Developing and Using a “Policy Neutral” Access Control Policy

The foundation for security enforcement is access control. Re-sources must be protected against access by unauthorized entities. Furthermore, authorized entities must be prevented from accessing resources in inappropriate ways. A major challenge to the devel-oper of an access control policy is to provide users the flexibility to protect their resources as they see fit; system policies that are inconsistent with user needs are inadequate. In particular, systems that enforce a single, hard-coded policy cannot satisfy the needs of all users. As part of the Distributed Trusted Operating System (DTOS) program, we have developed and implemented a flexible security architecture using the Mach microkernel. In this architecture, the security rules enforced by the system are defined by a system com-ponent outside the microkernel. This reduces the problem of sup-porting other security policies to redefining this system component; the same microkernel can be used to support a wide range of policies. Formal methods were used to provide a rigorous approach for the development of the policy. Recognizing that most people are uninterested in reading security requirements stated in formal speci-fication languages, an approach was developed for representing and maintaining the policy in a tabular format. This paper describes the flexibility of the DTOS security architecture and the approach used in developing the access control policy for this flexible architecture. It also gives examples of how to define a component that makes security decisions for the microkernel.1