A Multilevel Secure Message Switch with Minimal TCB: An Architectural Outline and Automatic Verification

This paper describes an architectural outline for a generic secure message switch. We will highlight key security issues germane to the structure and functionality of a switch for routing messages of multiple sensitivity levels over communication media with multiple security levels.