Trusted Extensions Separates Information by Label
MAC is enforced for all transactions, including email.
Files are stored in separate zones according to label.
The desktop provides workspaces that are labeled.
Users can select a single-level or a multilevel session.
Data on objects is erased prior to object reuse.
Trusted Extensions separates information at different labels by the following means:
Single-Level or Multilevel Sessions
When you first log in to a Trusted Extensions session, you specify whether to operate at a single label or at multiple labels. You then set your session clearance or session label. This setting is the security level at which you intend to operate.
In a single-level session, you can access only those objects that are equal to your session label or are dominated by the label.
In a multilevel session, you can access information at labels that are equal to or lower than your session clearance. You can specify different labels for different workspaces. You can also have multiple workspaces at the same label.
Session Selection Example
Figure 2, Table 2, Effect of Initial Label Selection on Available Session Labels provides an example that shows the difference between a single-level and a multilevel session. This example contrasts a user who chooses to operate in a single-level session at CONFIDENTIAL: NEED TO KNOW (CNF: NTK) with a user who chooses a multilevel session, also at CNF: NTK.
The three columns on the left show each user's session selections at login. Note that users set session labels for single-level sessions and session clearances for multilevel sessions. The system displays the correct label builder according to your selection. To view a sample label builder for a multilevel session, see Step 3 in How to Change the Label of a Workspace.
The two columns on the right show the label values that are available in the session. The Initial Workspace label column represents the label when the user first accesses the system. The Available Labels column lists the labels that the user is permitted to switch to during the session.
| ||||||||||||||||||||
As the first row of the table shows, the user has selected a single-level session with a session label of CNF: NTK. The user has an initial workspace label of CNF: NTK, which is also the only label at which the user can operate.
As the second row of the table shows, the user has selected a multilevel session with a session clearance of CNF: NTK. The user's initial workspace label is set to Public, because Public is the lowest possible label in the user's account label range. The user can switch to any label between Public and CNF: NTK. Public is the minimum label, and CNF: NTK is the session clearance.
Labeled Workspaces
On a Trusted Extensions desktop, the workspaces are accessed through workspace panels at the right of the bottom panel.
Figure 5 Labeled Workspaces on the Panel
Each workspace has a label. You can assign the same label to several workspaces, and you can assign different labels to different workspaces. Windows that are launched in a workspace have the label of that workspace. When the window is moved to a workspace of a different label, the window retains its original label. Thus, in a multilevel session, you can arrange windows of different labels in one workspace.
Enforcing MAC for Email Transactions
Trusted Extensions enforces MAC for email. You can send and read email at your current label. You can receive email at a label within your account range. In a multilevel session, you can switch to a workspace at a different label to read email at that label. You use the same mail reader and the same login. The system permits you to read mail at your current label only.
Erasing Data on Objects Prior to Object Reuse
Trusted Extensions prevents inadvertent exposure of sensitive information by automatically erasing old information from user-accessible objects prior to reuse. For example, memory and disk space are cleared before being used again. Failure to erase sensitive data prior to reuse of the object risks the exposure of data to inappropriate users. Through device deallocation, Trusted Extensions clears all user-accessible objects prior to allocating the drives to processes. Note, however, that you must clear all removable storage media, such as DVDs and USB devices, before allowing another user access to the drive.