.3)
Management of TSF Data (FMT_MTD.1)
Specification of Management Functions (FMT_SMF.1)
[O.ACCESS]
The TOE must ensure that only those users with the correct authority are able to access
an object.
The access control mechanism must have a defined scope of control [FDP_ACC.1] with
defined rules [FDP_ACF.1]. Authorised users must be able to control who has access to
the objects [FMT_MSA.1]. Protection of these objects must be continuous, starting from
object creation [FMT_MSA.3]
[O.ACCOUNT]
The TOE must provide a means of recording any unsuccessful access attempts to the
objects.
Security relevant actions must be defined, auditable [FAU_GEN_MQ.1] and capable of
being associated with individual users [FAU_GEN.2]. The event queue must be protected
so that only authorised users can access it [FAU_STG.1]. An authorised administrator
must be able to manage the event queue [FMT_MTD.1].
[O.MANAGE]
The TOE must allow administrators to effectively manage the TOE and that this is only
performed by authorised users.
The TSF must enable an authorised administrator to manage the TOE by the access
control policy objects [FMT_MSA.1] with default values [FMT_MSA.3]. The
administrator must be able to manage the event queue [FMT_MTD.1] and the access
control list [FMT_MSA.1]. [FMT_SMF.1] specifies the management functions provided
by the TOE.
7.3.2
Security Assurance Requirements Rationale
This ST contains assurance requirements from the CC EAL2 assurance package.
© Copyright IBM 2012
Page 37
The EAL chosen is based on the impact that the statements of the security environment
and objectives within this ST have on the assurance level. The administrator shall be
capable of managing the TOE such that the security is maintained (O.ADMIN)
particularly within the operating system that the TOE relies (O.OS). This EAL level also
provides a resistance to penetration attackers with a low attack potential.
Given the amount of assurance required to meet the TOE environment and the intent of
EAL2, this assurance level was considered most applicable for the TOE described within
this ST.
7.4
SFR Dependencies
x
FAU_GEN_MQ.1
FAU_GEN.2
x
FAU_STG.1
x
x
x
FDP_ACC.1
FDP_ACF.1
x
FMT_MSA.1
x
x
x
x
FMT_MSA.3
x
x
x
FMT_MTD.1
FPT_ITT.1
dependencies)
FPT_STM.1
FMT_SMR.1
FMT_SMF.1
FMT_MSA.3
FMT_MSA.1
FIA_UID.1
FDP_ACF.1
FDP_ACC.1
FCS_CKM.4
FCS_CKM.1
FAU_GEN.1*
The below table identifies all of the dependencies of the SFRs included in the ST. Only
those SFRs that have a dependency, or are depended upon are shown in the table.
x
(no
The key to the symbols used, are:
x required dependency
o optional dependency
As shown in [CC], all dependencies are satisfied by the TOE, with the exception of the
dependencies on FIA_UID.1, FMT_SMR.1 and FPT_STM.1. These dependencies are
met by functionality provided in the IT environment of the TOE.
© Copyright IBM 2012
Page 38
FIA_UID.1 is addressed by objective O.IDENTITY where the Operating system provides
the TOE with the user IDs
The TOE does not ‘maintain’ an administrator role (FMT_SMR.1) or internal clock
(FPT_STM.1), but relies upon the operating system to maintain the role and clock.
Identification of the administrator is based on membership of the mqm or administrators
group defined within the operating system. O.ROLE ensures the operating system will
proide roles to the TOE and O.TIEM ensures timestamps are provided.
* The reliance on the requirements FAU_GEN.1 is countered by the extended
requirement FAU_GEN_MQ.1, which records auditing details. In turn, the extended
requirement assumes the dependencies on FAU_GEN.1 as shown in the above table.
© Copyright IBM 2012
Page 39
7.5
TOE Summary Specification Rationale
This section demonstrates that the TOE security functions and assurance measures are
suitable to meet the TOE security requirements.
7.5.1
TSF correspondence to SFRs
This section demonstrates that the combination of the specified TSFs work together so
that the SFRs are satisfied. The table below shows the TOE security functions, which
together satisfy each SFR element. For a detailed description of how the SFR relates to
the security function, refer to appropriate section in Section 6.
© Copyright IBM 2012
TOE SFR
TSFs
FAU_GEN_MQ.1.1
Audit.1
FAU_GEN_MQ.1.2
Audit.2
FAU_GEN.2.1
Audit.2
FAU_STG.1.1
Audit.3
FAU_STG.1.2
Audit.3
FDP_ACC.1.1A
AC.1
FDP_ACC.1.1B
AC.4
FDP_ACF.1.1A
AC.1
FDP_ACF.1.1B
AC.4
FDP_ACF.1.2A
AC.1
FDP_ACF.1.2B
AC.4
FDP_ACF.1.3A
AC.1
FDP_ACF.1.3B
AC.4
FDP_ACF.1.4A
AC.1
FDP_ACF.1.4B
AC.4
FMT_MSA.1.1A
AC.2
FMT_MSA.1.1B
AC.4
FMT_MSA.3.1A
AC.3
Page 40
© Copyright IBM 2012
TOE SFR
TSFs
FMT_MSA.3.1B
AC.5 and AC.6
FMT_MSA.3.2A
AC.3
FMT_MSA.3.2B
AC.6
FMT_MTD.1.1
AC.2
FMT_SMF.1.1
AC.1, AC.2 and AC.3
FTP_ITT.1.1
TP.1
Page 41