A Hookup Theorem for Multilevel Security

In this paper, the author describes a security property for trusted multilevel systems, restrictiveness, which restricts the inferences a user can make about sensitive information. This property is a hookup property, or composable, meaning that a collection of secure restrictive systems when hooked together form a secure restrictive composite system. The author argues that the inference control and composability of restrictiveness make it an attractive choice for a security policy on trusted systems and processes.