The multipolicy paradigm for trusted systems

Abstract

This paper describes shortcomings in the current paradigm for multilevel secure (MLS) systems, summarizes requirements for an alternate paradigm, and describes the Multipolicy Paradigm. The Multipol-icy Paradigm is useful whenever there are multiple security goals such as confidentiality, privacy, availability, integrity, or weapons release control; whenever users with different values and traditions must share a common system; whenever a system is composed of separately-evaluated pieces, and whenever policies must adapt to changing circumstances. The paper suggests shifts in thinking about multilevel secure (MLS) systems, and raises important multipolicy issues: policy flexibility, policy conflict resolution, adding user security policies to commercial off-the-shelf (COTS) products, evaluating and certifying multiple policy systems, and passing sensitive data across policy boundaries.