Fortresses built upon sand

Abstract

The current "trusted system" paradigm is built upon the notion of a Reference Monitor that assumes the existence of a well-defined security policy, a bounded system entity, and a centralized reference validation mechanism with knowledge of and control over the system entity. The "trusted system" paradigm is hierarchical: management defines the policy, the hardware and system software that comprise the trusted computing base enforce the policy, and applications must conform to the policy. This paradigm acknowledges that applications depend upon the hardware and operating system on which they run, and that assurance that they will execute safely is derivedfiom the strength of this "trusted computing base. "