TrustGraph: Trusted graphics subsystem for high assurance systems

  • Okhravi H
  • Nicol D
  • 12


    Mendeley users who have this article in their library.
  • 5


    Citations of this article.


High assurance MILS and MLS systems require strict limitation of the interactions between different security compartments based on a security policy. Virtualization can be used to provide a high degree of separation in such systems. Even with perfect isolation, however, the I/O devices are shared between different security compartments. Among the I/O controllers, the graphics subsystem is the largest and the most complex. This paper describes the design and implementation of TrustGraph, a trusted graphics subsystem for high assurance systems. First, we explain the threats and attacks possible against an unsecured graphics subsystem. We then describe the design of TrustGraph, the security principles it is built upon, and its implementation. Finally, we verify our implementation through different levels of verification which include functionality testing for simple operations, attack testing for security mechanisms, and formal verification for the critical components of the implementation. An analysis of the graphics API covert channel attack is presented, its channel capacity is measured, and the capacity is reduced using the idea of fuzzy time. © 2009 IEEE.

Author-supplied keywords

  • Covert channel analysis
  • Formal verification
  • Multi-level security
  • Trusted graphics
  • Virtualization

Get free article suggestions today

Mendeley saves you time finding and organizing research

Sign up here
Already have an account ?Sign in

Find this document


  • Hamed Okhravi

  • David M. Nicol

Cite this document

Choose a citation style from the tabs below

Save time finding and organizing research with Mendeley

Sign up for free