Adding Security to Commercial Microkernel-Based Systems

The proposed work investigates the feasibility of integrating state of the art technologies for security and assurance with emerging commercially available computing systems. The study will use the Spring system currently under development by SunSoft as a representative commercial grade system. Spring is an object-oriented, microkernel-based, distributed operating system that supports Unix compatibility through a Unix emulation. The study will identify deficiencies in Spring's support for high security, enhancements to Spring that could address those deficiencies, the assurability of Spring, and negative impacts that the enhancements might have on Spring applications. This work will build on work Secure Computing has previously done on the DTOS program. In particular, the DTOS approach of providing flexible support for security will be used. This will allow the system to support both Government (for example, multilevel) and commercial (for example, integrity) policies. Key issues to be considered include tangible benefits that would result from the security enhancements and the cost of securing and assuring the system.