A Bibliography of Windowing Systems and Security

Jeremy Epstein TRW Systems Division 1 Federal Systems Park Drive Fairfax, VA 22033 USA

Tel: +1 703 803 4947

            E-mail: epstein@trwacs.fp.trw.com (Internet) ^{∗}

26 October 2010 Version 1.05

Over the past several years there has been an increasing interest in windowing systems and security. Most of this interest has been in security aspects of the X Window System^{1}, while there has been some work in policy issues for windowing and in windowing systems other than X.

Because X is a network protocol, it is susceptible to many types of attack foreign to other windowing systems. Additionally, X was designed without concern for security: the X designers frequently state that X provides (graphical) “mechanism without policy”, but in the area of security, X provides “policy without mechanism.”

Much of the interest in security has come from the government community, in particularly in the form of Compartmented Mode Workstations (CMWs). The commercial world is increasingly sensitive to issues of authentication in X, and to a lesser extent issues of audit and access control to X resources.

This bibliography lists articles and publications addressing both government and commercial security concerns. The author welcomes additions and corrections to this list at any of the addresses listed above.^{2}

∗This paper was originally published in The X Resource, 4(1), 103–108, 1992.

1X Window System is a trademark of the Massachusetts Institute of Technology.

2Copyright 1992 by Jeremy Epstein. Permission is granted to make unlimited copies of this document for any purpose and without fee, provided that the above copyright notice and this permission notice is retained on all copies.

Title word cross-reference

-or- [7]. Applications [11]. Approach [16]. Architecture [3]. Architectures [19]. B1 [24]. B3 [9]. based [3]. Building [7]. Cautionary [14]. Certifiable [24]. CMW [11]. Comparison [19]. Compartmented [12]. Concurrent [16]. Criteria [12]. Cut [17]. Downgrading [14]. draft [20]. Enhancements [2]. Evaluation [12]. Evolution [10]. Free [22]. Generic [1]. Heterogeneous [16]. High [25]. Image [14]. INsecure [20]. Interoperability [19]. Issues [7]. Labeling [6]. Less [20]. level [15]. LInX [20]. Mach [5]. Microsystems [20]. Mode [12]. Multi [24]. Multi-Level [24]. Multilevel [15, 3]. Note [14]. Operating [24]. Paste [17]. Policies [6]. Policy [22]. Policy-Free [22]. Protocol [22]. Prototype [6]. Reconciling [11]. Requirements [1]. Secure [4]. Security [1]. Server [5]. Single [15]. Single-level [15]. Sun [20]. Supporting [16]. System [21, 1]. Systems [4, 8]. Terminal [15]. Those [11]. Trusted [7, 5]. Trusting [7]. UNIX [4]. unpublished [20].

Version [12]. Virtual [16]. Window [4, 1]. Windowing [16]. Windows [2]. Workstation [12]. Workstations [25]. X [1]. X11 [3]. X11-based [3].

References

Bellcore:GRX92

[1] Bellcore. Generic requirements for X Window System security. Technical Report FA-STS-991324, Framework Technical Advisory, June 30 1992. Describes some of the problems associated with X in a commercial environment, and specifies solutions including Kerberos. Also talks about auditing in X.

Boeing:XWE88

[2] Boeing. X windows enhancements. Technical Report Software Technology for Adaptable Reliable Systems (STARS), Technical Report QTASK 13, Boeing, December 23 1988. Probes issues in moving X from being written in C to being written in Ada and some security enhancements that could be made to the X server.

Carson:XMW90

[3] Mark Carson and Janet Cugini. An X11based Multilevel Window System architecture. In Proceedings of the Autumn 1990 EUUG Technical Conference, Nice, France, 1990. A preliminary architecture of the X portion of IBM’s CMW.

Carson:SWS89

[4] Mark Carson, et. al. Secure window systems for UNIX. In Proceedings of the USENIX Winter 1989 Conference, San Diego, CA, USA, January 1989. An architecture for a CMW based on Trusted XENIX and a text-based windowing system. Also mentions some X related issues.

Epstein:TXW90

[5] Jeremy Epstein and Marvin Shugerman. A Trusted X Window System server for Trusted Mach. In Proceedings of the USENIX Mach Conference, Burlington, VT, USA, October 1990. This paper describes the initial architecture of the Trusted X Window System prototype developed at TRW. This paper was superseded by the paper at the Seventh Annual Computer Security Applications Conference [9].

Epstein:PTX90

[6] Jeremy Epstein. A prototype for Trusted X labeling policies. In Proceedings of the Sixth Annual Computer Security Applications Conference, Tucson, AZ, USA, December 1990. A discussion of visible labeling issues, not specific to X, but applicable to any windowing environment.

Epstein:TXI91

[7] Jeremy Epstein and Jeffrey Picciotto. Trusting X: Issues in building Trusted X window systems -or- what’s not trusted about X? In Proceedings of the 14th Annual National Computer Security Conference, Washington, DC, USA, October 1991. A survey of the issues involved in building trusted X systems, especially of the multi-level secure variety.

Epstein:IBT91

[8] Jeremy Epstein and Jeffrey Picciotto. Issues in building Trusted X Window Systems. The X Resource, 1(1), Fall 1991. A revision of the previous paper [7], aimed at an audience which is X literate, but security ignorant.

Epstein:PBT91

[9] Jeremy Epstein, et. al. A prototype B3 Trusted X Window System. In Proceedings of the Seventh Annual Computer Security Applications Conference, San Antonio, TX, USA, December 1991. The architecture for TRW’s high assurance multi-level secure X prototype.

Epstein:ETB92

[10] Jeremy Epstein, et. al. Evolution of a Trusted B3 Window System prototype. In Proceedings of the 1992 IEEE Symposium on Research in Security and Privacy, Oakland, CA, USA, May 1992. The history of the design and tradeoffs taken in TRW’s prototype.

Faden:RCR91

[11] Glenn Faden. Reconciling CMW requirements with those of X11 applications. In Proceedings of the 14th Annual National Computer Security Conference, Washington, DC, USA, October 1991. Architecture of the windowing portion of Sun’s CMW.

Graubart:CMW91

[12] R. D. Graubart, J. L. Berger, and J. P. L. Woodward. Compartmented mode, workstation evaluation criteria, version 1. Technical Report MTR 10953 (also published by the Defense Intelligence Agency as document DDS-2600-6243-91), The MITRE Corporation, Bedford, MA, USA, June 1991. Revised requirements for the CMW, including a description of what they expect for Trusted X.

Khera:SXW90

[13] Vivek Khera. The secure X window server. Technical Report TR90-54, Microelectronics Center of North Carolina, 1990. Description of Khera’s Kerberized X Window Server developed at MCNC. Also discusses security of X in general. Available via anonymous ftp from cs.

duke.edu:dist/papers/khera.

Kurak:CNI92

[14] Charles Kurak and John McHugh. A cautionary note on image downgrading. In Proceedings of the Eighth Annual Computer Security Applications Conference, San Antonio, TX, USA, December 1992. A discussion of problems involved in viewing images, particularly as it applies to multi-level windowing.

McIlroy:MWS88

[15] D. McIlroy and J. Reeds. Multilevel windows on a single-level terminal. In Proceedings of the (First) USENIX Security Workshop, Portland, OR, USA, August 1988. Describes a prototype of modifications to the Teletype 5620 and driving software to allow multi-level windows. Also explains some of the limitations of the method.

Pascale:VWS92

[16] Rita Pascale and Jeremy Epstein. Virtual window systems: A new approach to supporting concurrent heterogeneous windowing systems. In Proceedings of the USENIX Summer 1992 Conference, San Antonio, TX, USA, July 1992. A generalization of TRW’s prototype to nonsecurity applications.

Picciotto:TTC91

[17] Jeffrey Picciotto. Towards trusted cut and paste in the X Window System. In Proceedings of the Seventh Annual Computer Security Applications Conference, San Antonio, TX, USA, December 1991. A discussion of the security problems associated with cut and paste in multi-level secure versions of X.

Picciotto:TXW90

[18] Jeffrey Picciotto. Trusted X Window System. Technical Report MTP 288, The MITRE Corporation, February 1990. A detailed explanation of MITRE’s CMW prototype.

Picciotto:CTX92

[19] Jeffrey Picciotto and Jeremy Epstein. A comparison of Trusted X security policies, architectures, and interoperability. In Proceedings of the Eighth Annual Computer Security Applications Conference, San Antonio, TX, USA, December 1992. A survey of interoperability issues among CMWs and the TRW prototype.

Rosenthal:LLI92

[20] David S. H. Rosenthal. LInX—a Less INsecure X server (Sun Microsystems unpublished draft). An early architecture for Sun’s CMW., 1992.

Rosenthal:XWS92

[21] David S. H. Rosenthal. X window security system. US patent 5,073,922, Describes implementation of LInX., 1992.

Smith:TPF92

[22] Mark Smith. Towards a policy-free protocol supporting a secure X Window System. In Proceedings of the 15th Annual National Computer Security Conference, Baltimore, MD, USA, October 1992. A concept for improving interoperability among Trusted X systems by separating the security policy from the system implementation, thus allowing pluggable security policies.

Sheldrick:SXW92

[23] Dennis Sheldrick. Security and the X Window System. UNIX World, January 1992. A discussion of some of the security features in X, and threats to X.

Smith-Thomas:SML89

[24] Barbara Smith-Thomas. Secure multilevel windowing in a B1 certifiable secure UNIX operating system. In Proceedings of the USENIX Winter 1989 Conference, San Diego, CA, USA, January 1989. Describes the architecture of the multi-level version of the AT&T 630 graphics terminal. This terminal was evaluated as part of AT&T System V/MLS, which received a B1 rating.

Woodward:SRS87

[25] J. P. L. Woodward. Security requirements for system high and compartmented mode workstations. Technical Report MTR 9992, Revision 1 (also published by the Defense Intelligence Agency as document DDS-2600-5502-87), The MITRE Corporation, Bedford, MA, USA, November 1987. The original requirements for the CMW, including a description of what they expect for Trusted X.