Structuring trust in a large general purpose operating system

A description is given of the approach taken by ICL to ameliorate the problem of evaluating the security of a large operating system in which the number of TCB (trusted computing base) and trusted process code procedures is large enough to make exhaustive detailed scrutinization more than exhausting. The approach is applicable to any structured large general-purpose system that enables a conventional TCB/trusted process architecture to be implemented, though it is described with particular reference to ICL´s VME (virtual machine environment) operating system. It is concluded that not only is it possible to structure the TCB into separately identifiable components with different responsibilities but it is also possible to provide a fine-grain categorization of the different degrees of trust vested in the trusted processes