The primary goal of the MITRE compartmented mode workstation (CMW) project was to articulate the security requirements that workstations must meet to process highly classified intelligence data. As a basis for the validity of the requirements developed, a prototype was implemented which demonstrated that workstations could meet the requirements in an operationally useful manner while still remaining binary compatible with off-the-shelf software. The security requirements not only addressed traditional security concerns but also introduced concepts in areas such as labeling and the use of a trusted window management system. The CMW labeling paradigm is based on associating two types of security labels with objects: sensitivity levels and information labels. Sensitivity levels describe the levels at which objects must be protected. Information labels are used to prevent data overclassification and also provide a mechanism for associating with data those markings that are required for accurate data labeling, but which play no role in access control decisions. The use of a trusted window manager allows users to easily operate at multiple sensitivity levels and provides a convenient mechanism for communicating security information to users in a relatively unobtrusive manner.>

The Defense Intelligence Agency (DIA) recognized that commercially available workstations could significantly enhance the capabilities of today's Intelligence Data Handling Systems (IDHS) if they could be integrated with the IDHS systems in a secure manner. The Compartmented Mode Workstation (CMW) project was started at the request of the DIA to further the state-of-the-art of computer security in general and workstation security in particular. The prototype effort had two major purposes. The first purpose was to demonstrate that operationally useful implementations of each requirement could be designed and developed. The second, more general, purpose was to gain insight into what measures could be taken to augment commercially available workstations with meaningful security. Therefore, as the Security Requirements for System High and Compartmented Mode Workstations [CMWREQS] were stated, a development team attempted to implement thereon the CMW prototype. Viable approaches were found for all requirements thereby verifying the premise that a workstation and its associated operating system could be modified such that off-the-shelf software (distributed in binary form) could execute with adequate security .This paper describes compartmented mode operation, how the prototype satisfied each requirement, and the level of effort involved in the prototype implementation.