A retrospective on the VAX VMM security kernel

Abstract-This paper describes the development of a virtual-machine monitor (VMM) security kernel for the VAX archi-tecture. The paper particularly focuses on how the system’s hardware, microcode, and software are aimed at meeting Al-level security requirements while maintaining the standard interfaces and applications of the VMS and ULTRIX-32 operating systems. The VAX Security Kernel supports multiple concurrent virtual machines on a single VAX system, providing isolation and con-trolled sharing of sensitive data. Rigorous engineering standards were applied during development to comply with the assurance requirements for verification and configuration management. The VAX Security Kernel has been developed with a heavy emphasis on performance and system management tools. The kernel performs sufficiently well that much of its development was carried out in virtual machines running on the kernel itself, rather than in a conventional time-sharing system. Index Terms- Computer security, virtual machines, covert channels, mandatory security, discretionary security, layered de-sign, security kernels, protection rings. I