This paper describes the architecture of a prototype multilevel secure windowing system based on the X Window System. The prototype, known as TX, is designed to meet the class B3 architectural requirements of the Trusted Computer System Evaluation Cr

The early issues, obstacles, and ultimate achievements of Phase II of the US DARPA Advanced Computing Systems project to develop a proof-of-concept prototype for a B3 X-Window system on a TMach base are described. The present work defines initial project goals, presents an overview of X, and describes system objectives. The major implications of meeting the B3 trust criteria and the constraints of building the Trusted X prototype on the TMach system (itself a prototype) are described. The reader is led through the process of Trusted X evolution from an initial architecture requiring a large and complex TCB to an architecture based on task polyinstantiation greatly simplifying the TCB.>

Multilevel secure windowing systems are a key technology for the 1990s. The authors have spent 20 months designing and implementing a prototype of a multilevel secure X Window System as a proof of concept vehicle for their software engineering process model for the development of trusted systems. The prototype is targeted to B3 evaluation criteria. In the early stages many doubted that B3 was achievable for a windowing system (especially X); the prototype demonstrates that B3 is achievable. The paper describes the goals, the architecture of the system, and some of the trade-offs made to achieve the goals. It also contrasts the work with existing compartmented mode workstations (CMW) windowing systems.>

TMail is a privacy-enhanced electronic mail system on a trusted operating system base. A description is given of the TMail cryptographic processes that protect the mail in transit from disclosure, detect modification, and assure source authentication. The trusted operating system is used to protect the mail and the cryptographic modules on the host system. The trust requirements for the system are discussed. Both aspects of the system, cryptography and trust, are needed to assure protection for the mail within the broader system in which it exists.>

An architecture especially adept at security support is outlined. The architecture's fundamental information unit is a two-tuple, or ordered pair, consisting of a datum word and an associated security tag. As an atomic information unit, the two-tuple moves around through the architecture in unison as processing proceeds. a security subprocessor always operates on a security tag in synchrony with a fairly ordinary data subprocessor's operation on the associated datum word. The coupled subprocessors provide the overall architecture with efficient, multilevel-secure access control and flow control. The proposed architecture represents the advancement of security technology along a unique combination of three fronts: (1) direct hardware support, (2) fine-grained-to-the-word mediation, and (3) optimal (minimal) result classification. >

This paper presents the initial results of a DARPA-funded research effort to define a development paradigm for high-performance trusted systems in Ada. The paradigm is aimed at improving the construction process and the future products of Ada systems that require both broad trust and high performance. The need for a process model and the notions of trust and assurance are reviewed. The foundation for the process model and its elements are presented. The process model is contrasted with traditional development approaches. The combination of a risk driven approach with the integration of trust and performance engineering into a unified whole appears to offer substantial advantages to system builders.>

The authors describe how mandatory and discretionary access mediation are performed in the trusted mach (TMach) kernel, a system that uses message passing as its primary means of communication both between tasks and with the kernel. As a consequence, control of interprocess communication in the TMach kernel is a central concern whereas controlled sharing of segments is the central focus in trusted systems with more traditional architectures. The TMach kernel is not a complete trusted system. It is a reference monitor of basic system abstractions, providing a small, well-controlled base on which the rest of a trusted computing base and operating system can be constructed. The TMach kernel provides simple and elegant mandatory access control for port access rights. The TMach kernel's MAC (mandatory access control) mechanisms clearly control the flow of information according to a mandatory security policy based on a Bell and La Padula model. DAC (discretionary access control) mechanisms are provided in the TMach kernel to implement TCSEC (trusted computer system evaluation criteria) requirements and to support DAC in servers to be built on the kernel.>

Software Engineering Project Standards (SEPS) and their importance are presented in this paper by looking at standards in general, then progressively narrowing the view to software standards, to software engineering standards, and finally to SEPS. After defining SEPS, issues associated with the selection, support, and use of SEPS are examined and trends are discussed. A brief overview of existing software engineering standards is presented as the Appendix.