A Minimal Trusted Computing Base for Dynamically Ensuring Secure Information Flow

With each passing year, more and more valuable, confidential information is stored in government and commercial computer systems. Ensuring the security of those computer systems is a challenge with social, political, and technological aspects; computer networks, however, make the technological aspects particularly important as computer systems are exposed to assault from remote sites. Two critical components of the technological computer security problem are access control and data dissemination control. Access control mechanisms prevent unauthorized parties from accessing (e.g. reading, modifying, or executing) confidential data or programs. Data dissemination control mechanisms prevent confidential data from being exposed to unauthorized parties, either by accident or due to malicious code which has gained read-access to the data; e.g. a malicious or erroneous program should never be able to read a “Top Secret” value and write it out as an “Unclassified” result. In this memo we present two contributions addressing the problem of controlling data dissemination, also known as ensuring secure information flow. First, we present a sound, flexible model which dynamically ensures secure data flow with respect to a lattice-based information flow policy, with security classification on a per-word basis. Second, we present a set of hardware mechanisms, most notably the Hash Execution (HEX) unit, which enable the practical implementation of our model. We believe that recent trends in logic and memory density and costs make the architectural overhead of our mechanisms small, and that they are more than offset by the significant benefits they bring to system security. Our dynamic strategy has several advantages over static (compile-time) verificationof secure information flow. It