A secure distributed operating system.

This paper discusses some issues in distributed system security, in the context of the design of a secure distributed operating system. The design is targeted for an A1 rating. Some new developments in formal verification methods are reported. Distributed system security is contrasted with single-host and network security, and described in the context of the TNI. Problems unique to distributed system security are discussed. An argument is made for implementing security features in higher layers, corresponding roughly to the session thru application layers of the OSI model. A new security policy, based on message-passing rather than reads and writes, is described. The SDOS design is summarized.