Terminology , Criteria and Systemarchitectures for Data

In response to the strawman document 9] we propose that trust be treated as synonymous with integrity rather than synonymous with conndence. We also propose that mandatory controls be taken to mean controls based on properties of the object and/or the subject. Label-based mandatory controls are then a special case of this more general notion. The TCSEC 11] presents criteria for establishing prescribed levels of conndence in trusted systems with particular objectives. We consider how these criteria might be generalized to a broader context. Finally regarding architectures for trusted systems we suggest enhancements to the current security kernel approach.