According to the trusted systems evaluation criteria (TCSEC) paradigm, if untrusted subjects are constrained by the trusted computer base (TCB), they may safely execute software of unknown assurance while accessing sensitive information. Untrusted subjects, however, can leak sensitive information, undermine the TCB's accountability mechanisms, and destroy information integrity. Hence, the security properties needed by many organizations cannot be enforced at the TCSEC security perimeter, i.e., the TCB interface. We propose an alternative approach that redraws the security perimeter of a trusted system so that it encompasses not only a TCSEC TCB but the Controlled Application Set (CAS), a collection of software components for which some assurance of benign behavior has been obtained. Non-CAS components may also be present on a system bird may be used to manipulate only non-sensitive information. The approach advocates a form of balanced assurance in which the assurance sought for CAS components is commensurate with residual security risks they present. We propose practical assurance requirements, including new functional requirements for TCBs. Examples illustrate the applicability of the approach to confidentiality, accountability, and integrity.>

This paper describes the architecture of a prototype multilevel secure windowing system based on the X Window System. The prototype, known as TX, is designed to meet the class B3 architectural requirements of the Trusted Computer System Evaluation Cr

A synchronization mechanism that communicates information from a writer to a reader without permitting information flow in the reverse direction is presented. The synchronization mechanism takes advantage of a priori knowledge of the semantics of communicated information and is optimal because it does not require blocking, busy wait states, an unbounded number of rereads of data, or inefficient use of system resources. The mechanism has been implemented in the Trusted Mach (TMach) operating system's file system. The TMach's file system is described, and it is shown how performance is enhanced through the use of the synchronization mechanism.>

Multilevel secure windowing systems are a key technology for the 1990s. The authors have spent 20 months designing and implementing a prototype of a multilevel secure X Window System as a proof of concept vehicle for their software engineering process model for the development of trusted systems. The prototype is targeted to B3 evaluation criteria. In the early stages many doubted that B3 was achievable for a windowing system (especially X); the prototype demonstrates that B3 is achievable. The paper describes the goals, the architecture of the system, and some of the trade-offs made to achieve the goals. It also contrasts the work with existing compartmented mode workstations (CMW) windowing systems.>

One way to show that a system is not secure is to demonstrate that a malicious or mistake-prone user or program can break security by causing the system to reach a nonsecure state. A fundamental aspect of a security model is a proof that validates that every state reachable from a secure initial state is secure. A sequential security model assumes that every command that acts as a state transition executes sequentially, while a concurrent security model assumes that multiple commands execute concurrently. This paper presents a security model called the Centralized-Parallel-Distributed model (CPD model) that defines security for logically, or physically centralized, parallel, and distributed systems. The purpose of the CPD model is to define concurrency conditions that guarentee that a concurrent system cannot reach a state in which privileges are configured in a nonsecure manner. As an example, the conditions are used to construct a representation of a distributed system.

A description is given of the hierarchical model (HM), an access matrix-based model used to define nondisclosure in distributed multilevel secure applications such as secure file systems, secure switches, and secure upgrade downgrade facilities. The HM explicitly encodes access rights, synchronization primitives, and indirection in its state matrix. Serializability of concurrent commands is formally defined in terms of the HM syntactic model of computation. HM serializability conditions are independent of the semantic security predicate. Finally, an example that illustrates the HM is presented.>