DID FinderBack
Source
DI-MCCR-81344

Design Specification

The Design Specification demonstrates correct implementation and enforcement of the security policy across the trusted computing base, explaining protection mechanisms so change impacts on the TCB can be evaluated.

Approval DateJuly 2, 1993
AMSC NumberG6934
Preparing Activity—
Project Number—
OPRG/C71
DTIC Applicable—
GIDEP Applicable—
Limitation—
Applicable Forms—
Approval Limitation—
Form VersionAPR 89
DID Formatdd_form_1664
963C CompliantNo
DISTRIBUTION STATEMENT A: Approved for public release; distribution is unlimited.
Supersedes
—
Related
—

Description & Purpose

3.1 The Design Specification demonstrates the correct implementation and enforcement of the security policy throughout the trusted computing base (TCB). It shall explain the protection mechanisms of the TCB to the extent that the effect a change may have on the TCB can be evaluated prior to a technical change performed.

Application & Interrelationship

7.1 This Data Item Description (DID) contains the format and content preparation instructions for the data product generated under the work task described by 2.1.3.1.1, 2.1.4.4, 2.2.3.1.1, 3.1.3.1.1, 3.1.4.4, 3.2.3.1.1, 3.2.3.1.4, 3.2.4.4, 3.3.3.1.1, 3.3.4.4, and 4.1.4.4 of DOD-5200.28 STD, Department of Defense Trusted Computer System Evaluation Criteria.

7.2. This DID is applicable to any computer acquisition that calls for a Design Specification as specified by DOD-5200.28 STD, Department of Defense Trusted Computer System Evaluation Criteria (TCSEC) for TCB Classes C1 (Discretionary Security Protection), and above, products or their equivalent systems. The Design Specification identifies and describes the TCB and its security features.

7.3 The information required by 10.3 is required for all class products and their equivalent systems applicable to the DID as a whole. In addition, the information required in 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5 and 10.3.6 are necessary for various classes of products and their equivalent systems.

Use & Relationship

—

Preparation Instructions

10.1Source Document.The applicable issue of the documents cited herein, including their approval date, and dates of any applicable amendments and revisions shall be reflected in the contract.
10.2Format.Document the Design Specification as follows:
10.2.2Cover Sheet.Shall contain Title, Contract Number, Procuring Activity, Contractor Identification, Acquisition Program Name, disclaimers (as provided by the procuring activity contracting officer), date, version, number, security classification, and any other appropriate descriptive data.
10.2.3Errata Sheet.Shall contain sheets delimiting cumulative page changes from previous versions.
10.2.4Table of Contents.Shall contain paragraph numbers, paragraph names, and page numbers.
10.2.5List of illustrations, diagrams, charts, and figures.
10.2.6Glossary of abbreviations, acronyms, terms, symbols, and notation used, and their definitions.
10.2.7Executive Summary, not to exceed two pages, that briefly describes the TCB's security-related capabilities.
10.2.8Introduction.
10.2.9Body of the Specification.
10.2.10Attachments.
10.2.11Subject index.
10.2.12Appendices.
10.2.13Bibliography.List reference sources and applicable documents.
10.2.1Specific format instructions.
10.2.1.1Abbreviations and acronymsshall be defined when first used in the text and shall be placed in the glossary.
10.2.1.2Pagesshall be numbered separately and consecutively using Arabic numerals. Blank pages shall be numbered.
10.2.1.3Paragraphsshall have a short descriptive title and shall be numbered consecutively using Arabic numerals. Numbering schemes beyond the fourth level (e.g., 4.1.2.5.8) are not permitted.
10.2.1.4Chaptersshall begin on an odd-numbered (right hand) page.
10.2.1.5Column headingsshall be repeated on subsequent pages if tabular material exceeds one page.
10.2.1.6Fold out pagesshall be kept to a minimum.
10.2.1.7Papershall be standard 8 1/2 x 11 inches, white, with black type. The type font shall be standard 10 pitch pica or courier, 12 pitch elite, or equivalent font. Either blocked text (left and right justified) or ragged right (left justified only) shall be used.
10.2.1.8At least one inch marginsshall be provided all around to allow for drilling and binding.
10.2.1.9Either single or double sided printingmay be used. If double-sided, the document shall be printed or typed head-to-head, front-to-back.
10.2.1.10The specification shall be providedin standard three-ring notebook binders for ease of maintenance.
10.3Content.The Design Specification shall contain the following items:
10.3.7A statement of the security policy.This description shall be in enough detail to form the background for the design discussions.
10.3.8The Design Specification shall relate the security requirements to the architecture.
10.3.9An explanation of how the security policy is translated into a technical solution through the TCB hardware, software, and firmware.
10.3.1Classes C1, C2, and B1 products and their equivalent systems.The following shall be included in this section:
10.3.1.1Description of how the TCB is modularized (if modular).
10.3.1.2Description of all interfaces between the TCB modules (if modular).
10.3.1.3Description of how the TCB protects itself from external interference or tampering.
10.3.1.4Description of the resources which are controlled by the TCB.These resources may be a defined subset of the subjects and objects.
10.3.2Classes C2 and B1 products and their equivalent systems.The Design Specification shall describe how the TCB isolates the resources to be protected so that they are subject to the access control and auditing requirements.
10.3.3Classes B1 products and their equivalent systems.The following shall be included in this section:
10.3.3.1Identification and description of the TCB protection mechanisms.
10.3.3.2An explanation to show that the TCB protection mechanisms satisfy the model.
10.3.3.3Description of how the TCB maintains process isolation through the provision of distinct address spaces under its control.
10.3.4Classes B2 and above products and their equivalent systems.The following shall be included in this section:
10.3.4.1Description of how the TCB is structured to facilitate testing.
10.3.4.2Description of the different sets of privileges assigned to differing roles (e.g., users, administrators).
10.3.4.3Description of the design techniques involved in restricting covert storage channels.
10.3.4.4Description of the interfaces between the TCB modules.
10.3.4.5Description of how the TCB complies with additional B2 architecture requirements.The following requirements shall be described:
10.3.4.5.1TCB maintenance of a domain for its own execution that protects it from external interference or tampering.
10.3.4.5.2TCB maintenance of process isolation through the provision of distinct address spaces under its control.
10.3.4.5.3Features in hardware, such as segmentation, used to support logically distinct storage objects with separate attributes (namely: readable, writable).
10.3.4.5.4TCB modules structured such that the principle of least privilege is enforced.
10.3.4.5.5TCB internally structured into well-defined largely independent modules.
10.3.4.5.6Effective use of available hardware by TCB to separate those elements that are protection-critical from those that are not.
10.3.4.6Description of the trusted communication path between the TCB and user.
10.3.5Classes B3 and above products and their equivalent systems.The following shall be included in this section:
10.3.5.1Description of the design techniques involved in restricting covert timing channels.
10.3.5.2Description of how the TCB complies with additional B3 architecture requirements.The following requirements shall be described:
10.3.5.2.1Complete, conceptually simple protection mechanism with precisely defined semantics.The Design Specification shall describe how this mechanism plays a central role in enforcing the internal structuring of the TCB.
10.3.5.2.2Significant use of layering, abstraction, and data hiding by the TCB.
10.3.5.2.3Minimization of the complexity of the TCB, excluding the modules that are not protection-critical.
10.3.5.3The Design Specification shall describe the following for trusted recovery:
10.3.5.3.1Anticipated classes of failures and discontinuities of operation handled by trusted recovery, automatically or using administrative procedures.
10.3.5.3.2Trusted recovery philosophy (e.g., use of failure-atomicity in the design of TCB primitives, of non-atomic actions which allow recovery).
10.3.5.3.3Warnings concerning the 'unanticipated' (i.e., rare) failures that can't be handled in a routine manner.
10.3.5.4Description of how the specific TCB protection mechanisms used ensuring trusted-recovery functions are available only to administrative users.
10.3.6Class A1 products and their equivalent systems.The Design Specification shall describe the hardware, software, and firmware mechanisms not dealt with in the FTLS but strictly internal to the TCB (e.g., mapping registers, direct memory access I/O).

References

—
Schema v3.0Community-maintained · Verify against ASSIST
Community-maintained — not an official government database.
Verify against ASSIST·GitHub·About·Disclaimer