A security property for trusted multilevel systems, restrictiveness, is described. It restricts the inferences a user can make about sensitive information. This property is a hookup property, or composable, meaning that a collection of secure restrictive systems when hooked together form a secure restrictive composite system. It is argued that the inference control and composability of restrictiveness make it an attractive choice for a security policy on trusted systems and processes.>

The problem of composability of multilevel security properties, particularly the noninterference property and some of its generalizations, is discussed. Examples are used to show that some of these security properties do not compose; it is possible to connect two systems, both of which are judged to be secure, so that the composite system is not secure. A property called restrictiveness is introduced that is generally composable, so that two restrictive systems connected legally result in a new restrictive composite system. A novel feature in the brief discussion of restrictiveness is a state-machine version of the property.>

In this paper, we give a brief description of several formalisms for computer security, and discuss some of the problems in their interpretation and application. We define the property of "hook-up security", which can be shown to imply that a collection of hook-up secure systems can be hooked up to form a secure complex system. We believe this result addresses some of the problems with other definitions of security, and will be valuable in the design of large secure systems from simpler secure components.