Meaning
A standardized security assurance rating for information technology products represents the rigorous evaluation of hardware and software safety mechanisms. Certification under common criteria EAL5+ signifies that a product has been semi-formally designed and tested to resist sophisticated hardware attacks. Microcontrollers and secure elements in payment terminals or mobile devices frequently target this high level of verification.
The plus suffix indicates that one or more specific assurance requirements have been augmented beyond the standard level five baseline.
Evaluation Process
The certification involves independent third-party laboratory testing against a structured protection profile. During the common criteria EAL5+ assessment, the developer must submit complete design schematics and source code for the security architecture. Evaluators perform vulnerability analyses and penetration testing to confirm the effectiveness of the countermeasures.
Hardware Countermeasure
Physical protection mechanisms are audited to ensure resistance against tampering and side-channel analysis. Implementing common criteria EAL5+ requires the inclusion of active shields, true random number generators, and clock manipulation detectors within the silicon layout. These features prevent an attacker from extracting cryptographic keys via physical probes.
Product Certification
Product documentation issued at the end of this cycle is the essential document for regulatory compliance. Manufacturers present this document during the final device assembly sign-off. It provides buyers with verified proof of the silicon’s integrity.
