GB/T 18336.3-2015

GB/T 18336.3-2015 信息技术 安全技术 信息技术安全评估准则 第3部分：安全保障组件 （英文版）

Information technology—Security techniques—Evaluation criteria for IT security—Part 3: Security assurance components

2015-05-15

2016-01-01

275

10.00元

是

2,000.00元

Word/PDF

Contents
Foreword 1
INTRODUCTION 4
1 Scope 1
2 Normative references 1
3 Terms and definitions 1
4 Overview 1
4.1 organisation of this part 1
5 Assurance paradigm 2
5.1 ISO/IEC 15408 philosophy 2
5.2 Assurance approach 3
5.3 ISO/IEC 15408 evaluation assurance scale 5
6 Security assurance components 5
6.1 Security assurance classes, families and components structure 5
6.2 EAL structure 13
6.3 CAP structure 16
7 Evaluation assurance levels 19
7.1 Evaluation assurance level (EAL) overview 20
7.2 Evaluation assurance level details 21
7.3 Evaluation assurance level 1 (EAL1) - functionally tested 21
7.4 Evaluation assurance level 2 (EAL2) - structurally tested 22
7.5 Evaluation assurance level 3 (EAL3) - methodically tested and checked 24
7.6 Evaluation assurance level 4 (EAL4) - methodically designed, tested, and reviewed 25
7.7 Evaluation assurance level 5 (EAL5) - semiformally designed and tested 27
7.8 Evaluation assurance level 6 (EAL6) - semiformally verified design and tested 29
7.9 Evaluation assurance level 7 (EAL7) - formally verified design and tested 31
8 Composed assurance packages 32
8.1 Composed assurance package (CAP) overview 32
8.2 Composed assurance package details 35
8.3 Composition assurance level A (CAP-A) - Structurally composed 35
8.4 Composition assurance level B (CAP-B) - Methodically composed 36
8.5 Composition assurance level C (CAP-C) - Methodically composed, tested and reviewed 37
9 Class APE: Protection Profile evaluation 38
9.1 PP introduction (APE_INT) 39
9.2 Conformance claims (APE_CCL) 40
9.3 Security problem definition (APE_SPD) 43
9.4 Security objectives (APE_OBJ) 44
9.5 Extended components definition (APE_ECD) 46
9.6 Security requirements (APE_REQ) 48
10 Class ASE: Security Target evaluation 51
10.1 ST introduction (ASE_INT) 52
10.2 Conformance claims (ASE_CCL) 54
10.3 Security problem definition (ASE_SPD) 56
10.4 Security objectives (ASE_OBJ) 57
10.5 Extended components definition (ASE_ECD) 59
10.6 Security requirements (ASE_REQ) 61
10.7 TOE summary specification (ASE_TSS) 64
11 Class ADV: Development 66
11.1 Security Architecture (ADV_ARC) 75
11.2 Functional specification (ADV_FSP) 78
11.3 Implementation representation (ADV_IMP) 92
11.4 TSF internals (ADV_INT) 97
11.5 Security policy modelling (ADV_SPM) 102
11.6 TOE design (ADV_TDS) 106
12 Class AGD: Guidance documents 119
12.1 Operational user guidance (AGD_OPE) 120
12.2 Preparative procedures (AGD_PRE) 123
13 Class ALC: Life-cycle support 125
13.1 CM capabilities (ALC_CMC) 127
13.2 CM scope (ALC_CMS) 140
13.3 Delivery (ALC_DEL) 147
13.4 Development security (ALC_DVS) 149
13.5 Flaw remediation (ALC_FLR) 151
13.6 Life-cycle definition (ALC_LCD) 158
13.7 Tools and techniques (ALC_TAT) 161
14 Class ATE: Tests 166
14.1 Coverage (ATE_COV) 167
14.2 Depth (ATE_DPT) 170
14.3 Functional tests (ATE_FUN) 176
14.4 Independent testing (ATE_IND) 180
15 Class AVA: Vulnerability assessment 186
15.1 Application notes 186
15.2 Vulnerability analysis (AVA_VAN) 187
16 Class ACO: Composition 194
16.1 Composition rationale (ACO_COR) 199
16.2 Development evidence (ACO_DEV) 200
16.3 Reliance of dependent component (ACO_REL) 205
16.4 Composed TOE testing (ACO_CTT) 208
16.5 Composition vulnerability analysis (ACO_VUL) 213
Annex A (Informative) Development (ADV) 218
Annex B (Informative) Composition (ACO) 248
Annex C (Informative) Cross reference of assurance component dependencies 260
Annex D (Informative) Cross reference of PPs and assurance components 265
Annex E (Informative) Cross reference of EALs and assurance components 266
Annex F (Informative) Cross reference of CAPs and assurance components 267

GB/T 18336.3 英文版 English Version