We provide a retrospective view of the design of SRI's Provably Secure Operating System (PSOS), a formally specified tagged-capability hierarchical system architecture. It examines PSOS in the light of what has happened in computer system developments since 1980, and assesses the relevance of the PSOS concepts in that light.

In most trusted systems, discretionary access to objects can be obtained in ways not explicitly allowed by the discretionary access control (DAC) policy. This well-understood observation is examined in the context of client-server architectures, and compared both to the traditional understanding of DAC and to existing trusted systems. The results are used as the basis for an argument for a new understanding of DAC and its implications for the design of trusted systems.>

A security policy is given for separation virtual machine monitors (SVMMs) and the authors interpret J.M. Rushby's (1981) separation model for SVMMs. Applying Rushby's technique yields a practical method for demonstrating that an implementation of an SVMM adheres to the abstract isolation axiom of the separation model, thus providing relatively strong assurance for a low level of effort. The authors describe the relevant characteristics of SVMMs and note the applicable formal modeling requirements. A summary of the SVMM separation model, which is a modification of the original model presented by Rushby, is given. The separation model technique permits a proof of separability among the operating systems under control of the kernel of an SVMM. An interpretation of the elements of the separation model using concepts from SVMMs is given.>

Trusted computing base (TCB) subsetting consists of subdividing a large TCB into smaller separate TCBs, each of which can be separately designed, implemented, and analyzed. The idea of TCB subsetting is attractive because it can simplify the difficult task of constructing TCBs. However, there are many unanswered questions, connected in particular with determinating the useful and meaningful ways of subsetting a trusted system. It is concluded that the notion of TCB subsetting is appealing, but there are many pitfalls and unanswered questions, making it necessary to ensure that the cost is commensurate with the benefits. >

Passwords have long been used as the most common method for providing user authentication when accessing remote computer systems. However, there are many security problems associated with passwords including their susceptibility to the attacks of eavesdropping, playback, and exhaustive search. This paper describes a system which offers an innovative solution to the problem of establishing identities over insecure communications channels. The system embodies the security concept of a one-time pad because it requires that a different password be used for each access. Through the possession of a personal authentication device (the PassPort) and knowledge of a unique PIN number, an authorized user is able to generate the correct password to be used for each access.

The distribution of cryptographic keys in a computer network is discussed.The need for current authentication of communicants to prevent playback attacks is demonstrated, and an earlier protocol is found to be subject to such attacks.A protocol which employs a simple means of obtaining current authentication of communicants and does not require communicants to maintain an absolute sense of time is presented.The protocol is expanded to accommodate key distribution between multiple security communities, where each community is administered by a different authentication server.Another form of the protocol which is appropriate for datagram applications is developed.

An I/0 system has been implemented in the Multics system that facilitates dynamic switching of I/0 devices. This switching is accomplished by providing a general interface for all I/O devices that allows all equivalent operations on different devices to be expressed in the same way. Also particular devices are referenced by symbolic names and the binding of names to devices can be dynamically modified. Available I/0 operations range from a set of basic I/0 calls that require almost no knowledge of the I/O System or the I/0 device being used to fully general calls that permit one to take full advantage of all features of an I/O device but require considerable knowledge of the I/0 System and the device. The I/O System is described and some popular applications of it, illustrating these features, are presented.