Separation kernels are the strongest known form of separation for virtual machines. We agree with NSA's Information Assurance Directorate that while separation kernels are stronger than any other alternative, their construction on modern commodity hardware is no longer justifiable. This is because of orthogonal feature creep in modern platform hardware. We introduce the separation VMM as a response to this situation and explain how we prototyped one.

This panel highlights a selection of the most interesting and provocative papers from the 2005 New Security Paradigms Workshop. This workshop was held September 2005 - the URL for more information is http://www.nspw.org. The panel consists of authors of the selected papers, and the session is moderated by the workshop's general chairs. We present selected papers focusing on exciting major themes that emerged from the workshop. These are the papers that will provoke the most interesting discussion at ACSAC.

This paper argues that the existing model-driven architecture paradigm does not adequately cover the visual modeling of security protocols: sequences of interactions between principals. A security protocol modeling formalism should be not only well-defined but also support event-based, compositional, comprehensive, laconic, lucid, sound, and complete modeling. Candidate visual approaches from both the OMG's MDA and other more well-defined formalisms fail to satisfy one or more of these criteria. By means of two example security protocol models, we present the GSPML visual formalism as a solution.

Faults are examined by both the security and fault tolerance communities. These communities have strikingly different views of the types of faults that exist, the way they are modeled, and how they are addressed. One community can pronounce a system survivable but the other community would not find this to be so. This leaves us with two approaches that both fail to be comprehensive, depending on which community is looking at the system. While intrusion-tolerance and security researchers look at faults in terms of statistically dependent events caused by the hard intruder, the fault tolerance literature assumes that faults are statistically independent and can be described as random variables with probability distributions. When considering the survivability of a system, we cannot assume that the system is susceptible to only one type of fault or the other, but this is common practice in both communities. A new paradigm is needed.

This paper describes an extension to abuse-case-based security requirements analysis that provides a lightweight means of increasing assurance in security relevant software. The approach is adaptable to lightweight software development processes but results in a concrete and explicit assurance argument. Like abuse-case-based security requirements analysis, this approach is suitable for use in projects without security experts. When used in this way (without security experts) it will not produce as much assurance as the more traditional alternatives, but arguably give better results than ad hoc consideration of security issues.

The relationships between the work products of a security engineering process can be hard to understand, even for persons with a strong technical background but little knowledge of security engineering. Market forces are driving software practitioners who are not security specialists to develop software that requires security features. When these practitioners develop software solutions without appropriate security-specific processes and models, they sometimes fail to produce effective solutions. We have adapted a proven object oriented modeling technique, use cases, to capture and analyze security requirements in a simple way. We call the adaptation an abuse case model. Its relationship to other security engineering work products is relatively simple, from a user perspective.

Describes progress to date on three prototype tools for detecting storage jamming (or information warfare) attacks. One prototype (Doc) uses a replay defense; another (Wyatt) uses logical replication, and the third (Virgil) can be used to determine the source and pattern of a detected attack. Three prototype jammers are used to test the effectiveness of the defenses. Initial experiments have shown that access control, encryption, auditing and virus detection do not prevent or detect storage jamming. The prototype tools have been effective in detecting the same attacks. Object-oriented data storage may require the use of application-specific techniques for applying checksums.

Protocols of care are representations of practice that specify how patients should be treated given specified conditions.We have been exploring ways that protocols of care can be encoded in computers so that they can actively structure work people do in clinics to accord with standards of care.We describe one such implementation called the Care Manager.Because a protocol's power to suggest action lies in people's alignment to it, and beeause organizational change can make such standards obsolete overnight, means for keeping protocols in sync with work practice are a necessary accompaniment to any implementation of protocol-based care.

Storage jamming can degrade real-world activities that share stored data. Storage jamming is not prevented by access controls or cryptographic techniques. Verification to rule out storage jamming logic is impractical for shrink-wrapped software or low-cost custom applications. Detection mechanisms do offer more promise. In this paper, we model storage jamming and a detection mechanism, using Unity logic. We find that Unity logic, in conjunction with some high-level operators, models storage jamming in a natural way and allows us to reason about susceptibility, rate of jamming, and impact on persistent values.

A replicated-architecture database system uses data replication to provide multilevel security. The most critical problem associated with replicated architecture multilevel-secure database systems is mutual consistency of the replicas and the impact

Current projects aimed at providing MLS computing services rarely seem to exploit advances in related fields. Specifically, the concepts of data distribution, replication, and interoperation are currently receiving much attention in the commercial database system sector but have yet to be applied to the delivery of MLS computing services. This paper explains how these concepts might kelp deliver MLS computing services relatively, quickly and cheaply, and how they can ease integration of legacy systems and new technology into future MLS cooperative, distributed computing environments.>

Summary reports are the periodic assemblings of text, numbers, and other data, drawn from diverse sources to present a picture of some aspect of an organization's state. They have become ubiquitous in organizations with the advent of computers, but are not always as useful as their readers would like them to be. This paper focuses on the meaning-making work that report contributors and readers must do in order for reports to be useful and presents some examples drawn from everyday interactions in a business unit of a large corporation. The paper uses these examples as a foundation for asking what it might mean to purposefully support meaning-making in organizational reporting.

Unlike previous approaches to developing a trusted database system, the replicated architecture approach provides access control at a high level of assurance through replication of data and operations. We present a model of the SINTRA replicated architecture trusted database system which shows how the logical (users') view of the system and its security policy is translated into the physical structure and operations of the SINTRA system. We formalize the intended security policy for replicated architecture and demonstrate that a high level of assurance can be obtained solely from replication with virtually no change to the structure of the underlying database systems or the security kernel.>

A definition of multilevel transaction for multilevel secure databases is proposed, and a notion of correctness that is consistent with the traditional idea of correctness of replicated systems is defined. To demonstrate the applicability of these ideas, an algorithm for correct transaction processing within this framework is presented for replicated architecture multilevel databases.>

The replicated architecture for multilevel secure database systems provides security by replicating data into separate untrusted single-level database systems. To be successful, a system using the replicated architecture must have a concurrency and replica control algorithm that does not introduce any covert channels. Jajodia and Kogan (1990) have developed one such algorithm that uses update projections and a write-all replica control algorithm. The authors describe an alternative algorithm. The new algorithm uses replicated transactions and a set of queues organized according to security class. A new definition of correctness is required for this approach, so they present one and use it to show that the algorithm is correct. The existence of this new algorithm increases the viability of the replicated architecture as an alternative to kernelized approaches.>

The authors have investigated how to certify the trustworthiness of application systems built to satisfy stringent security requirements and have undertaken the certification analysis of two command and control systems targeted at the B3 class of the DoD Trusted Computer System Evaluation Criteria (TCSEC). Based on these experiences, the authors have gained many insights into the certification and procurement of trusted application systems. Certifying a trusted application system in a contractual environment presents both technical and programmatic challenges. The procurement policy must to some extent take into account the certification approach. This paper documents some of the lessons learned during the authors' investigations.>

Presents some initial experiences in NRL's application system certification technology project. The project goal is to develop an approach to certifying US Navy application systems that must be trusted. The authors are conducting their research by participating in the certification of two NATO command and control systems targeted at the B3 class of the Trusted Computer System Evaluation Criteria. An important initial finding of this project is a working definition of the role that an informal or descriptive top-level specification plays in development of trusted application systems. Other initial experiences include the possibility of using the descriptive top-level specification as a preliminary specification and the identification of some easily corrected shortcomings of natural language descriptions. The paper is divided into two parts. The first part discusses the role of the descriptive top-level specification and the second part relates three initial experiences with descriptive top-level specifications.>

A trusted application system must support the processing needs of a specific operating environment. Its security policy includes many constraints that are specific to the application, so the trusted application system can be more difficult to develop and evaluate than a trusted product. One approach for reducing the development and evaluation effort for a trusted application system is to build the system on an evaluated product. Among other advantages, this approach may relieve the developer from demonstrating that the application's trusted computing base enforces those application policies that are enforced by the evaluated product. The authors discuss their thoughts on modeling a trusted application system based on an evaluated product. They identify some lessons learned from experience in evaluating a trusted application system formal model and provide a set of guidelines for writing a formal model for a trusted application system based on an evaluated product.>

This paper describes knowledge acquisition strategies developed in the course of handcrafting a diagnostic system and reports on their consequent implementation in MORE, an automated knowledge acquisition system. We describe MORE in some detail, focusing on its representation of domain knowledge, rule generation capabilities, and interviewing techniques. MORE's approach is shown to embody methods which may prove fruitful to the development of knowledge acquisition systems in other domains.

In this paper, we describe the organization of a rule-based system, SPAM, that uses map and domain-specific knowledge to interpret airport scenes. This research investigates the use of a rule-based system for the control of image processing and interpretation of results with respect to a world model, as well as the representation of the world model within an image/map database. We present results on the interpretation of a high-resolution airport scene wvhere the image segmentation has been performed by a human, and by a region-based image segmentation program. The results of the system's analysis is characterized by the labeling of individual regions in the image and the collection of these regions into consistent interpretations of the major components of an airport model. These interpretations are ranked on the basis of their overall spatial and structural consistency. Some evaluations based on the results from three evolutionary versions of SPAM are presented.

This paper presents an experiment in knowledge-intensive programming within a general problem-solving production-system architecture called Soar. In Soar, knowledge is encoded within a set of problem spaces, which yields a system capable of reasoning from first principles. Expertise consists of additional rules that guide complex problem-space searches and substitute for expensive problem-space operators. The resulting system uses both knowledge and search when relevant. Expertise knowledge is acquired either by having it programmed, or by a chunking mechanism that automatically learns new rules reflecting the results implicit in the knowledge of the problem spaces. The approach is demonstrated on the computer-system configuration task, the task performed by the expert system R1.