The authors give a generalization of the definition of security for state machines given by D. Sutherland (Proc. 9th Nat. Comput. Security Conf., Sept. 1986). The generalization allows the security levels of inputs and outputs to be assigned dynamically. Its aim is merely to say what it means to infer high-level information from low-level information when the definitions of what is high and low can change. Although the generalization supports the modeling of thins like login and reclassification, it does not give any guidance about how to do login or reclassification correctly. It merely allows such procedures to be represented; this cannot be done in a straightforward way with previous models.>

Some issues in distributed system security are discussed in the context of the design of a secure distributed operating system (SDOS). The design is targeted for an A1 rating. Some developments in formal verification methods are reported. Distributed system security is contrasted with single-host and network security, and described in the context of the Trusted Network Interpretation. Problems unique to distributed system security are discussed. An argument is made for implementing security features in higher layers, corresponding roughly to the session through application layers of the OSI model. A security policy based on message-passing rather than reads and writes is described. The SDOS design is summarized.>