Abstract-This paper describes the development of a virtualmachine monitor (VMM) security kernel for the VAX architecture. The paper particularly focuses on how the system's hardware, microcode, and software are aimed at meeting Al-level security requirements while maintaining the standard interfaces and applications of the VMS and ULTRIX-32 operating systems. The VAX Security Kernel supports multiple concurrent virtual machines on a single VAX system, providing isolation and controlled sharing of sensitive data. Rigorous engineering standards were applied during development to comply with the assurance requirements for verification and configuration management. The VAX Security Kernel has been developed with a heavy emphasis on performance and system management tools. The kernel performs sufficiently well that much of its development was carried out in virtual machines running on the kernel itself, rather than in a conventional time-sharing system. Index Terms -Computer security, virtual machines, covert channels, mandatory security, discretionary security, layered design, security kernels, protection rings.

This paper describes the development of a virtual-machine monitor (VMM) security kernel for the VAX architecture. The paper particularly focuses on how the system's hardware, microcode, and software are aimed at meeting Aleffort has bccn primarily aimcd at identifying the differences and their cost in development effort and in kernel complexity.This paper dcscribes how the VAX security kcrncl meets its five InajOr goals:* Mcet all AI security rcquircments.levcl security requirements while maintaining the standard interfaces and applications of the VMS and ULTRIX-32 operating systems. The VAX security kcrncl supports multiple Run on commercial hardware without special modifications other than microcode changcs for virtualization.concurrent virtual machines on a single VAX system, providing isolation and controlled sharing of sensitive data. Rigorous engincering standards were applied during devclopmcnt to comply with the assurance requirements for verification and configuration management. The VAX security kcrncl has been dcveloped with a heavy emphasis on performance and on system managemcnt tools. The kcrnel pcrforms sufficicntly well that all of its development is now carricd out in virtual machines running on the kcrnel itself, rather than in a conventional time-sharing system.