Zte ZXR10 M6000 Series - TOE Access; User Data Protection

Chapter6TOESUMMARYSPECIFICATION
executecommandsallowedbyhisprivilegelevelandcannotexecutecommandsofhigher
level.
6.1.4TOEAccess
Mechanismsplacecontrolsonadministrator’ssessions.Localandremoteadministrator’s
sessionsaredroppedafteranAdministrator-denedtimeperiodofinactivity.Droppingthe
connectionofalocalandremotesession(afterthespeciedtimeperiod)reducestherisk
ofsomeoneaccessingthelocalandremotemachineswherethesessionwasestablished,
thusgainingunauthorizedaccesstothesession.
lFTA_SSL.3TSF-initiatedtermination
TheTOEallowsconguringlogincontrolparametersforconsoleandremoteadministration
sessions.
TheTOEhastheabilitytoterminatestaleconnections.TheTOEterminatesinteractive
sessionafteranadministratordenedperiodofinactivitywithadefaultvalueof2minutes,
andwithinarangeof1to1000minutes.AndtheTOEcanconguremandatorytermination
absolute-timewithinfrom1to10000minuteswithadefaultvalueof1440minutes.
Thisidle-timeparametercongurestheidletimeoutforconsole,orremotesessionsbefore
thesessionisterminatedbythesystem.Theidle-timeandabsolute-timewouldreduce
thechancefortheunauthorizedadministratorstoaccesstheTOEthroughanunattended
openedsession.Bydefault,anidleconsole,orremotesessiontimesoutafter2minutes
ofinactivity.Thistimerissetforallsession.
lFTA_TSE.1TOEsessionestablishment
TheTOEwilldenysessionestablishmentafterthecongurednumber(1~15)ofactive
sessionsisreached.AnadministratorcancongureACLstorefusetoestablishmentofa
connection,toensureonlyconnectionsfromtrustedaddressorportistrustable.
TheTOEhasadirectconnectionviathephysicalRS232consoleinterfaceandaremote
consoleconnectiontoperformsecuritymanagementfunctions.
6.1.5Userdataprotection
TheTOEprovidesanInformationFlowControlmechanismthatsupportscontrolofthe
owoftrafcgeneratedbythenetworkdevices.TheInformationFlowControlPoliciesare
conguredoneachnetworkdevicestoallowtrafctoonlyowbetweentheauthorized
sourcesandauthorizeddestinations.AlsotheTOEprovideexportinglogtoSYSLOGand
SNMPservers.
lFDP_IFC.1(1)Subsetinformationowcontrol(unauthenticatedpolicy)
TheTOEenforcesanUNAUTHENTICATEDSFPwherebythenetworkpacketssentand/or
receivedthroughtheTOEtoITentity.
lFDP_IFC.1(2)Subsetinformationowcontrol(exportpolicy)
6-7
SJ-20110815105844-030|2011/08/19（R1.6）ZTECORPORATION