by John Rushby
In Eighth ACM Symposium on Operating System Principles
http://www.csl.sri.com/reports/postscript/sosp81.ps.gz
Add To MetaCart
Abstract:
This paper reviews some of the difficulties that arise in the verification of kernelized secure systems and suggests new techniques for their resolution. It is proposed that secure systems should be conceived as distributed systems in which security is achieved partly through the physical separation of their individual components and partly through the mediation of trusted functions performed within some of those components. The purpose of a security kernel is simply to allow such a `distributed ' system to actually run within a single processor; policy enforcement is not the concern of a security kernel. This approach decouples verification of components which perform trusted functions from verification of the security kernel. This latter task may be accomplished by a new verification technique called `proof of separability ' which explicitly addresses the security relevant aspects of interrupt handling and other issues ignored by present methods.
Citations
|
394
|
Secure computer systems: Unified exposition and MULTICS interpretation
– Bell, LaPadula
- 1976
|
|
342
|
Proofs of correctness of data representations
– Hoare
- 1972
|
|
240
|
A note on the confinement problem
– Lampson
- 1973
|
|
231
|
Certification of programs for secure information flow
– Denning, Denning
- 1977
|
|
34
|
KSOS: The Design of a Secure Operating System
– McCauley
- 1979
|
|
31
|
A provably secure operating system: The system, its applications, and proofs
– Neumann, Boyer, et al.
- 1980
|
|
29
|
Proving multilevel security of a system design
– FEIERTAG, LEVITT, et al.
- 1977
|
|
29
|
Specification and verification of the UCLA Unix security kernel
– Walker, Kemmerer, et al.
- 1980
|
|
25
|
A Comment on the Confinement Problem
– Lipner
- 1975
|
|
23
|
Security kernel validation in practice
– Millen
- 1976
|
|
14
|
A Model for Verification of Data Security in Operating Systems
– Popek, Farber
- 1978
|
|
9
|
Proof of Separability—A verification technique for a class of security kernels
– Rushby
- 1982
|
|
9
|
Applications for multilevel secure operating systems
– Woodward
- 1979
|
|
6
|
Security kernels: A solution or a problem
– Jr
- 1981
|
|
5
|
Issues in kernel design
– Popek, Kline
- 1978
|
|
4
|
KSOS--computer network applications
– Padlipsky, Biba, et al.
- 1979
|
|
4
|
A verifiable protection system
– Popek, Kline
- 1975
|
|
3
|
Demonstrating security for trusted applications on a security kernel base
– Keeton-Williams
- 1980
|
|
3
|
Systems architecture for security and protection
– Anderson
- 1974
|
|
3
|
Secure personal computing (technical correspondence
– Auerbach
- 1980
|
|
3
|
Computer security in the RSRE PPSN
– Barnes
- 1980
|
|
3
|
Barksdale Jr. KSOS|development methodology for a secure operating system
– Berson, L
- 1979
|
|
3
|
The SDC communications kernel
– Golber
- 1981
|
|
3
|
Assertions for verification of multilevel secure military message systems
– LANDWEHR
- 1980
|
|
3
|
Intelligent X25 level 2 line units for packetswitching
– Martin, Parks
- 1980
|
|
3
|
et al. Software development and proofs of multi-level security
– Neumann
- 1976
|
|
3
|
et al. UCLA secure UNIX
– Popek
- 1979
|
|
3
|
Quoted by P. zave in report of a panel session from specifications of reliable software conference
– Robinson
- 1979
|
|
2
|
verification plan
– KSOS
- 1978
|
|
2
|
et al. A security retrofit of VM/370
– Gold
- 1979
|
|
2
|
LSI guard system specification (type A
– Hathaway
- 1980
|
|
2
|
Operating system security verification
– Millen
- 1979
|
