Protection

The protection mechanisms of computer systems control the access to objects, especially information objects. The range of responsibilities of these mechanisms includes at one extreme completely isolating executing programs from each other, and at the other extreme permitting complete cooperation and shared access among executing programs. Within this range one can identify at least seven levels at which protection mechanisms can be conceived as being required, each level being more difficult than its predecessor to implement:1. No sharing at all (complete isolation).2. Sharing copies of programs or data files.3. Sharing originals of programs or data files.4. Sharing programming systems or subsystems.5. Permitting the cooperation of mutually suspicious subsystems---e.g., as with debugging or proprietary subsystems.6. Providing memoryless subsystems---i.e., systems which, having performed their tasks, are guaranteed to have kept no secret record of the task performed (an income-tax computing service, for example, must be allowed to keep billing information on its use by customers but not to store information secretly on customers' incomes).7. Providing certified subsystems---i.e., those whose correctness has been completely validated and is guaranteed a priori.