1. A Multi-OS Approach to Trusted Computer Systems
Based on:
H. Yoshiura et. al., “A Multi-OS Approach to Trusted Computer Systems”, Security Protocols, LNCS 2467, pp , 2002.
Kenji Sumida
COMPSCI 725 FC 2003

2. Summary
Aims to find a secure system which can be implemented in the private sector
Problems: Efficiency vs. Security, Cost
Use two operating systems
A “user” OS (insecure) and “monitoring” OS (secure)
Multi-OS controller (MOC) switches from the user OS to monitoring OS when required
Aims to provide “best of both worlds”
Flexibility and usability of user OS, and security of monitoring OS

3. Appreciative/Critical Comments
Easy to comprehend
Does not present a real world example
Orange book may not be a relevant measure for private sector businesses
Considers both online attacks and offline attacks
Good that it considers offline attacks
But makes many assumptions  (even with online attacks)
We will see this in an example in the next two slides

4. An example system: implementing MAC

5. Online attacks To the example system
Attacks to the User OS
Assume access requests go through the required processes
Attacks to the Monitoring OS
Assume it is adequately secure
Attacks to the MOC
Apparently under research and the paper does not expand on this further
No real evidence that the system works

6. Question
Is it a reasonable assumption made by the authors that all requests to the file system made by user processes are hooked by the MOC, and control passed to the Monitoring OS?