A formal framework called Security Logic ( SL ) is developed for specifying and reasoning about security policies and for verifying that system designs adhere to such policies. Included in this modal logic framework are definitions of knowledge, permission, and obligation . Permission is used to specify secrecy policies and obligation to specify integrity policies. The combination of policies is addressed and examples based on policies from the current literature are given.

The network security model originally developed for the SNet secure system is generally applicable to all secure networks. Although it was recognized that allowing message loss in the model permits a covert channel, this operational model was accepted on an intuitive basis as enforcing some concept of secrecy. The paper presents a formal argument that the model, augmented with a no-loss requirement, does indeed satisfy a formal abstract secrecy policy. This secrecy policy, called INF, has previously been defined in terms of security logic. The proof contains two steps. First, the network model augmented with a no-loss requirement (and called NM) is shown to satisfy the non-deducibility (ND) condition. ND satisfies INF, therefore, NM satisfies INF.>

A formal framework called security logic (SL) is developed for specifying and reasoning about security policies, and for verifying that system designs adhere to such policies. Included in this framework is a definition of knowledge based on modal logic so that properties can be time-related, a definition of permission, and a definition of obligation. Permission is used to specify secrecy policies, and obligation is used to specify integrity policies. A security policy is given as a set of policy constraints on the SL model. The combination of policies is addressed. Examples based on policies from the current literature are given.>

It is suggested that the notion of obligation found in modal logic can be used as the fundamental notion in formally specifying integrity. Integrity as represented by Clark-Wilson-type models is discussed. It is argued that the essential part of their model, for the purpose of formal specification, is an expression of required connectivity in a graph representing integrity subjects. A review of knowledge logic is given, followed by a discussion of a logic of security that contains operators for knowledge and obligation. A formal semantic definition of integrity based on operator nets is given.>

A method for reasoning about knowledge in multilevel secure distributed systems is introduced. This method, based on a behavioral semantics for operator nets, can be used to specify a variety of security properties such as nondisclosure, integrity, and authority systems. The major attributes of the method are the intuitive nature of the specifications and the expressibility of the model, which allows statements about temporal properties and deductive capabilities of processes.>

A security model for the SNet multilevel secure distributed system, bawd on a behavioral semantics for operator nets and expressed in Lucid, is described. This model subsumes a previously published model of the network within SNet and includes authorized downgrading as well as the security policies enforced by trusted hosts connected to the network. The previous model is based on seven rather ad hoc constraints without presenting a coherent argument regarding security. The model described in this paper provides a more general abstract model than is provided by those' seven constraints.

RNet is a high-level programming system for building and executing distributed hard real-time programs. The main objective in developing RNet is to investigate how high-level programming concepts and tools can be used to simplify the real-time programming task. A distributed real-time program in RNet consists of a configuration specification that outlines the structure and real-time properties of the program, and a set of program modules written in a high-level programming language. The RNet configuration system performs a static feasibility analysis of the specifications and handles the construction, distribution, and execution of the program. A debugging and timing analysis system, currently under development and not described here, will be used to measure the real-time characteristics of network resources and the application program, and to perform a validation of the specifications via simulation. The distributed RNet kernel provides run-time support for message-passing and real-time scheduling. The RNet programming model, based on message ports having associated deadlines, provides the programmer with a direct means of expressing a variety of real-time behavioral effects in a way that can be validated. In particular, timing constraints can be used to obtain reliable event synchronization. Some properties that are considered desirable in a high-level distributed real-time programming system are identified. These address issues such as program moduilarity and reconfigurability, timing constraint specification, validation and enforcement, real-time event handling, I/O and exception handling, logical and physical structure specification, and program analysis. The degree to which RNet succeeds in possessing these properties is discussed.

This paper describes current work on the design and specification of a multilevel secure distributed system called SNet. It discusses security models in general, the various problems of information flows in SNet, and the abstract and concrete security model components for SNet. It also introduces Lucid as a language for specifying distributed systems. The model components are expressed in Lucid; these Lucid partial specifications are shown to be correct with respect to the formal model, and the two model components are shown to be consistent. The complete functional specification of SNet in Lucid, its implementation in Concurrent Euclid, and the verification of the implementation with respect to the Lucid specification are not discussed.

We are interested in multi-level secure networks in which the host systems are required to conform to a multi-level security policy such that information is constrained to flow between hosts only in certain ways. The problem of interest is how to most efficiently block such flows in the face of the threat of untrusted software running on the communication sub-network processors and on all or some untrusted hosts. A model for secure transmission and a possible solution which we feel satisfies certain criteria are presented. The solution, however, relies on the assumption of a highly reliable sub-network. Consequently, it is likely to find application as a mechanism to implement multi-level security by inter-connecting, on a local network, untrusted hosts operating at different levels.

This paper describes the design of a prototype experimental secure operating system kernel called xsl that supports compile-time enforcement of an information flow policy. The security model chosen is an extension of Feiertag's model modified to state requirements in terms of program analysis functions. A prototype flow analyzer for Pascal programs, based on Denning's model, has been designed and implemented for incorporation into xs1. In addition, a flow analyzer, based on London's model, has also been designed and implemented. Both kinds of enforcement are supported in xsl. Both program anallyzers use an intermediate code program representation, originally designed for code optimization. Implementation of the flow analyzers is in Euclid with the remainder of xsl in PascaL

This paper describes a compile-time information flow control (IFC) mechanism that certifies secure information flow within the collection of objects accessed by a program. The IFC mechanism is based on the lattice model and certification mechanism of Denning, who proposes the use of the mechanism during the analysis phase of compilation. However, IFC is placed after semantic analysis and before code optimization by ufilizing an intermediate code representation. This reduces the complexity of IFC and allows a degree of language independence. An implentation has been developed for Pascal.

Abstract In the course of developing a programming project for a course in operating systems, a general purpose language (Burroughs B6700 Algol) possessing concurrency and semaphores was used to provide a process oriented simulation sequencing facility. This facility has been used successfully to simulate several simple operating systems. The facility comprises three procedures along with ‘simulation semaphore’ variables. The first procedure, when called, inserts a simulated time delay into the progress of a simulation model process: the latter two procedures provide a P and a V operation on simulation semaphores, and are used to synchronize processes in a simulation model. The P operation may insert a simulated time delay into the progress of a process. These procedures are explained and presented along with a simple example to show their use.

No abstract available.

A queueing model of movable-head disk storage systems is developed so that the performance, as measured by the mean response time, can be calculated.Queue scheduling algorithms which improve the performance are considered.Single-module disk systems are analyzed, incorporating the SCAN scheduling algorithm suggested by Denning so that comparisons with the FIFO algorithm are possible.This analysis is extended to multimodule systems whereby tables of approximate glean response values time can be calculated over system parameters describing equipment characteristics, equipment configuration, system loading, file organization, and scheduling algorithm (SCAN or FIFO).The use of such tables is discussed and the applicability of the analysis to a recently marketed disk is noted.