Outline for May 28, 1997

1.	Greetings and Felicitations

2.	ORCON (Originator Controlled; Graubert) 

a.	Document/information can be passed on with approval of originator; real world 
justification is that originator of document trusts recipients not to release docu-
ments which they should not. 

b.	Untrusted subject x marks object O ORCON on behalf of organization X and indi-
cates it is releasable to subjects acting on behalf of organization Y.  not  releasable 
to subjects acting on behalf of other organizations without X's permission, and any 
copies made have the same restriction 

c.	DAC: can't do this as the restriction would not copy over (y reads O into C, puts its 
own ACL on C) 

d.	MAC: separate category with O, x, y. y wants to read O, copy to C; MAC means C 
has same category as O, x, y, so can't give z access to C. Say a new organization 
w wants to provide data in B to y but not to be shared with x or z. Can't use O's 
category. Hence you get explosion of categories. Real world parallel: individuals 
are "briefed" into a category and those represent a formal "need to know" policy  
that is standard across the entity; ORCON has no central clearinghouse to cate-
gorize data; originator makes  rules. 

3.	Solution? 

a.	Owner of object can't change ACL's relationship with object (MAC characteristic) 

b.	On copy, ACL is copied as well (MAC characteristic) 

c.	Access control restrictions can be tailored on a per-subject/object basis (DAC 
characteristic) 

4.	Verifiably Secure Systems

a.	Reference monitors; use them to isolate all access control functions into a small 
nucleus; the „security kernel¾

5.	UCLA Secure UNIX

a.	Each user process in separate domain, with 2 parts: the application program level 
(user mode) and the UNIX interface/Kernel Interface SubSystem level (supervisor 
mode)

b.	Protection domains set by C-Lists

c.	Policy manager manages policies for kernel objects, shared files

d.	Dialoguer provides trusted path between user, terminal

6.	KSOS (Kernel Secure Operating System)

a.	Complete OS (not a security kernel)

b.	Enforces access control policy and multilevel security

c.	Handles files and type extensions

d.	UNIX emulator, „trusted¾ non-kernel system software run in supervisor mode

7.	PSOS (Proveably Secure Operating System)

a.	Levels of abstraction

b.	For PSOS:
17.	command interpreter
16.	user environments, name space
15.	user I/O
14.	procedure records
13.	user processes, visible I/O
12.	creation, deletion of user objects
11.	directories
10.	abstract data aypes
9.	virtual memory (segmentation for PSOS)
8.	paging
7.	system processes, system I/O
6.	primitive I/O
5.	basic arithmetic, logical operations
4.	clocks
3.	interrupts
2.	real memory (registers, main store)
1.	capabilities