According to the trusted systems evaluation criteria (TCSEC) paradigm, if untrusted subjects are constrained by the trusted computer base (TCB), they may safely execute software of unknown assurance while accessing sensitive information. Untrusted subjects, however, can leak sensitive information, undermine the TCB's accountability mechanisms, and destroy information integrity. Hence, the security properties needed by many organizations cannot be enforced at the TCSEC security perimeter, i.e., the TCB interface. We propose an alternative approach that redraws the security perimeter of a trusted system so that it encompasses not only a TCSEC TCB but the Controlled Application Set (CAS), a collection of software components for which some assurance of benign behavior has been obtained. Non-CAS components may also be present on a system bird may be used to manipulate only non-sensitive information. The approach advocates a form of balanced assurance in which the assurance sought for CAS components is commensurate with residual security risks they present. We propose practical assurance requirements, including new functional requirements for TCBs. Examples illustrate the applicability of the approach to confidentiality, accountability, and integrity.>

The authors describe how mandatory and discretionary access mediation are performed in the trusted mach (TMach) kernel, a system that uses message passing as its primary means of communication both between tasks and with the kernel. As a consequence, control of interprocess communication in the TMach kernel is a central concern whereas controlled sharing of segments is the central focus in trusted systems with more traditional architectures. The TMach kernel is not a complete trusted system. It is a reference monitor of basic system abstractions, providing a small, well-controlled base on which the rest of a trusted computing base and operating system can be constructed. The TMach kernel provides simple and elegant mandatory access control for port access rights. The TMach kernel's MAC (mandatory access control) mechanisms clearly control the flow of information according to a mandatory security policy based on a Bell and La Padula model. DAC (discretionary access control) mechanisms are provided in the TMach kernel to implement TCSEC (trusted computer system evaluation criteria) requirements and to support DAC in servers to be built on the kernel.>