MLS and trust issues at the user interface in MLS AISs

A critical element in the widespread application of trusted systems is the availability of user interfaces that support efficient access by users to MLS data. The authors look at functional requirements for an MLS user interface, not in terms of what is typically implemented but in terms of user/system interaction. A model of user/system interaction is presented based on three security levels: session level, update level and field level. Based on this model, three modes of user/system interaction are identified. These modes vary in the flexibility offered the user and the degree of difficulty in developing a trustworthy implementation. A brief discussion of architectural and implementation issues is presented for each mode