Nubo Software Thin Client Common Criteria Addendum. Document Version: 1.2. Copyright 2018 by Nubo Inc. All rights reserved

Transcription

1 Nubo Software Thin Client Common Criteria Addendum Document Version: 1.2

2 Contents 1. Introduction Document Purpose and Scope Installation/Update Verifying Product Versioning Register and activate your account Secure Communications Nubo Management Server Communications TLS Configuration Digital Certificates Revocation Checking Resource Usage Evaluated Functionality... 11

3 1. Introduction Nubo to its core is a high-security mobility solution. We designed and implemented security from the ground up to achieve the maximum level of security. Our design principles that are unique to the Nubo platform, and the Virtual Mobile Infrastructure (VMI) technology set it apart from other Enterprise IT solutions. This includes the Nubo Player s Device as a Display as well as One Flat Protocol, which are leveraged to safeguard data while affording your employees the utmost freedom Document Purpose and Scope This document describes the installation and Common Criteria evaluation related usage of the Nubo Software Thin Client for Android. Specifically, it applies to Nubo Software Thin Client version 2.0 running on Android on either Samsung Galaxy S7 or S7 Edge (NIAP VID10739). This guide will show you how to download/register the Nubo remote workspace app and operate the software in a Common Criteria compliant manner. You will learn how to: Register for and activate Nubo: o Download and register for Nubo o Activate your account o Authenticate your username and password o Select your passcode o Log in to Nubo Identify the Nubo Management Server of choice

4 2. Installation/Update You can download the Nubo app from the Google Play store on your device. You may also download and install/updatel Nubo to your mobile device from any online browser on your laptop or desktop via the Google Play web site Verifying Product Versioning The version of the Nubo Software Thin Client is verified using the following steps, Press down on the installed icon. Drag the app to the App Info button in the upper left of the screen. The version will be shown next to the name of the app.

5 3. Register and activate your account Please follow these steps to register your account and activate Nubo on your device: Once you have installed the Nubo app on your device, launch the application for the first time. A welcome screen will appear asking you to create a user (Note: This is an account with the Nubo Management Server not a locally stored account): Tap the Create a User button. You will be taken to a registration screen. NOTE: The registration contains a warning stating that the information on the page will be transmitted over the network via a secure channel.

6 Enter the registration details on the form: o First Name o Last Name o Job Title o Work address Once you ve filled out the form, tap the Create a User button. The next screen will notify you that an activation link has been sent to your address. Go to your inbox and open the from Nubo Support about how to create a player. Tap the activation link provided. You will receive a notification on your device home screen that your device has been activated.

7 Once your device is activated, you can now sign into Nubo for the first time.

8 4. Secure Communications 4.1. Nubo Management Server Communications The Nubo Software Thin Client supports secure communications with a remote Nubo Management Server. All communications between the Nubo Management Server and the TOE are secure via TLS. Configuration requires a single configuration. Please follow the following step to configure the target Nubo Management Server. Access the Nubo Management Server configuration screen by tapping and holding the Nubo Logo on the initial screen. Complete the Management Server IP address/host name 4.2. TLS Configuration Aside from identifying the target Nubo Management Server, there are no additional configurations needed for TLS communications. The following TLS ciphersuites are supported:

9 TLS_RSA_WITH_AES_128_CBC_SHA as defined in RFC 5246 TLS_RSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5246 TLS_DHE_RSA_WITH_AES_128_CBC_ SHA256 as defined in RFC 5246 TLS_DHE_RSA_WITH_AES_256_CBC_ SHA256 as defined in RFC 5246 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5289 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 as defined in RFC 5289 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 as defined in RFC 5289 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 as defined in RFC 5289 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 as defined in RFC 5289 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 as defined in RFC 5289 TLS_ECDHE_ECDSA_AES_128_CBC_SHA256 as defined in RFC 5289 TLS_ECDHE_ECDSA_AES_256_CBC_SHA384 as defined in RFC 5289 Additionally, the following Elliptic Curve Extension are supported, secp256r1 secp384r1 secp521r1 Again, no additional configuration is required Digital Certificates The digital certificate trust chain for the Nubo Management Server must be installed directly in to the Android Trust Store. The TOE does not mediate the installation of the trust chain. The installation of the certificate is per the evaluated platform recommendations. The reference identifier for the TOE is the configured Nubo Management Server IP address/host name. No additional configuration is required Revocation Checking The Nubo Software Thin Client performs revocation checking using the OS provided OCSP. The software will check the revocation status of a certificate against the OCSP server address listed in the presented certificate. No additional configuration is required.

10 5. Resource Usage The Nubo Software Thin Client uses the following resources, Camera: This is required because the TOE facilitates user interaction with the camera on the platform. Microphone: This is required because the TOE facilitates user interaction with the microphone on the platform. Location services: This is required because the TOE interacts with and other applications on the platform that make location service requests. Media stored in non-volatile memory: This is required because the TOE facilitates user interaction with the media on the platform.

11 6. Evaluated Functionality In addition to the base functionality found in the Protection Profile for Application Software, the following functionality was also evaluated for the Nubo Software Thin Client, TLS Client Connections

12 End of Document