Page 1 A Guide to the Procurement of Trusted Systems: An ... - csirt

specific hardware "registers" with the main memory areas (domains) they are
protecting. There should be sufficient types and numbers of "registers" to
ensure the number of sensitivity labels for information in the system can be
adequately mapped. Common ways to achieve these capabilities are through
"Descriptor Base Registers," "Bounds Registers," and "Virtual Memory Mapping
Registers," although other approaches may also be used.
3.4.1.5 INTEGRITY CHECKING MECHANISMS
Integrity checking mechanisms usually provide support for security
functions. For example, memory parity checks and cyclic redundancy check
schemes ensure errors are detected. Another commonly used technique is
called a watchdog timer. This timer performs a direct security-related
function by ensuring an application program cannot "steal all the
processor's time" by independently checking allocations of processor time.
3.4.1.6 DIRECT MEMORY ACCESS (DMA) PROTECTION
DMA allows input-output to occur simultaneously with the processor's normal
computational activities. That is, once the processor initiates an inputoutput
operation, a separate hardware feature directs the flow of data into
(or out of) main memory independent of the processor, while the processor
itself is free to complete other tasks. Since DMA is independent of
processor intervention, it cannot be confined by the TCB's enforcement
techniques. Thus, unless DMA security protection is provided, Mandatory Access
Controls cannot be enforced during DMA operations.
3.4.1.7 ASYNCHRONOUS EVENT MECHANISMS
Asynchronous events are not predictable (e.g., arrival of a message, the
printer's running out of paper, or communications link errors). Asynchronous
event mechanisms are hardware features which handle the unpredictable, usually
by "interrupting" the processor. Once interrupted, the processor then deals
with the event. For security, the hardware features should cause the processor
to recognize and respond to specific asynchronous events, such as "security
policy violations" (in DoD 5200.28-STD phrasing, violations of the Simple
Security Property or Star Property). Unless hardware features support these
properties, software must interpret the results of every operation, -causIng a
severe performance penalty. The penalty may come into conflict with mission
performance requirements.
3.4.2 CAVEATS
Care must be taken not to restrict potentially valid solutions in the
specifications (requirements), statement of work, or CDRL sections of the RFP.
Many possible design solutions could meet the requirements. Use of specific
terms could unintentionally preclude the application of alternative
techniques. Thus, terms should be used that illustrate the concepts involved
without restricting the design choices available to the contractor. The second
guideline of this four-guideline series, "Language for RFP Specifications
and Statements of Work - An Aid to Procurement Initiators," was written
specifically to deal with this problem.
3.4.3 MANAGING HARDWARE
Page 46