Using mandatory integrity to enforce 'commercial' security

Abstract

Government research, development, and standardization efforts in computer security have been repeatedly criticized as not being applicable to the commercial world. In particular, they have been criticized as not being able to support the kinds of security policies, such as separation of duties and well-formed transactions, used by the financial and other communities to control unauthorized changes to or falsification of information. It is shown two natural extensions-integrity categories and partially trusted subjects-of the principles of current US Department of Defense computer security standards could be used to implement such commercial security policies in a way that exploits the fundamental strengths of existing or future trusted systems.<>