Security kernels are now emerging from the R&D community. Unfortunately the quality of these systems has not lived up to original expectations. While useful for allowing users of various security levels to share common hardware, the original problem that they were designed to solve, security kernels are less than ideal for solving applications that are truly multi-level, the problem that now needs to be addressed. Based upon experience gained in both the use and limitations of security kernels, recommendations are provided as to where the next thrust for providing secure systems should proceed.

A methodology for demonstrating the security of trusted applications on a security kernel base is presented. The methodology consists of selecting and authenticating security criteria, and demonstrating through verification techniques that the implementation obeys the selected criteria. Difficulties encountered in the placement of a trusted application on top of a security kernel base motivated the development of the methodology.