If sensitive information is to be included in a shared Web, access controls will be required. However, the complex software needed to provide a Web service is prone to failure. To provide access control without relying on such software, encryption can be used. Bob is a prototype system that supports complex access control expressions through the transparent use of encryption.

Modern interconnected computer systems handling classified information can be built using mainstream COTS software platforms. The technique provides each user with a private desktop in which to work, along with services for sharing data. Within a desktop, the user is helped to label their data. When data is shared, labelling prevents accidental compromise, but other measures defend against other forms of compromise. Purple Penelope is a prototype that extends Windows NT security to support this approach. It adds discretionary labelling, easy-to-use role-based access controls and effective accounting and auditing measures to shared files.

It is shown how compartmented mode workstation (CMW) technology can be used as the basis of simple assured firewalls, where the vast majority of the evaluation effort required is reused from the evaluation of the CMW. The generic bastion host architecture described provides ITSEC E3 assurance that the unevaluated proxies cannot be bypassed. Assurance that the inappropriate export of information is prevented, can be gained by extending a trusted path export sanction from the user's desktop to an evaluated release checker in the firewall.

A form of security labelling is added to a COTS object relational DBMS. The labelling is discretionary and so provides mediated access to data, but does not defend against the inappropriate release of data through the database, whether by Trojan Horse software or a treacherous user. To counter these risks, business constraints are imposed to ensure that a user sanctions the release of any data and adequate business related accounting information is recorded. The business constraints are implemented using the features of the object relational DBMS.

Some new security models are presented as a means of understanding the complexities of the Compartmented Mode Workstation dual-label design and the different implementations that are available. The security models, which are based upon a realistic abstraction of a computer, have floating security labels. The models are pessimistic, in that they assume that if information is potentially able to flow then it does so. The models vary in their degrees of pessimism, and thus provide different guarantees about the accuracy of a security label.>

Although much work has been performed in the areas of database design and MLS DBMSs, little has been done to marry the two areas together. It is shown that the implementation of a secure database design is not a trivial matter. Two MLS DBMSs, SWORD and SeaView, are used to demonstrate the problems of implementing simple secure application requirements.>

It is proposed that all database security controls except those which provide information flow security can be built using a suitable trigger mechanism. The implementation of an example application, which has a variety of requirements for confidentially, integrity and accountability, is shown to illustrate the technique. The trigger mechanism is to be implemented using query modification as part of the SWORD secure database management system project.>

The author discusses the relationship between confidentiality controls, integrity controls and security. There are two kinds of integrity control, defensive checks and voting, and confidentiality controls are an example of automated voting. He discusses polyinstantiation and database security. He looks at SWORD designed for databases. Polyinstantiation is only unavoidable when an operating system's security controls are used to build a secure database.>

A model of security is presented which integrates notions of confidentiality and integrity. This model has been developed to fulfil the needs of the RSRE SMITE project because existing modeling approaches proved to be inadequate. The authors introduce the model and subsequently compare and contrast it with existing approaches. Both an inductive confidentiality property and a noninductive integrity property have been modeled. To successfully utilize the second property, the authors have used an approach whereby the noninductiveness is absent in the model, but appears in proof obligations on refinement.>

If signaling channels can only be driven by a trusted path, they cannot be exploited by trojan horses in untrusted software. To this end, the SMITE secure computer system provides a general-purpose trusted path, based on a screen editor, which would act as the users' normal interface to the system. The feasibility of the approach relies on the use of a sympathetic computer architecture, which supports a fine grain of protection. The authors describe the trusted path and the user interface of the SMITE system. They discuss the formal specification of the display functions. They examine the use of SMITE for high-assurance applications.>

A secure computer system based on a capability architecture is described. Abstract types are used to provide separation and the reference monitor function. By providing a trusted path from the user to security critical operations, full discretionary and mandatory access controls are enforced.