P2600 Hardcopy Device and System Security May 2008 Working Group Meeting

1. P2600Hardcopy Device and System SecurityMay 2008 Working Group Meeting Don Wright Director of Standards Lexmark International don@lexmark.com

2. How To Access Xerox Guest Wireless Network • To use the Xerox Guest Wireless network from a location supporting the "Xerox Corporate Enterprise Wireless LAN (XCEWLAN)": • Connect to the guest wireless network identified by "XCEWLAN Guest" • Acknowledge any insecure network warning messages (this network is not encrypted) • Launch a web browser • Enter your Guest ID and Password in the login screen and click "Accept“. If you forgot either see Al Sukert. • You are now connected to the Internet utilizing the Xerox Guest Network • After login with a web browser other client applications may be utilized such as VPN or email clients.

3. Opening Agenda Items • Self Introductions • Approval of the Agenda

4. Agenda Items • Wednesday/Thursday, May 21-22 • Welcome & Introductions • Update and Approve Agenda • Review and approve April Minutes • IEEE Patent Policy Review • New Slides • 2008 Meeting Schedule • Update on TCG (Volkoff) • Update on INCITS CS1 Working Group (Thrasher) • Update of CC Vendor's Forum (Sukert) • Review of Action Items from April Meeting • Ad Hoc Reports • PP Evaluation Decision ad hoc status (Nevo) • Guide to P2600 PPs ad hoc status (Sukert)

5. Agenda Items • Wednesday/Thursday, May 21-22 • Issues raised on e-mail • None • Protection Profiles Review and Comments • Comments • New Approach PPs (Smithson) • Overview • PP-A Prototype • Production Printing Profile (Sukert) • Draft • Schedule Checkpoint Review • Other items • Posting and Comment deadlines for June Meeting • Next meeting details

6. Minutes from April Meeting • Minutes were published shortly after the meeting. • They are available at:http://grouper.ieee.org/groups/2600/minutes/P2600-minutes-Apr2008.pdf • Any additions, deletions or corrections to the April minutes?

7. Instructions for the WG Chair The IEEE-SA strongly recommends that at each WG meeting the chair or a designee: • Show slides #1 through #4 of this presentation • Advise the WG attendees that: • The IEEE’s patent policy is consistent with the ANSI patent policy and is described in Clause 6 of the IEEE-SA Standards Board Bylaws; • Early identification of patent claims which may be essential for the use of standards under development is strongly encouraged; • There may be Essential Patent Claims of which the IEEE is not aware. Additionally, neither the IEEE, the WG, nor the WG chair can ensure the accuracy or completeness of any assurance or whether any such assurance is, in fact, of a Patent Claim that is essential for the use of the standard under development. • Instruct the WG Secretary to record in the minutes of the relevant WG meeting: • That the foregoing information was provided and that slides 1 through 4 (and this slide 0, if applicable) were shown; • That the chair or designee provided an opportunity for participants to identify patent claim(s)/patent application claim(s) and/or the holder of patent claim(s)/patent application claim(s) of which the participant is personally aware and that may be essential for the use of that standard • Any responses that were given, specifically the patent claim(s)/patent application claim(s) and/or the holder of the patent claim(s)/patent application claim(s) that were identified (if any) and by whom. • The WG Chair shall ensure that a request is made to any identified holders of potential essential patent claim(s) to complete and submit a Letter of Assurance. • It is recommended that the WG chair review the guidance in IEEE-SA Standards Board Operations Manual 6.3.5 and in FAQs 12 and 12a on inclusion of potential Essential Patent Claims by incorporation or by reference. Note: WG includes Working Groups, Task Groups, and other standards-developing committees with a PAR approved by the IEEE-SA Standards Board. (Optional to be shown)

8. Participants, Patents, and Duty to Inform • All participants in this meeting have certain obligations under the IEEE-SA Patent Policy. Participants: • “Shall inform the IEEE (or cause the IEEE to be informed)” of the identity of each “holder of any potential Essential Patent Claims of which they are personally aware” if the claims are owned or controlled by the participant or the entity the participant is from, employed by, or otherwise represents • “Personal awareness” means that the participant “is personally aware that the holder may have a potential Essential Patent Claim,” even if the participant is not personally aware of the specific patents orpatent claims • “Should inform the IEEE (or cause the IEEE to be informed)” of the identity of “any other holders of such potential Essential Patent Claims” (that is, third parties that are not affiliated with the participant, with the participant’s employer, or with anyone else that the participant is from or otherwise represents) • The above does not apply if the patentclaim is already the subject of an Accepted Letter of Assurance that applies to the proposed standard(s) under consideration by this group (Quoted text excerpted from IEEE-SA Standards Board Bylaws subclause 6.2) • Early identification of holders of potential Essential Patent Claims is strongly encouraged • No duty to perform a patent search Slide #1

9. Patent Related Links All participants should be familiar with their obligations under the IEEE-SA Policies & Procedures for standards development. Patent Policy is stated in these sources: • IEEE-SA Standards Boards Bylaws http://standards.ieee.org/guides/bylaws/sect6-7.html#6 • IEEE-SA Standards Board Operations Manual http://standards.ieee.org/guides/opman/sect6.html#6.3 • Material about the patent policy is available at http://standards.ieee.org/board/pat/pat-material.html If you have questions, contact the IEEE-SA Standards Board Patent Committee Administrator at patcom@ieee.org or visit http://standards.ieee.org/board/pat/index.html This slide set is available at http://standards.ieee.org/board/pat/pat-slideset.ppt Slide #2

10. Call for Potentially Essential Patents • If anyone in this meeting is personally aware of the holder of any patent claims that are potentially essential to implementation of the proposed standard(s) under consideration by this group and that are not already the subject of an Accepted Letter of Assurance: • Either speak up now or • Provide the chair of this group with the identity of the holder(s) of any and all such claims as soon as possible or • Cause an LOA to be submitted Slide #3

11. Other Guidelines for IEEE WG Meetings • All IEEE-SA standards meetings shall be conducted in compliance with all applicable laws, including antitrust and competition laws. • Don’t discuss the interpretation, validity, or essentiality of patents/patent claims. • Don’t discuss specific license rates, terms, or conditions. • Relative costs, including licensing costs of essential patent claims, of different technical approaches may be discussed in standards development meetings. • Technical considerations remain primary focus • Don’t discuss or engage in the fixing of product prices, allocation of customers, or division of sales markets. • Don’t discuss the status or substance of ongoing or threatened litigation. • Don’t be silent if inappropriate topics are discussed … do formally object. --------------------------------------------------------------- See IEEE-SA Standards Board Operations Manual, clause 5.3.10 and “Promoting Competition and Innovation: What You Need to Know about the IEEE Standards Association's Antitrust and Competition Policy” for more details. Slide #4

12. 2008 Meeting Schedule • June 23-24: Denver/Boulder (PWG Also) • August 11 (& 12?): Portland OR @ Sharp (PWG Also)? • Week of September 8th at Sharp in Arlington VA • October 24th: Lexington?

13. Trusted Computing Group Update

14. INCITS CS1 : Cyber-Security Update Thrasher

15. CC Vendors Forum Update Sukert/Thrasher

16. Action Items from Previous Meetings • Review entries in P2600-action-items excel spreadsheet • Pre-meeting Spreadsheet • P2600-action-items-20080516.xls

17. Old Business • PP Evaluation Decision ad hoc (Nevo) • Status • Contract completed to atsec • Press releases after approval by some “SCHEME” • Budget management? • Rechartered – anyone want to join or leave? • Consider using another scheme for PP-B, C, D if NIAP won’t accept them. • Guide to PPs ad hoc (Sukert) • Status • Rechartered?

18. Held meetings on May 6th and May 19th: Have enough information to start Chapters 1-3 of the PP Guide now; assignments made (see below) Can’t complete PP Guide until P2600 has completed PP restructuring and any other changes to address NIAP and Atsec PP feedback. Still want to run the PP Guide outline by Atsec to get its feedback as to whether anything else could or should be added. Current Plan is that initial text of the PP Guide will be available for the August 08 meeting due to the uncertainty surrounding PP content Will likely contain partially completed sections Checkpoint to see if we are on “right track” PP Guide Ad Hoc Team

19. Issues raised on e-mail • None

20. Protection Profiles • Protection Profiles Review • PP-A (version 35a) • PP-B (version 35a) • PP-C (version 35a) • PP-D (version 35a) • Comments Submitted • http://grouper.ieee.org/groups/2600/comment-tracking/P2600_2008_05_v01.pdf

21. “New Approach” Protection Profile • Overview • http://grouper.ieee.org/groups/2600/presentations/Rochester2008/Explanation%20of%20PP%20restructuring.pdf • PP-A Prototype • http://grouper.ieee.org/groups/2600/drafts/ProtectionProfiles/P2600.1-36b-proto.pdf

22. PP Path Forward • Decision – • Get atsec to write up why the “packages” approach is consistent with CC • Evangelize the “packages” approach to other schemes and get their public endorsement • Evangelize the “packages” approach to the key technologist at IPA (Haruki Tabuchi). • Get the “packages” approach on the CCDB agenda • Get a better draft of “A” • Take the recommendation to go to “package” to the whole WG.

23. Production Printing Protection Profile • Production Printing Profile Status (Sukert) • Draft: http://grouper.ieee.org/groups/2600/drafts/ProtectionProfiles/P2600.5-34a.pdf • Issues/Comments/Ideas?

24. Project Schedule • All Documents • May Meeting (May 21-22) • Feedback from atsec • Recommendation on “family” versus “packages” • June Meeting (June 23-24) • WG Comments on “packages” draft • Feedback from atsec • Feedback from IPA from JBMIA meeting • Update on Production Printing Profile • Make a decision on getting a PAR for Production Printing Profile • Make a decision on the SCHEME(s) to be used • Create new sponsor ballot bodies (After June 28) • August Meeting (Aug 11 & 12) @ Sharp PDX • Revisit NIAP CIM comments • Deal with SCHEME comments • Deal with WG comments • Draft of Guide • Start Evaluation of PPs (post meeting) • Start .1, .2, .3, & .4 Sponsor Ballot (post meeting) • September Meeting (Sept 9 & 10 at Sharp DCA) • Deal with any comments received from SCHEME/atsec • Work on Guide • October Meeting (Oct 24 at Lexmark LEX) • Process sponsor ballot comments on .1, .2, .3, .4 • Deal with any comments received from SCHEME/atsec • Discuss if PP’s still match Std 2600 – if not, process amendment PAR • Work on Guide • December (11-12 in FL or week of 15th anywhere) Meeting • Deal with any comments received from SCHEME/atsec • Process Sponsor Ballot *recirculation” Comments • Finish Guide

25. Other Items • Do we need to add any more meetings? • Do we need to meeting in August / September / October? • Yes and probably a December meeting as well

26. June Meeting Deadlines • All PPs are under change control • All comments must be in the tool • The editor may not make changes EXCEPT based on submitted and accepted comments. • Posting of Documents: June 9,2008 • Posting of Comments: June 16, 2008

27. Next Meeting Details • June 23-24, 2008 • Radisson Hotel & Conference Center Longmont-Boulder1900 Ken Pratt BoulevardLongmont, CO 80501Ph. 303-776-2000 • No hotel block • Meeting Fee: $65 per day • Registration through the PWG

28. Next Meeting Location Map Longmont Boulder

29. Thanks! • See you in Boulder/Longmont!!

30. Back-up Charts BACK-UP CHARTS

31. Mailing List and Web Site • Web Site: http://grouper.ieee.org/groups/2600 • Mailing list: • Listserv run by the IEEE • An archive is available on the web site • Subscribe via a note to: listserv@listserv.ieee.orgcontaining the line:subscribe stds-2600 • Only subscribers may send e-mail to the mailing list. No Change