Approved by

This report is based on work at FFI towards the potential realization of a certifiable workstation for handling multiple security classifications. To realize such a solution based on the use of a MILS separation kernel, it is deemed essential to have a secure way to share the keyboard, mouse, and screen between partitions. We propose a design for this where it is ensured through the configuration of the separation kernel that data cannot flow between user partitions (i.e., classification levels), thereby simplifying the certification of such a system. The principal design can be generalized to handle all devices that are used either as purely input or purely output devices and it is also described in this report how the proposed solution can be applied to a touchscreen device. A basic proof-of-concept prototype has been implemented and was demonstrated as part of the SOA Pilot at FFI in June 2011. This prototype adheres to the principal design, but does not represent a certifiable implementation. The realization of the full potential of such a system depends on the existence of a separation kernel certified on suitable hardware. The last chapter of this report therefore provides an overview of the current status with regard to certification of separation kernels, before a discussion of potential ways forward