You do not have permission to edit this page, for the following reasons:

This IP address has been blocked from editing Wikipedia.
This does not affect your ability to read Wikipedia pages.
Most people who see this message have done nothing wrong. Some kinds of blocks restrict editing from specific service providers or telecom companies in response to recent abuse or vandalism, and can sometimes affect other users who are unrelated to that abuse. Review the information below for assistance if you do not believe that you have done anything wrong.

The IP address or range 54.163.0.0/16 has been blocked (disabled) by ‪Blablubbs‬ for the following reason(s):

The IP address that you are currently using has been blocked because it is believed to be a web host provider or colocation provider. To prevent abuse, web hosts and colocation providers may be blocked from editing Wikipedia.
You will not be able to edit Wikipedia using a web host or colocation provider because it hides your IP address, much like a proxy or VPN.
We recommend that you attempt to use another connection to edit. For example, if you use a proxy or VPN to connect to the internet, turn it off when editing Wikipedia. If you edit using a mobile connection, try using a Wi-Fi connection, and vice versa. If you are using a corporate internet connection, switch to a different Wi-Fi network. If you have a Wikipedia account, please log in.
If you do not have any other way to edit Wikipedia, you will need to request an IP block exemption.

How to appeal if you are confident that your connection does not use a colocation provider's IP address:
If you are confident that you are not using a web host, you may appeal this block by adding the following text on your talk page: ((unblock|reason=Caught by a colocation web host block but this host or IP is not a web host. My IP address is _______. Place any further information here. ~~~~)). You must fill in the blank with your IP address for this block to be investigated. Your IP address can be determined here. Alternatively, if you wish to keep your IP address private you can use the unblock ticket request system. There are several reasons you might be editing using the IP address of a web host or colocation provider (such as if you are using VPN software or a business network); please use this method of appeal only if you think your IP address is in fact not a web host or colocation provider.

Administrators: The IP block exemption user right should only be applied to allow users to edit using web host in exceptional circumstances, and requests should usually be directed to the functionaries team via email. If you intend to give the IPBE user right, a CheckUser needs to take a look at the account. This can be requested most easily at SPI Quick Checkuser Requests. Unblocking an IP or IP range with this template is highly discouraged without at least contacting the blocking administrator.

This block will expire on 17:28, 10 March 2024.

Even when blocked, you will usually still be able to edit your user talk page, as well as email administrators and other editors.

For information on how to proceed, please read the FAQ for blocked users and the guideline on block appeals. The guide to appealing blocks may also be helpful.

Other useful links: Blocking policy · Help:I have been blocked
Your IP address is in a range that has been blocked on all Wikimedia Foundation wikis. The block was made by ‪Jon Kolbert‬. The reason given is Open proxy/Webhost: See the help page if you are affected .
- Start of block: 18:27, 12 November 2023
- Expiry of block: 18:27, 12 November 2028
Your current IP address is 54.163.179.242. The blocked range is 54.163.0.0/16. Please include all above details in any queries you make. If you believe you were blocked by mistake, you can find additional information and instructions in the No open proxies global policy. Otherwise, to discuss the block please post a request for review on Meta-Wiki. You could also send an email to the stewards VRT queue at stewards@wikimedia.org including all above details.

You can view and copy the source of this page:

((Short description|Operating system))
((Use dmy dates|date=December 2016))
((more citations needed|date=November 2016))
((Infobox OS
 | name = XTS-400
 | website = [https://www.baesystems.com/en/product/stop-os STOP OS Homepage]
 | developer = [[BAE Systems]]
 | source_model = [[Closed source]]
 | latest_release_version = 8.2
 | latest_release_date = ???
 | kernel_type = [[Monolithic kernel]]
 | working_state = Current
 | supported_platforms = [[x86]] [[x86-64]]
))

The '''XTS-400''' is a [[multilevel security|multilevel]] secure computer [[operating system]]. It is [[multiuser]] and [[computer multitasking|multitasking]] that uses multilevel scheduling in processing data and information. It works in networked environments and supports [[Gigabit Ethernet]] and both [[Internet Protocol version 4|IPv4]] and [[IPv6]].

The XTS-400 is a combination of [[Intel Corporation|Intel]] [[x86]] hardware and the '''Secure Trusted Operating Program''' ('''STOP''') [[operating system]]. XTS-400 was developed by [[BAE Systems]], and originally released as version 6.0 in December 2003.

STOP provides ''high-assurance'' security and was the first general-purpose operating system with a [[Common Criteria]] assurance level rating of EAL5 or above.<ref>((cite web|url=http://www.commoncriteriaportal.org/products/| title=Certified Products|access-date=2023-09-06))</ref> The XTS-400 can host, and be trusted to separate, multiple, concurrent data sets, users, and networks at different sensitivity levels.

The XTS-400 provides both an ''untrusted'' environment for normal work and a [[trusted operating system|trusted]] environment for administrative work and for privileged applications. The untrusted environment is similar to traditional [[Unix]] environments. It provides binary compatibility with [[Linux]] applications running most Linux commands and tools as well as most Linux applications without the need for recompiling. This untrusted environment includes an [[X Window System]] [[Graphical user interface|GUI]], though all windows on a screen must be at the same sensitivity level.

To support the trusted environment and various security features, STOP provides a set of proprietary [[API]]s to applications. In order to develop programs that use these proprietary  
APIs, a special software development environment (SDE) is needed. The SDE is also needed in order to port some complicated Linux/Unix applications to the XTS-400.

A new version of the STOP operating system, STOP 7<ref>[http://www.baesystems.com/article/BAES_043838/stop-os STOP 7]</ref> has since been introduced, with claims to have improved performance and new features such as [[Role-based access control|RBAC]].

==Uses==
As a high-assurance, [[Multilevel security|MLS]] system, XTS-400 can be used in [[cross-domain solution]]s, which typically need a piece of privileged software to be developed which can temporarily circumvent one or more security features in a controlled manner. Such pieces are outside the CC evaluation of the XTS-400, but they can be accredited.

The XTS-400 can be used as a desktop, server, or network gateway. The interactive environment, typical Unix [[command-line interface|command line tools]], and a GUI are present in support of a desktop solution. Since the XTS-400 supports multiple, concurrent network connections at different sensitivity levels, it can be used to replace several [[Multiple single-level|single-level]] desktops connected to several different networks.

In support of server functionality, the XTS-400 can be implemented in a [[rackmount]] configuration, accepts an [[uninterruptible power supply]] (UPS), allows multiple network connections, accommodates many [[hard disk drive|hard disks]] on a [[SCSI]] subsystem (also saving disk blocks using a ''sparse file'' implementation in the [[file system]]), and provides a trusted backup/save tool. Server software, such as an Internet daemon, can be ported to run on the XTS-400.

A popular application for high-assurance systems like the XTS-400 is to guard information flow between two networks of differing security characteristics. Several customer guard solutions are available based on XTS systems.

==Security==
XTS-400 version 6.0.E completed a Common Criteria (CC) evaluation in March 2004 at EAL4 augmented with ALC_FLR.3 (validation report CCEVS-VR-04-0058.) Version 6.0.E also conformed with the protection profiles entitled Labeled Security Protection Profile (LSPP) and [[Controlled Access Protection Profile]] (CAPP), though both profiles are surpassed in functionality and assurance.

XTS-400 version 6.1.E completed evaluation in March 2005 at EAL5 augmented with ALC_FLR.3 and ATE_IND.3 (validation report CCEVS-VR-05-0094), still conforming to the LSPP and CAPP. The EAL5+ evaluation included analysis of covert channels and additional vulnerability analysis and testing by the [[National Security Agency]].

XTS-400 version 6.4.U4 completed evaluation in July 2008 at EAL5 augmented with ALC_FLR.3 and ATE_IND.3 (validation report CCEVS-VR-VID10293-2008), also still conforming to the LSPP and CAPP.  Like its predecessor, it also included analysis of covert channels and additional vulnerability analysis and testing by the National Security Agency.

The official postings for all the XTS-400 evaluations can be seen on the Validated Product List.<ref>((cite web|url=http://www.niap-ccevs.org/cc-scheme/vpl/|title=Validated Products List |archive-url=https://web.archive.org/web/20100310141215/http://www.niap-ccevs.org/vpl/|archive-date=2010-03-10 ))</ref><ref>((Cite web |url=http://www.commoncriteriaportal.org/products_OS.html#OS |title=Certified Products : New CC Portal |access-date=24 September 2008 |archive-date=31 December 2013 |archive-url=https://web.archive.org/web/20131231024938/http://www.commoncriteriaportal.org/products_OS.html#OS |url-status=dead ))</ref>

The main security feature that sets STOP apart from most operating systems is the mandatory sensitivity policy. Support for a mandatory integrity policy, also sets STOP apart from most [[Multilevel security|MLS]] or trusted systems. While a sensitivity policy deals with preventing unauthorized disclosure, an integrity policy deals with preventing unauthorized deletion or modification (such as the damage that a [[computer virus|virus]] might attempt). Normal (i.e., untrusted) users do not have the ''discretion'' to change the sensitivity or integrity levels of objects. The [[Bell–LaPadula model|Bell–LaPadula]] and [[Biba Model|Biba]] formal models are the basis for these policies.

Both the sensitivity and integrity policies apply to all users and all objects on the system. STOP provides 16 hierarchical sensitivity levels, 64 non-hierarchical sensitivity categories, 8 hierarchical integrity levels, and 16 non-hierarchical integrity categories. The mandatory sensitivity policy enforces the [[United States]] [[United States Department of Defense|Department of Defense]] data sensitivity classification model (i.e., "Unclassified," "Secret," "Top Secret"), but can be configured for commercial environments.

Other security features include:
* Identification and [[authentication]], which forces users to be uniquely identified and authenticated before using any system services or accessing any information; the user's identification is used for access control decisions and for accountability via the auditing mechanism;
* [[Discretionary access control]] (DAC), which appears just as in [[Unix]], including the presence of [[access-control list]]s on every object; the set-id function is supported in a controlled fashion;
* A mandatory ''subtype'' policy, which allows some of the functionality of trusted systems which support a full ''type enforcement'' or ''domain-type enforcement'' policy;
* Auditing of all security-relevant events and trusted tools to allow administrators to detect and analyze potential security violations;
* [[Trusted path]], which allows a user to be sure s/he is interacting directly with the ''trusted security functions'' (TSF) during sensitive operations; this prevents, for example, a [[Trojan horse (computing)|Trojan horse]] from [[spoofing attack|spoofing]] the login process and stealing a user's password;
* Isolation of the operating system code and data files from the activity of untrusted users and processes which, in particular, prevents [[malware]] from corrupting or otherwise affecting the system;
* Separation of processes from one another (so that one process/user cannot tamper with the internal data and code of another process);
* [[Reference monitor]] functionality, so that no access can bypass scrutiny by the operating system;
* Strong separation of administrator, operator, and user roles using the mandatory integrity policy;
* Residual information (i.e., object reuse) mechanisms to prevent data scavenging;
* Trusted, evaluated tools for configuring the system, managing security-critical data, and repairing file systems;
* Self-testing of security mechanisms, on demand;
* Exclusion of higher layer network services from the TSF, so that the TSF is not susceptible to the publicly known vulnerabilities in those services.

STOP comes in only a single package, so that there is no confusion about whether a particular package has all security features present. Mandatory policies cannot be disabled. Policy configuration does not require a potentially complicated process of defining large sets of domains and data types (and the attendant access rules).

To maintain the trustworthiness of the system, the XTS-400 must be installed, [[booting|booted]], and configured by trusted personnel. The site must also provide [[physical security|physical protection]] of the hardware components. The system, and software upgrades, are shipped from BAE Systems in a secure fashion.

For customers who want them, XTS-400 supports a [[Mission Support Cryptographic Unit]] (MSCU) and [[Fortezza]] cards. The MSCU performs [[Type 1 product|''type 1'' cryptography]] and has been separately scrutinized by the [[United States]] [[National Security Agency]].

==Hardware==
The CC evaluation forces particular [[computer hardware|hardware]] to be used in the XTS-400. Though this places restrictions on the hardware configurations that can be used, several configurations are possible. The XTS-400 uses only standard PC, [[commercial off-the-shelf]] (COTS) components, except for an optional [[Mission Support Cryptographic Unit]] (MSCU).

The hardware is based on an Intel [[Xeon]] ([[Pentium 4|P4]]) [[central processing unit]] (CPU) at up to 2.8&nbsp;GHz speeds, supporting up to 2 GB of main memory.

A [[Peripheral Component Interconnect]] (PCI) bus is used for add-in cards such as [[Gigabit Ethernet]]. Up to 16 simultaneous [[Ethernet]] connections can be made, all of which can be configured at different mandatory security and integrity levels.

A [[SCSI]] subsystem is used to allow a number of high-performance peripherals to be attached. One SCSI peripheral is a [[PC Card]] reader that can support [[Fortezza]]. Multiple [[SCSI host adapter]]s can be included.

==History==
The XTS-400 has been preceded by several evaluated ancestors, all developed by the same group: Secure Communications Processor (SCOMP), XTS-200, and XTS-300. All of the predecessor products were evaluated under [[Trusted Computer System Evaluation Criteria]] (TCSEC) (a.k.a. [[Rainbow Series|Orange Book]]) standards. SCOMP completed evaluation in 1984 at the highest functional and assurance level then in place: A1. Since then the product has evolved from proprietary hardware and interfaces to commodity hardware and Linux interfaces.

The XTS-200 was designed as a general-purpose operating system supporting a [[Unix-like]] application and user environment. XTS-200 completed evaluation in 1992 at the B3 level.

The XTS-300 transitioned from proprietary, mini-computer hardware to COTS, Intel x86 hardware. XTS-300 completed evaluation in 1994 at the B3 level. XTS-300 also went through several ratings maintenance cycles (a.k.a. RAMP), very similar to an ''assurance continuity'' cycle under CC, ultimately ending up with version 5.2.E being evaluated in 2000.

Development of the XTS-400 began in June 2000. The main customer-visible change was specific conformance to the [[Linux]] [[Application programming interface|API]]. Though the security features of the XTS system put some restrictions on the API and require additional, proprietary interfaces, conformance is close enough that most applications will run on the XTS without recompilation. Some security features were added or improved as compared to earlier versions of the system and performance was also improved.

As of July 2006, enhancements continue to be made to the XTS line of products.

On September 5, 2006, the [[United States Patent and Trademark Office|United States Patent Offices]] granted BAE Systems Information Technology, LLC. United States Patent # 7,103,914 "Trusted computer system".

==Architecture==
STOP is a [[monolithic kernel]] operating system (as is Linux). Though it provides a Linux-compatible API, STOP is not derived from [[Unix]] or any [[Unix-like]] system. STOP is highly layered, highly modularized, and relatively compact and simple. These characteristics have historically facilitated high-assurance evaluations.

STOP is layered into four ''rings'' and each ring is further subdivided into layers. The innermost ring has hardware privilege and applications, including privileged commands, run in the outermost. The inner three rings constitute the ''[[kernel (operating system)|kernel]]''. Software in an outer ring is prevented from tampering with software in an inner ring. The kernel is part of every process's [[address space]] and is needed by both normal and privileged processes.

A ''[[security kernel]]'' occupies the innermost and most privileged ring and enforces all mandatory policies. It provides a virtual process environment, which isolates one process from another. It performs all low-level scheduling, [[memory management]], and interrupt handling. The security kernel also provides [[Input/output|I/O]] services and an [[Inter-process communication|IPC]] message mechanism. The security kernel's data is global to the system.

Trusted system services (TSS) software executes in ring 1. TSS implements file systems, implements [[Internet protocol suite|TCP/IP]], and enforces the [[discretionary access control]] policy on file system objects. TSS's data is local to the process within which it is executing.

Operating system services (OSS) executes in ring 2. OSS provides Linux-like API to applications as well as providing additional proprietary interfaces for using the security features of the system. OSS implements signals, process groups, and some memory devices. OSS's data is local to the process within which it is executing.

Software is considered trusted if it performs functions upon which the system depends to enforce the [[security policy]] (e.g., the establishment of user authorization). This determination is based on integrity level and privileges. Untrusted software runs at integrity level 3, with all integrity categories, or lower. Some processes require privileges to perform their functions—for example the Secure Server needs to access the User Access Authentication database, kept at ''system high'', while establishing a session for a user at a lower sensitivity level.

==Potential weaknesses==
The XTS-400 can provide a high level of security in many application environments, but trade-offs are made to attain it. Potential weaknesses for some customers may include:
* Lower performance due to more rigid internal layering and modularity and to additional security checks;
* Fewer application-level features available out-of-the-box;
* Some source level changes may be necessary to get complicated applications to run;
* The trusted user interface does not utilize a GUI and has limited command line features;
* Limited hardware choices;
* Not suited for embedded or real-time environments.

==References==
((reflist))

==External links==
* ((Official website|www.baesystems.com/enhancedarticle/BAES_161128/stop-os%E2%84%A2)), BAE
* [http://www.niap-ccevs.org/cc-scheme/st/vid10293 XTS-400 EAL5+ validated product page]
* [http://www.niap-ccevs.org/CCEVS_Products/archived_pcl.cfm XTS-400 EAL5+ archived validated product page]
* [http://www.niap-ccevs.org/CCEVS_Products/archived_pcl.cfm XTS-400 EAL4+ archived validated product page]
* [https://archive.today/20121214115407/http://patft.uspto.gov/netacgi/nph-Parser?TERM1=7103914&u=/netahtml/srchnum.htm&Sect1=PTO1&Sect2=HITOFF&p=1&r=0&l=50&f=S&d=PALL United States Patent 7,103,914: Trusted computer system]
* [http://www.nsa.gov/research/_files/selinux/papers/inevitability.pdf Paper on the need for secure operating systems and mandatory security]
* [https://web.archive.org/web/20061207005649/http://cisr.nps.navy.mil/projects/mysea.html Monterey Security Architecture (MYSEA)], a [[Naval Postgraduate School]] project which utilized the STOP OS
* [https://web.archive.org/web/20070221140614/http://www.sensornet.gov/net_ready_workshop/Boyd_Fletcher_CDCIE_XMPP_Overview_for_NetReadySensors_Conf.pdf XMPP & Cross Domain Collaborative Information Environment (CDCIE) Overview], multinational information sharing in both single and cross domain environments (utilizes STOP OS)

((BAE Systems))

((DEFAULTSORT:Xts-400))
[[Category:BAE Systems]]
[[Category:Operating system security]]
[[Category:Computer security procedures]]
[[Category:Evaluation of computers]]

Pages transcluded onto the current version of this page (help):

XTS-400 (edit)
Template:Ambox (view source) (template editor protected)
Template:BAE Systems (edit)
Template:Cite web (view source) (protected)
Template:DMCA (view source) (template editor protected)
Template:Dated maintenance category (view source) (template editor protected)
Template:Dated maintenance category (articles) (view source) (template editor protected)
Template:FULLROOTPAGENAME (view source) (template editor protected)
Template:Find sources mainspace (view source) (template editor protected)
Template:Hlist/styles.css (view source) (protected)
Template:Icon (view source) (template editor protected)
Template:Infobox (view source) (template editor protected)
Template:Infobox OS (view source) (semi-protected)
Template:Main other (view source) (protected)
Template:More citations needed (view source) (template editor protected)
Template:Navbox (view source) (template editor protected)
Template:Ns has subpages (view source) (protected)
Template:Official website (view source) (template editor protected)
Template:Pagetype (view source) (protected)
Template:Reflist (view source) (protected)
Template:Reflist/styles.css (view source) (protected)
Template:SDcat (view source) (protected)
Template:Short description (view source) (protected)
Template:Short description/lowercasecheck (view source) (protected)
Template:Template other (view source) (protected)
Template:Use dmy dates (view source) (template editor protected)
Module:Arguments (view source) (protected)
Module:Category handler (view source) (protected)
Module:Category handler/blacklist (view source) (protected)
Module:Category handler/config (view source) (protected)
Module:Category handler/data (view source) (protected)
Module:Category handler/shared (view source) (protected)
Module:Check for unknown parameters (view source) (protected)
Module:Citation/CS1 (view source) (protected)
Module:Citation/CS1/COinS (view source) (protected)
Module:Citation/CS1/Configuration (view source) (protected)
Module:Citation/CS1/Date validation (view source) (protected)
Module:Citation/CS1/Identifiers (view source) (protected)
Module:Citation/CS1/Utilities (view source) (protected)
Module:Citation/CS1/Whitelist (view source) (protected)
Module:Citation/CS1/styles.css (view source) (protected)
Module:Disambiguation/templates (view source) (protected)
Module:Find sources (view source) (template editor protected)
Module:Find sources/config (view source) (template editor protected)
Module:Find sources/links (view source) (template editor protected)
Module:Find sources/templates/Find sources mainspace (view source) (template editor protected)
Module:Icon (view source) (template editor protected)
Module:Icon/data (view source) (template editor protected)
Module:Infobox (view source) (template editor protected)
Module:Infobox/styles.css (view source) (template editor protected)
Module:InfoboxImage (view source) (template editor protected)
Module:Message box (view source) (protected)
Module:Message box/ambox.css (view source) (protected)
Module:Message box/configuration (view source) (protected)
Module:Namespace detect/config (view source) (protected)
Module:Namespace detect/data (view source) (protected)
Module:Navbar (view source) (protected)
Module:Navbar/configuration (view source) (protected)
Module:Navbar/styles.css (view source) (protected)
Module:Navbox (view source) (template editor protected)
Module:Navbox/configuration (view source) (template editor protected)
Module:Navbox/styles.css (view source) (template editor protected)
Module:Ns has subpages (view source) (protected)
Module:Official website (view source) (template editor protected)
Module:Pagetype (view source) (protected)
Module:Pagetype/config (view source) (protected)
Module:Pagetype/disambiguation (view source) (protected)
Module:Pagetype/setindex (view source) (protected)
Module:Pagetype/softredirect (view source) (protected)
Module:SDcat (view source) (protected)
Module:String (view source) (protected)
Module:URL (view source) (template editor protected)
Module:Unsubst (view source) (protected)
Module:Wikitext Parsing (view source) (protected)
Module:Yesno (view source) (protected)

Return to XTS-400.

Retrieved from "https://en.wikipedia.org/wiki/XTS-400"