OMCPOSIBILITY CONSTRAINTS OF MULTILEVEL SYSTEMS

The NCSC evaluates the trustworthiness of computing systems and places them on the Evaluated Products List (EPL). Rare is the time when a monolithic computing system will meet an organization's needs. Rather, systems integrators are called upon to integrate differing hardware platforms and software suites. The EPL is composed on monolithic systems. There is no list of trusted integrated products. This makes the accreditor's job difficult, because a DAA can rarely implement a system directly from the EPL. The Trusted Database Management Interpretation of the TCSEC (TDI) was produced partially as a result of this problem. Although the TDI is geared primarily to DBMSs, it can also be used to evaluate parts of the systems. Putting those parts together is difficult because there is no guidance for accreditors on how these TCB subsets can be securely connected. How does one compose a collection of trusted systems? This is the composibility problem. A model is needed for system developers, integrators, accreditors, and others who must take trusted system components (some of which may be multilevel) and create a system that not only operates but operates securely. This proposal addresses composibility from the viewpoint of an integrator, an evaluator, and an investigator.