Reference monitoring

It is also usual to fit reference (monitoring) electrodes as an independent check on the performance of sensing electrodes. 

The kinetic investigations were carried out in a 1080 L cylindrical quartz-glass photoreactor in synthetic air (296 3 K and 760 10 Torr). As the description given here is limited to the instrumentation actually used in this smdy, the reader is referred to the literature for a more detailed description of this reaction chamber (Barnes et al., 1994). A White type multiple refleetion mirror system, operated at a total optical path length of (484.7 0.8) m, coupled to a Nicolet Nexus FTIR spectrometer equipped with a liquid nitrogen cooled mercury-cadmium-tellurium (MCT) detector, was used for reactant and reference monitoring. 

Fig. 10 Viability of human endothelial cells isolated from umbilical cord on unmodified, RGD-modified gels (here shown for Type B) and fibronectin (FN) reference monitored by the colorimetric MTT-(tetrazolium)-assay. MTT-assay was used to quantify living cells after 3 days in culture...

An access control policy is enforced when the behavior of the system matches the intended interpretation of the observe and alter functions. This requires the following conditions - called the Reference Monitor assumptions - to be satisfied. 

From these reference monitor assumptions, Rushby shows that the three unwinding conditions can be derived. These conditions are therefore sufficient to ensure security. For transitive security policies, the main theorem in the Rushby model is the following ... 

Theorem 2. A system with structured state that satisfies the Reference Monitor Assumptions and the following two conditions... 

From this Unwinding Theorem, Rushby proves that the Reference Monitor Assumptions are also sufficient to ensure isecure. 

In its original formulation, Rushby defines three reference monitor assumptions. The second monitor assumption is mainly used to derive (weak) step consistency. In our formulation, we replace this assumption with weak step consistency. We now prove a lemma showing how to recover step consistency from weak step... 

Using this Lemma, we prove that any GWV system that is secure for an intransitive policy is also Rushby secure for this security policy. In this proof, we assume that GWV systems satisfy reference monitor assumptions similar to the first and third assumptions in the Rushby model. Formally, we define the... 

Theorem 6. Let Mg be a GWV system satisfying the GWV Reference Monitor Assumptions and Gurrent Respects. Let M he the Rushby system corresponding to Mg. Then M is isecure for - g. 

Theorem 7. Let Mg he a GWV system that satisfies Current Respects, weak step consistency, the GWV Reference Monitor Assumptions, and the following condition ... 

The scientific basis of the "Orange Book" rests upon the reference monitor concept [Anderson 72] and the Bell-LaPadula security policy model [Bell 76], and indeed this basis has led to the development of commercially available (off-the-shelf) operating systems which can enforce the US DoD rules for processing classified information. 

Figure 1 Application of the Reference Monitor concept to hardware architecture design...

In conclusion, we note that the fault preventative approach provides high assurance in a single component. It is most effective when based on a formal security policy model and implemented using the reference monitor concept. Weaknesses in the security policy model can, however, be overcome by combining the fault preventative approach with a fault tolerant approach, indicating that the path to greater assurance requires a combination of the two methods. 

Safety engineers are now encouraged to use fault prevention techniques (e.g. through the publication of [MOD 91]), in particular the use of formal methods to the development of safety-critical software. To maximise the benefit of this approach the safety engineer would be wise to adopt the security principles of the "reference monitor concept" and security policy modelling. However, as in the case of security, the safety engineer would also be wise to utilise the more traditional safety engineering approach of fault tolerance in harmony with the new fault preventative approach. 

---