Alcatel-Lucent FIPS 140-2 Non-Proprietary Security Policy - National

27 Pages·2008·0.46 MB·English

Alcatel-Lucent

Alcatel-Lucent VPN Firewall Bricks
1200 AC, 1200HS AC, and 1200 HS DC

Hardware Versions: 1200 AC, 1200HS AC, and 1200HS DC; Firmware Version: 9.1.299

FIPS 140-2
Non-Proprietary Security Policy

Level 2 Validation

Document Version 3.1

Prepared for: Prepared by:

Alcatel-Lucent Corsec Security, Inc.
600-700 Mountain Avenue 10340 Democracy Lane, Suite 201
Murray Hill, NJ 07974 Fairfax, VA 22030
Phone: [phone] Phone: [phone]
http://www.alcatel-lucent.com http://www.corsec.com
© 2008 Alcatel-Lucent
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Non-Proprietary Security Policy, Version 3.1 July 11, 2008

Revision History
Version Date Modified By Description of Changes
1.0 2007-05-01 Ben Greenberg Initial Version
1.1 2007-06-15 Xiaoyu Ruan Revision
1.2 2007-07-19 Xiaoyu Ruan Added figure of temper-evidence label
1.3 2007-08-06 Xiaoyu Ruan Addressed Lab’s comments
1.4 2007-09-11 Xiaoyu Ruan Addressed Lab’s comments
1.5 2007-09-13 Xiaoyu Ruan Addressed Lab’s comments
1.6 2007-09-14 Xiaoyu Ruan Addressed Lab’s comments
1.7 2007-09-14 Xiaoyu Ruan Addressed Lab’s comments
1.8 2007-10-01 Xiaoyu Ruan Addressed Lab’s comments
1.9 2007-10-17 Darryl Johnson Added instructions for tamper-evident label placement in Section 2.6.
2.0 2007-10-18 Xiaoyu Ruan 2.5.1
2.1 2007-10-19 Darryl Johnson Added more instructions for tamper-evident label placement in
Xiaoyu Ruan Section 2.6.
2.2 2007-10-22 Xiaoyu Ruan Addressed Lab’s comments
2.3 2007-10-23 Xiaoyu Ruan Authentication strength
2.4 2007-10-23 Darryl Johnson Tamper-evident label placement
2.5 2007-11-13 Xiaoyu Ruan Addressed Lab’s comments
2.6 2007-12-20 Xiaoyu Ruan Addressed Lab’s comments
2.7 2008-01-04 Xiaoyu Ruan Algorithm certificate numbers
2.8 2008-01-18 Xiaoyu Ruan Version 9.1.299
3.0 2008-06-09 Xiaoyu Ruan Addressed CMVP comments
3.1 2008-07-11 Xiaoyu Ruan Added Sections 3.6 and 3.7
Alcatel-Lucent VPN Firewall Bricks 1200 AC, 1200HS AC, and 1200 HS DC Page 2 of 27
© 2008 Alcatel-Lucent
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Non-Proprietary Security Policy, Version 3.1 July 11, 2008

Table of Contents
1 INTRODUCTION...............................................................................................................................................6
1.1 PURPOSE.........................................................................................................................................................6
1.2 REFERENCES...................................................................................................................................................6
1.3 DOCUMENT ORGANIZATION...........................................................................................................................6
2 ALCATEL-LUCENT VPN FIREWALL BRICKS 1200 AC, 1200HS AC, AND 1200 HS DC....................7
2.1 OVERVIEW......................................................................................................................................................7
2.2 LUCENT SECURITY MANAGEMENT SERVER....................................................................................................8
2.3 CRYPTOGRAPHIC MODULES SPECIFICATION...................................................................................................8
2.4 MODULE INTERFACES.....................................................................................................................................9
2.4.1 Brick 1200..............................................................................................................................................9
2.5 ROLES AND SERVICES...................................................................................................................................10
2.5.1 Crypto Officer Role..............................................................................................................................10
2.5.2 User Role.............................................................................................................................................13
2.5.3 Authentication......................................................................................................................................13
2.5.4 Bypass Mode........................................................................................................................................14
2.6 PHYSICAL SECURITY....................................................................................................................................14
2.6.1 Brick 1200............................................................................................................................................15
2.7 OPERATIONAL ENVIRONMENT......................................................................................................................17
2.8 CRYPTOGRAPHIC KEY MANAGEMENT..........................................................................................................17
2.8.1 Cryptographic Algorithms...................................................................................................................17
2.8.2 CSPs.....................................................................................................................................................18
2.8.3 CSP Zeroization...................................................................................................................................21
2.9 SELF-TESTS..................................................................................................................................................21
2.10 MITIGATION OF OTHER ATTACKS.................................................................................................................21
3 SECURE OPERATION....................................................................................................................................22
3.1 INITIAL SETUP..............................................................................................................................................22
3.1.1 Installing the Brick...............................................................................................................................22
3.1.2 Setting up LSMS...................................................................................................................................22
3.2 MODULE INITIALIZATION AND CONFIGURATION..........................................................................................22
3.2.1 Configuring LSMS-Brick Communication...........................................................................................22
3.2.2 Initializing the Brick............................................................................................................................22
3.2.3 Configuring the Brick Serial Port........................................................................................................23
3.3 IPSEC REQUIREMENTS AND CRYPTOGRAPHIC ALGORITHMS........................................................................23
3.3.1 IPsec/IKE Requirements......................................................................................................................23
3.3.2 External CA Requirements...................................................................................................................24
3.3.3 Configuring LAN-LAN Tunnels...........................................................................................................24
3.3.4 Configuring Client Tunnels.................................................................................................................24
3.4 ZEROIZING KEYS AND CSPS.........................................................................................................................24
3.5 IDENTIFYING THE ERROR STATE...................................................................................................................25
3.6 MAINTAINING PHYSICAL SECURITY.............................................................................................................25
3.7 DETERMINING THE FIPS MODE OF OPERATION............................................................................................25
4 ACRONYMS......................................................................................................................................................26
Alcatel-Lucent VPN Firewall Bricks 1200 AC, 1200HS AC, and 1200 HS DC Page 3 of 27
© 2008 Alcatel-Lucent
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Non-Proprietary Security Policy, Version 3.1 July 11, 2008

Table of Figures
FIGURE 1 – ALCATEL-LUCENT VPN FIREWALL BRICK DEPLOYMENT...........................................................................7
FIGURE 2 – BRICK 1200..................................................................................................................................................9
FIGURE 3 – CRYPTO OFFICER LABEL PLACEMENT FOR THE REAR OF THE BRICK 1200................................................15
FIGURE 4 – CRYPTO OFFICER LABEL PLACEMENT FOR THE FRONT OF THE BRICK 1200..............................................15
FIGURE 5 – CRYPTO OFFICER LABEL PLACEMENT FOR THE TOP OF THE BRICK 1200...................................................16

Alcatel-Lucent VPN Firewall Bricks 1200 AC, 1200HS AC, and 1200 HS DC Page 4 of 27
© 2008 Alcatel-Lucent
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Non-Proprietary Security Policy, Version 3.1 July 11, 2008

List of Tables
TABLE 1 – SECURITY LEVEL PER FIPS 140-2 SECTION...................................................................................................8
TABLE 2 – MAPPING OF FIPS 140-2 LOGICAL INTERFACES TO BRICK 1200 INTERFACES.............................................10
TABLE 3 – CRYPTO OFFICER SERVICES........................................................................................................................11
TABLE 4 – USER SERVICES...........................................................................................................................................13
TABLE 5 – BRICK 1200 LABEL PLACEMENT GUIDANCE...............................................................................................16
TABLE 6 – ACRONYMS.................................................................................................................................................26

Alcatel-Lucent VPN Firewall Bricks 1200 AC, 1200HS AC, and 1200 HS DC Page 5 of 27
© 2008 Alcatel-Lucent
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Non-Proprietary Security Policy, Version 3.1 July 11, 2008

1 Introduction
1.1 Purpose
This is a non-proprietary Cryptographic Module Security Policy for the Alcatel-Lucent VPN Firewall Bricks 1200
AC, 1200HS AC, and 1200 HS DC (Hardware versions: 1200 AC, 1200HS AC, and 1200HS DC; Firmware
version: 9.1.299) from Alcatel-Lucent. This Security Policy describes how the Alcatel-Lucent VPN Firewall Bricks
1200 AC, 1200HS AC, and 1200 HS DC meet the security requirements of FIPS 140-2 and how the modules are run
in a secure FIPS 140-2 mode. This policy was prepared as part of the Level 2 FIPS 140-2 validation of the modules.
FIPS 140-2 (Federal Information Processing Standards Publication 140-2 – Security Requirements for
Cryptographic Modules) details the U.S. and Canadian Government requirements for cryptographic modules. More
information about the FIPS 140-2 standard and validation program is available on the National Institute of Standards
and Technology (NIST) Cryptographic Module Validation Program (CMVP) website at:
http://csrc.nist.gov/groups/STM/index.html.
The Alcatel-Lucent VPN Firewall Bricks 1200 AC, 1200HS AC, and 1200 HS DC are referred to in this document
as the Bricks, the cryptographic modules, or the modules.
1.2 References
This document deals only with operations and capabilities of the modules in the technical terms of a FIPS 140-2
cryptographic module security policy. More information is available on the modules from the following sources:
• The Alcatel-Lucent website (http://www.alcatel-lucent.com) contains information on the full line of
products from Alcatel-Lucent.
• The CMVP website (http://csrc.nist.gov/groups/STM/index.html) contains contact information for answers
to technical or sales-related questions for the modules.
1.3 Document Organization
The Security Policy document is one document in a FIPS 140-2 Submission Package. In addition to this document,
the Submission Package contains:
• Vendor Evidence document
• Finite State Machine
• Other supporting documentation as additional references
This Security Policy and the other validation submission documentation were produced by Corsec Security, Inc.
under contract to Alcatel-Lucent. With the exception of this Non-Proprietary Security Policy, the FIPS 140-2
Validation Documentation is proprietary to Alcatel-Lucent and is releasable only under appropriate non-disclosure
agreements. For access to these documents, please contact Alcatel-Lucent.
Alcatel-Lucent VPN Firewall Bricks 1200 AC, 1200HS AC, and 1200 HS DC Page 6 of 27
© 2008 Alcatel-Lucent
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Non-Proprietary Security Policy, Version 3.1 July 11, 2008

2 Alcatel-Lucent VPN Firewall Bricks 1200 AC, 1200HS AC,
and 1200 HS DC
2.1 Overview
The Alcatel-Lucent Virtual Private Network (VPN) Firewall Brick product line offers a broad range of enterprise
and carrier-class security solutions to protect corporate and service provider networks delivering mission-critical
Internet Protocol (IP) applications to headquarter employees, branch offices, trading partners, road warriors and
customers. Alcatel-Lucent VPN Firewall solutions can help stretch Information Technology (IT) budgets with
superb price and performance and a low total cost of ownership. Leading-edge technology can simplify deployment
and management of diverse applications including:

• Advanced security services
• VPN services for site-to-site and remote access
• Bandwidth management capabilities
• Secure data center, web and application hosting
• Storage network secure solution
• Mobile data security
• Packet Data Gateway and Packet Data Interworking
• Functions for Dual-Mode Wireless/WiFi VPN and VoIP/Data Security
The Lucent VPN Firewall Bricks deliver the performance needed to provide vital security and VPN services for
thousands of enterprise users. High-capacity packet processing capabilities help maximize user efficiency and
productivity with up to 1.7 Gbps VPN throughput and a full 4.75 Gbps firewall throughput. A general deployment
scenario for the Bricks is depicted in Figure 1 below. All administration of the Bricks is performed by the Lucent
Security Management Server (LSMS) software which is described in Lucent Security Management Server 1.2.

Figure 1 – Alcatel-Lucent VPN Firewall Brick Deployment
Alcatel-Lucent VPN Firewall Bricks 1200 AC, 1200HS AC, and 1200 HS DC Page 7 of 27
© 2008 Alcatel-Lucent
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Non-Proprietary Security Policy, Version 3.1 July 11, 2008

2.2 Lucent Security Management Server
The LSMS is a component to any VPN Firewall Brick deployment. All administration of the Bricks is performed via
the LSMS. The operators should identify the firmware version of the Brick and use a compatible version of LSMS.
The LSMS software provides advanced carrier-grade IP services management at a low total ownership cost.
Teaming with Lucent’s award-winning VPN Firewall Brick® portfolio, Lucent Security Management Server lets
administrators rapidly provision and manage high-return services for thousands of users in a single console. It
integrates firewall, VPN, Quality of Service (QoS), Virtual Local Area Network (VLAN) and virtual firewall policy
management; provides industry-leading scalability and availability; delivers robust monitoring, logs and reports; and
gives you flexible deployment options – all without the costly additional modules or recurring license fees that
competitive products require.
The LSMS provides the following features:
• Fully integrates firewall, VPN, QoS, VLAN, and virtual firewall management
• Comprehensive remote management capabilities with role-based administration
• Flexible management model: controls policies at global, customer, device, interface, VLAN and IP address
range levels
• High scalability: supports 20,000 Lucent VPN Firewall Brick units and up to 500,000 simultaneously
connected VPN users from one Lucent Security Management Server console.
• Carrier-class reliability: distributable across up to four network operations centers (NOCs) for active/active
network redundancy with no single point of failure
• Real time monitoring, robust logging, and customized reporting
• Multiple IP services deployment options: premises-based, network-based, tiered, and data-center
architectures

Note that the LSMS software is not included as part of this FIPS 140-2 validation.
2.3 Cryptographic Modules Specification
The Alcatel-Lucent VPN Firewall Bricks 1200 AC, 1200HS AC, and 1200 HS DC are considered to be multi-chip
standalone cryptographic modules and are validated at the following levels for each FIPS 140-2 Section:
Table 1 – Security Level per FIPS 140-2 Section
Section Section Title Level
1 Cryptographic Module Specification 2
2 Cryptographic Module Ports and Interfaces 2
3 Roles, Services, and Authentication 2
4 Finite State Model 2
5 Physical Security 2
6 Operational Environment N/A
7 Cryptographic Key Management 2
8 Electromagnetic Interference (EMI) / Electromagnetic Compatibility (EMC) 2
9 Self-tests 2
10 Design Assurance 2
Alcatel-Lucent VPN Firewall Bricks 1200 AC, 1200HS AC, and 1200 HS DC Page 8 of 27
© 2008 Alcatel-Lucent
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Non-Proprietary Security Policy, Version 3.1 July 11, 2008

Section Section Title Level
11 Mitigation of Other Attacks N/A
The Bricks come in a rack mounted form factor. The Brick 1200 models are intended to be installed on a standard
19-inch rack. The Brick measures 17″ (W) x 17.75″ (D) x 7″ (H). The Brick 1200 has three variations:
• Brick 1200 AC – Standard Brick 1200 with AC power
• Brick 1200HS AC – High Speed Brick 1200 with AC power
• Brick 1200HS DC – High Speed Brick 1200 with DC power

Figure 2 – Brick 1200
2.4 Module Interfaces
The Alcatel-Lucent VPN Firewall Bricks 1200 AC, 1200HS AC, and 1200 HS DC are multi-chip standalone
modules that meet overall level 2 FIPS 140-2 requirements. The cryptographic boundary of the Alcatel-Lucent VPN
Firewall Bricks 1200 AC, 1200HS AC, and 1200 HS DC is defined by the hard metal chassis of the Bricks.
2.4.1 Brick 1200
The following is a list of the physical ports and interfaces of the Brick 1200.
• Ethernet ports (x10 on the 1200 / x20 on the 1200HS)
• Serial port (console)
• USB ports (x4)
• Monitor port
• PS/2 Keyboard port
• LEDs
• Audio Alarm Cut Off switch
• Alarm connector
• Power connector
• Power switch
The front of the model 1200 Brick device has a power switch on the left, a chassis fan filter replacement panel, LED
activity lights and two USB. Note that the USB connectors are covered by tamper-evident labels. The use of USB
connectors are not allowed when in FIPS-Approved mode of operation. The front bezel contains three activity lights.
The behavior of the activity lights are as follows:
• The power (PWR) light turns solid green when the Brick device is powered on (by the switch in the rear).
Alcatel-Lucent VPN Firewall Bricks 1200 AC, 1200HS AC, and 1200 HS DC Page 9 of 27
© 2008 Alcatel-Lucent
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Non-Proprietary Security Policy, Version 3.1 July 11, 2008

• The FlashDisk Activity (FD Act) light turns green (usually momentarily) when I/O on the FlashDisk is
performed.
• An Encryption Accelerator Activity (EA Act) light turns solid green after the Encryption Accelerator Card
(EAC) passes its internal diagnostics and self-tests. It flashes when performing cryptographic processing
This LED is only present on AC models with an EAC.
In addition to the three activity lights described above, the DC version of the Model 1200 Brick also has a Fault
light, which is amber when power is lost to the A or B power connector.
The rear panel of the Brick 1200 device has two hot swappable redundant power supplies. The rear also contains a
keyboard port, a monitor port and the console port. The Brick 1200HS has 14 10/100/1000 Base-TX ports and 6
GigE mini-GBIC (Gigabit Interface Converter) SFP (Small Form-factor Pluggable) ports. The Brick 1200 has 8
10/100/1000 Base-TX ports and 2 GigE mini-GBIC SFP ports.
The following table maps the Brick 1200 interfaces to the FIPS 140-2 logical interfaces.
Table 2 – Mapping of FIPS 140-2 Logical Interfaces to Brick 1200 Interfaces
FIPS 140-2 Logical Interface Brick 1200 Port/Interface
Data Input Ethernet ports
Data Output Ethernet ports
Control Input Ethernet ports, serial port, keyboard port, power
switch, Audio Alarm Cut Off switch
Status Output Ethernet ports, serial port, monitor port, alarm
connector, LEDs
Power Power connector
2.5 Roles and Services
The Bricks support role-based authentication. There are two roles in the modules (as required by FIPS 140-2) that
operators may assume: a Crypto Officer role and a User role.
2.5.1 Crypto Officer Role
Whenever a Crypto Officer makes a change to information in the LSMS that affects a configured Brick, that change
has to be applied to the affected Brick. Although the changes may be saved in the LSMS database, they will not take
effect until they are applied to the device.
As a general rule, a Crypto Officer has to apply any updated information that has been downloaded to a Brick. For
example, Brick zone rulesets are assigned to Brick ports; if a Crypto Officer assigns a new ruleset to a port, then that
change has to be applied to the Brick.
Similarly, if a Crypto Officer adds a new rule to a ruleset, or changes an existing rule, then that change has to be
applied to every Brick to which the ruleset has been assigned.
If a Crypto Officer creates a new Brick zone ruleset, then it is applied automatically when the Crypto Officer applies
the ruleset assignment.
Alcatel-Lucent VPN Firewall Bricks 1200 AC, 1200HS AC, and 1200 HS DC Page 10 of 27
© 2008 Alcatel-Lucent
This document may be freely reproduced and distributed whole and intact including this copyright notice.