We describe the MILS approach to design, construction, integration, and evaluation of secure systems. The crucial feature of the MILS approach is that it separates the problems of enforcing security policy from those of securely sharing resources. MILS design proceeds in two steps: first, we develop a logical security policy architecture in which the system is deconstructed into interacting com...