Multiple Independent Levels of Security

<h2 id="overview">Overview</h2>
<p>A MILS solution allows for independent evaluation of security components and trusted composition.<a class="footnote-ref" id="fnref:2" href="#fn:2"><sup>2</sup></a><a class="footnote-ref" id="fnref:3" href="#fn:3"><sup>3</sup></a> MILS builds on the older <a href="/facts/Bell-La_Padula_model/aWl1Fc7R">Bell and La Padula theories</a> on secure systems that represent the foundational theories of the DoD <a href="/facts/Trusted_Computer_System_Evaluation_Criteria/GCN1fjaE">Orange Book</a>.
</p><p>A MILS system employs one or more separation mechanisms (e.g., <a href="/facts/Separation_kernel/d2zsWB3z">Separation kernel</a>, <a href="/facts/Partitioning_Communication_System/cr6bchaT">Partitioning Communication System</a>, physical separation) to maintain assured data and process separation. A MILS system supports enforcement of one or more application/system specific security policies by authorizing information flow only between components in the same security domain or through trustworthy security monitors (e.g., access control guards, downgraders, crypto devices, etc.).
</p>
<h3>NEAT</h3>
<p>Properties:
</p>
<ul><li><i>Non-bypassable</i>: a component can not use another communication path, including lower level mechanisms to bypass the security monitor.</li>
<li><i>Evaluatable</i>: any trusted component can be evaluated to the level of assurance required of that component. This means the components are modular, well designed, well specified, well implemented, small, low complexity, etc.</li>
<li><i>Always-invoked</i>: each and every access/message is checked by the appropriate security monitors (i.e., a security monitor will not just check on a first access and then pass all subsequent accesses/messages through).</li>
<li><i><a href="/facts/Tamper_resistance/CvYnqsQh">Tamperproof</a></i>: the system controls "modify" rights to the security monitor code, configuration and data; preventing unauthorized changes.</li></ul>
<p>A convenient acronym for these characteristics is NEAT.
</p>
<h3>Trustworthiness</h3>
<p>'Trustworthy' means that the component have been certified to satisfy well defined security policies to a level of assurance commensurate with the level of risk for that component (e.g., we can have single level access control guards evaluated at <a href="/facts/Common_Criteria/6Tln3R2k">CC</a> <a href="/facts/Evaluation_Assurance_Level/RjUeSsjR">EAL4</a>; separation mechanisms evaluated at <i>High Robustness</i>; two-level separation guards at <a href="/facts/Evaluation_Assurance_Level/RjUeSsjR">EAL 5</a>; and TYPE I crypto all in the same MILS system).
</p><p>'Untrusted' means that we have no confidence that the system meets its specification with respect to the security policy.
</p>
<h3>Companies</h3>
<p>The following companies have MILS separation kernel products:
</p>
<ul><li><a href="/facts/Green_Hills_Software/l3ubXp6D">Green Hills Software</a></li>
<li><a href="/facts/LynuxWorks/y6gAFUuX">LynuxWorks</a></li>
<li><a href="/facts/SYSGO/uLX5Il0m">SYSGO</a></li>
<li><a href="/facts/Wind_River_Systems/7unqIjwq">Wind River Systems</a></li>
<li>Bertin Technologies</li>
<li><a href="/facts/OK_Labs/JTNEqsAT">OK Labs</a><a class="footnote-ref" id="fnref:4" href="#fn:4"><sup>4</sup></a><a class="footnote-ref" id="fnref:5" href="#fn:5"><sup>5</sup></a></li></ul>
<p>Companies with other separation methods creating MILS products:
</p>
<ul><li><a href="/facts/Thales_Group/vuBBokok">Thales</a><a class="footnote-ref" id="fnref:6" href="#fn:6"><sup>6</sup></a></li></ul>
<h2 id="mils-research-and-technology">MILS Research and Technology</h2>
The MILS Community
<ul><li>The MILS Community <a href="https://mils.community/">[2]</a> is a global international, open membership, not-for-profit competence network on MILS architecture and technologies.</li></ul>
Research Projects
<ul><li>EURO-MILS: Secure European Virtualisation for Trustworthy Applications in Critical Domains <a href="https://zenodo.org/record/61251">[3]</a></li>
<li>D-MILS: Distributed MILS for dependable information and communication infrastructures <a href="http://www.d-mils.org/">[4]</a>.</li>
<li>certMILS: Compositional security certification for medium- to high-assurance COTS-based systems in environments with emerging threats <a href="https://certmils.eu/">[5]</a></li></ul>
<h2 id="see-also">See also</h2>
<ul><li><a href="/facts/Multiple_Levels_of_Security/yyCAmDEP">Multiple Levels of Security</a></li>
<li><a href="/facts/Secure_by_design/Bf9qyAfv">Secure by design</a></li></ul>

<ul><li>Rushby, J., 2008. <a href="http://www.csl.sri.com/users/rushby/papers/mils-constitution.pdf"><i>Separation and integration in MILS (The MILS constitution)</i></a>. Technical Report SRI-CSL-08-XX, SRI International.</li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1"><p>John Rushby (1981). "Design and Verification of Secure Systems" (PDF). Proc. 8th ACM Symposium on Operating System Principles. pp. 12–21. <a href="/wiki/John_Rushby" target="_blank">/wiki/John_Rushby</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li>
<li id="fn:2"><p>W. S. Harrison; N. Hanebutte; P. Oman; J. Alves-Foss (October 2005). "The MILS Architecture for a Secure Global Information Grid" (PDF). CrossTalk. 18 (10): 20–24. Archived from the original (PDF) on 2012-12-03. <a href="https://web.archive.org/web/20121203172008/http://www.crosstalkonline.org/storage/issue-archives/2005/200510/200510-Harrison.pdf" target="_blank">https://web.archive.org/web/20121203172008/http://www.crosstalkonline.org/storage/issue-archives/2005/200510/200510-Harrison.pdf</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li>
<li id="fn:3"><p>Alves-Foss, W. S. Harrison, P. Oman and C. Taylor (2007). "The MILS Architecture for High Assurance Embedded Systems". International Journal of Embedded Systems. 2 (3/4): 239–247. CiteSeerX 10.1.1.76.6810. doi:10.1504/IJES.2006.014859.{{cite journal}}:  CS1 maint: multiple names: authors list (link) <a href="/wiki/CiteSeerX_(identifier)" target="_blank">/wiki/CiteSeerX_(identifier)</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li>
<li id="fn:4"><p>[1] <a href="https://archive.today/20140517220738/http://wiki.ok-labs.com/DevelopOKLinuxApp?highlight=(oklinux)" target="_blank">https://archive.today/20140517220738/http://wiki.ok-labs.com/DevelopOKLinuxApp?highlight=(oklinux)</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li>
<li id="fn:5"><p>"SeL4 (Secure Embedded L4) | SSRG | NICTA". Archived from the original on 2014-04-10. Retrieved 2014-05-17. <a href="https://web.archive.org/web/20140410023153/http://ssrg.nicta.com.au/projects/seL4/" target="_blank">https://web.archive.org/web/20140410023153/http://ssrg.nicta.com.au/projects/seL4/</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li>
<li id="fn:6"><p>"Martello". <a href="https://www.thalesgroup.com/en/martello" target="_blank">https://www.thalesgroup.com/en/martello</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li>
</ol>

Multiple Independent Levels of Security open-in-new

Multiple Independent Levels of Security