During the past several years, interest in architectures for multilevel secure versions of the X Window System (X) has grown dramatically, primarily in the compartmented mode workstation (CMW) community. The architectures and security policies implemented in existing CMWs are similar to each other, although they differ in certain key details. Alternatives to the current approaches are being investigated. Most notably, a TRW-led team of researchers has designed and prototyped a trusted X implementation aimed at the trusted computer systems evaluation criteria (TCSEC) B3 level. The architecture and security policies adopted by this implementation differ radically from those of all the existing CMWs. The architectures and security policies implemented in existing CMWs and the TRW prototype are surveyed, areas of commonality and divergence are identified, and areas where interoperability can be achieved are noted.>

The X Window System (X) has become one of the most popular window systems available. However, to use X in a trusted environment, a variety of security issues must be addressed. Among these issues is how to mediate interwindow data moves in a manner consistent with a system's security policy. Current interpretations of existing security requirements state that interwindow moves must be subject not only to traditional access controls, but also that users must be able to perform certain operations as the data is being moved (such as review the data, or alter the data's security attributes). The paper presents the issues involved in meeting the security requirements, and describes and contrasts two possible approaches for addressing those issues.>

The primary goal of the MITRE compartmented mode workstation (CMW) project was to articulate the security requirements that workstations must meet to process highly classified intelligence data. As a basis for the validity of the requirements developed, a prototype was implemented which demonstrated that workstations could meet the requirements in an operationally useful manner while still remaining binary compatible with off-the-shelf software. The security requirements not only addressed traditional security concerns but also introduced concepts in areas such as labeling and the use of a trusted window management system. The CMW labeling paradigm is based on associating two types of security labels with objects: sensitivity levels and information labels. Sensitivity levels describe the levels at which objects must be protected. Information labels are used to prevent data overclassification and also provide a mechanism for associating with data those markings that are required for accurate data labeling, but which play no role in access control decisions. The use of a trusted window manager allows users to easily operate at multiple sensitivity levels and provides a convenient mechanism for communicating security information to users in a relatively unobtrusive manner.>

The Defense Intelligence Agency (DIA) recognized that commercially available workstations could significantly enhance the capabilities of today's Intelligence Data Handling Systems (IDHS) if they could be integrated with the IDHS systems in a secure manner. The Compartmented Mode Workstation (CMW) project was started at the request of the DIA to further the state-of-the-art of computer security in general and workstation security in particular. The prototype effort had two major purposes. The first purpose was to demonstrate that operationally useful implementations of each requirement could be designed and developed. The second, more general, purpose was to gain insight into what measures could be taken to augment commercially available workstations with meaningful security. Therefore, as the Security Requirements for System High and Compartmented Mode Workstations [CMWREQS] were stated, a development team attempted to implement thereon the CMW prototype. Viable approaches were found for all requirements thereby verifying the premise that a workstation and its associated operating system could be modified such that off-the-shelf software (distributed in binary form) could execute with adequate security .This paper describes compartmented mode operation, how the prototype satisfied each requirement, and the level of effort involved in the prototype implementation.

The Compartmented Mode Workstation project (CMW) is an effort to provide a prototype implementation of enhanced computer security features on a workstation. The ultimate goal of this project is to demonstrate that the compartmented mode workstation requirements detailed in "Security Requirements for System High and Compartmented Mode Workstations" [CMWREQS] can be met in an operationally useful manner. One of the necessary security enhancements that must be made to a workstation is the inclusion of a comprehensive auditing facility. For any computer system to be considered secure, it must have the ability to generate and store audit information on significant events. This information shall then be provided to authorized personnel for security and system monitoring. This document describes the design and implementation of the CMW'S auditing subsystem. The auditing subsystem was developed in conjunction with other parts of the total CMW project.