A Domain and Type Enforcement UNIX Prototype (1996)
| Venue: | In Proceedings of the Fifth USENIX UNIX Security Symposium |
| Citations: | 67 - 1 self |
BibTeX
@INPROCEEDINGS{Badger96adomain,
author = {Lee Badger and Lee Badger and Daniel F. Sterne and Daniel F. Sterne and David L. Sherman and David L. Sherman and Kenneth M. Walker and Kenneth M. Walker and Sheila A. Haghighat and Sheila A. Haghighat},
title = {A Domain and Type Enforcement UNIX Prototype},
booktitle = {In Proceedings of the Fifth USENIX UNIX Security Symposium},
year = {1996},
pages = {127--140}
}
Years of Citing Articles
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
UNIX system security today often relies on correct operation of numerous privileged subsystems and careful attention by expert system administrators. In the context of global and possibly hostile networks, these traditional UNIX weaknesses raise a legitimate question about whether UNIX systems are appropriate platforms for processing and safeguarding important information resources. Domain and Type Enforcement (DTE) is an access control technology for partitioning host operating systems such as UNIX into access control domains. Such partitioning has promise both to enforce organizational security policies that protect special classes of information and to generically strengthen operating systems against penetration attacks. This paper reviews the primary DTE concepts, discusses their application to IP networks and NFS, and then describes the design and implementation of a DTE UNIX prototype system.
