Program confinement in KVM/370

Abstract

One aspect of producing secure operating systems involves the confinement of programs. This paper discusses the program confinement problem as addressed by the developers of a retrofitted version of the IBM VM/370 virtual machine monitor. This version of the system (called KVM/370) uses a security-kernel architecture to provide a provably secure multi-level environment for Department of Defense computer operations.

A Study of Covert Communications in Space Platforms Hosting Government Payloads

“…Other definitions exist. For example, Schaefer et al stated that a covert communication channel exists if it is based on "transmission by storage into variables that describe resource states" [15].…”

A Channel Analysis in Network Security - Using a Covert Approach

“…If done on local basis with most resource management decisions performed by the system global and perfunctory reconciliations performed by the kernel, the opposite results hold system design, implementation, verification and interfaces are simplified, while system performance may be adversely affected. This basic definition if further analyzed in [3,4] Two parties can communicate in secret if they already share a sufficient quantity of secret information; these analyses elaborate on the concept by associating covert channels with resource allocation policies, shared resources at different system security levels, resource state variable that can be linked with communication taking place within the system [5,6] A resource state variable, for instance, is any system variable that can be used by a covert channel to signal information from one point to another with in the system. For example, a variable showing files status at several points (states) in the system.…”

A Guide to Understanding Covert Channel Analysis of Trusted Systems

“…The specifications of the allocator must contain explicit "allocate/deallocate" (TCB) operations that can be invoked dynamically and that subjects can share. A covert channel between the subjects using these user-visible objects exists here [Schaefer77]. However, if the dynamic allocator and, consequently, its specifications are changed to disallow the dynamic allocation/deallocation of objects in a shared memory area, the covert channel disappears.…”

“…The notion of covert communication was introduced in [Lampson73] and analyzed in [Lipner75,Schaefer77,Huskamp78,Denning83,Kemmerer83], among others. Several definitions for covert channels have been proposed, such as the following:…”

“…[Schaefer77] * Definition 3 -Covert channels "will be defined as those channels that are a result of resource allocation policies and resource management implementation." [Huskamp78] (Note: The computing environment usually carries out resource allocation policies and implementation.…”