550-06508 Enabling FIPS 140 Physical Security (Level2) for SBC Core Appliance

Physical Security

FIPS Level 2 requires labels for the Ribbon Communications SBC 5400 and SBC 7000physical security requirements. This document details how to place and maintain the FIPS-licensed SBC 5400 and SBC 7000.

Tamper Evident Label Application and Management

The SBC 5400 and SBC 7000 may be licensed to conform to FIPS 140 Level 2. The Crypto Officer is responsible for applying and inspecting tamper-evident labels to the FIPS-licensed Ribbon system to ensure that it maintains the approved mode of operation. The Crypto Officer must verify that all tamper-evident labels are in place and undamaged regularly; if a label is damaged or removed, the CO must ensure the label is replaced. The figure Example of Tampering a Label illustrates a tamper-evident label that has been tampered with. When the tamper-evident labels are removed or installed, the Crypto Officer must be present and return the system to an approved FIPS 140 Level 2 state. If the tamper-evident labels require replacement, you may purchase new replacement label kits (821-00535). 

Applying Labels

Clean the surface where the label is placed with isopropyl alcohol and dry it thoroughly. Do not touch or blow on the surface after cleaning it to avoid contaminating it. Using finger/thumb pressure, slowly roll back the liner (backing material) to expose the adhesive side of the label. Do not touch the adhesive with your fingers; the label may become spoiled (i.e., tampered). Place the label in the specified location and apply substantial pressure across the entire label surface, ensuring complete coverage. Allow the label adhesive to cure for at least 30 minutes – full adhesion is achieved after 24 hours.

Label Kits

Only the Crypto Officer should apply the Label kits using the label kit "821-00535" supplied by Ribbon Communications. Each label kit consists of a bag of six identical ½" x 2" labels for one Ribbon SBC appliance. All six labels are used on the SBC 7000. For the SBC 5400, only three labels are used –  the Crypto Officer must destroy the remaining three labels.

Inspect each label kit. If any of the following situations occur, reject the labels and notify Ribbon Communications.

• The label bag has been opened.
• All labels are not identical and do not have matching serial numbers.
• The labels appear to be tampered with.

An example of a label that was tampered with is shown below.

Example of Tampering a Label

Apply Labels to the SBC 5400

The SBC 5400 requires three tamper evident labels, 

• one on the left side of the front upper surface bridging the bezel and cover,
• one on the right side of the front bottom surface bridging the bezel and chassis base and
• one on the upper surface of the rear of the cover bridging to the DSP2X subassembly.

Bezel and Cover

Bezel and Cover

1. Remove the label from its liner.
2. Place the label onto the bezel approximately where shown, taking care not to wrap the label around the front surface of the bezel. Using firm pressure, smooth the label from one end to the other.
3. Confirm the label bridges the bezel and the cover.

Bezel and Chassis Base

Bezel and Chassis Base

1. Remove the label from its liner.
2. Place the label onto the bezel approximately where shown (below), not wrapping the label around the front surface. Using firm pressure, smooth the label from one end to the other.
3. Confirm the label bridges the bezel and the chassis base.

Cover and DSP2X Tray

Cover and DSP2X Tray

1. Remove the label from its liner.
2. Place the label onto the cover approximately where shown, starting at the edge, and wrap the label around the back surface. Using firm pressure, smooth out a label from one end to the other.
3. Confirm the label bridges, the cover, and the DSP2X tray.

Apply Labels to the SBC 7000

The SBC 7000 requires six tamper evident labels,

• one on the top surface that bridges the bezel and top surface of the chassis,
• one that bridges the top surface of the chassis and the cover,
• two that bridges the cover and sides of the chassis, one on each side, and
• two that bridge each side of the CSC 100 to the chassis body.

The bezel and Top Surface of the Chassis

Bezel and Top Surface of Chassis

1. Remove the label from its liner.
2. Place the label onto the bezel approximately where shown, taking care not to wrap the label around the front edge of the bezel. Using firm pressure, smooth the label from one end to the other.
3. Confirm the label bridges the bezel and the top surface of the chassis.

Cover and Top Surface of Chassis

Cover and Top Surface of Chassis

1. Remove the label from its liner.
2. Place the label onto the chassis approximately where shown. Using firm pressure, smooth the label from one end to the other.
3. Confirm the label bridges the cover and the top surface of the chassis.

Cover and First Side of Chassis

Cover and First Side of Chassis

1. Remove the label from its liner.
2. Place the label onto the cover approximately where shown. Starting at the edge, wrap the label around the side surface. Using firm pressure, smooth the label from one end to the other.
3. Confirm the label bridges the cover and the side of the chassis.

Cover and Second Side of Chassis

Cover and Second Side of Chassis

1. Remove the label from its liner.
2. Place the label onto the cover approximately where shown. Starting at the edge, wrap the label around the side surface. Using firm pressure, smooth the label from one end to the other.
3. Confirm the label bridges the cover and the side of the chassis.

CSC 100 and First Side of Chassis

CSC 100 and First Side of Chassis

1. Remove the label from its liner.
2. Place the label onto the CSC 100 approximately where shown. Starting at the edge, wrap the label around the side surface. Using firm pressure, smooth the label from one end to the other.
3. Confirm the label bridges the CSC 100 and the side of the chassis.

CSC 100 and Second Side of Chassis

CSC 100 and Second Side of Chassis

1. Remove the label from its liner.
2. Place the label onto the CSC 100 approximately where shown. Starting at the edge, wrap the label around the side surface. Using firm pressure, smooth the label from one end to the other.
3. Confirm the label bridges the CSC 100 and the side of the chassis.

Inspect Labels

The Crypto Officer is responsible for inspecting the FIPS labels regularly to ensure the Ribbon product maintains FIPS 140 Level 2 compliance. The Crypto Officer must verify that all tamper-evident labels are in place and show no signs of tampering. The Crypto Officer must inspect the following:

• Missing or misplaced labels – ensure labels are present and they are in the proper locations indicated in this document
• Labels match the Ribbon label (shown below) for style, size and color
• Serial numbers on all labels are identical and match the recorded serial numbers
• Indication of tampering – if tampered with, reject the labels and notify Ribbon
  
  Tamper-Evident Label Example
•