The problem of maintaining information privacy in a multi-user, remote-access system is quite complex. Hopefully, without going into detail, some idea can be given of the mechanisms that have been used in the Multics operating system at MIT.
The heart and soul of any on-line system is the file subsystem, which is charged with the maintenance of all on-line data bases and with their safekeeping from accidental or malicious damage. The salient features of the Multics file system* are: (1) all references to data are by symbolic name and never by physical address; (2) associated with each file or substructure within the system is an access-control list that defines each authorized user and how he may gain access to the substructure or file. (User class identifiers may be employed as well as individual user names.) Because this file-system mechanism also safeguards much of the operating system itself, substructures of directories and files are used to store the system and the state of individual user programs during execution. There is no other special "swapping" on-line file structure.
In order to make the file system effective, each user must carry an identification. This identification is made when he logs into the system, and is held as part of the user data base during the logged time period. Determining that a user is who he says. is accomplished by means of a log-in routine which may include passwords, special log-in algorithms, etc.
Even with the protection supplied by the file system, a central portion of the supervisor must be protected against accidental or overt tampering. A combination of hardware and software means to prevent gaining an unusual privilege is employed. In part, these safeguards include hardware locks that prevent execution, reading, or modification of certain key portions of the supervisor except when responding to a generated interrupt. (Locks that are more complex than can be explained in this short account are also employed.) Two basic principles are applied within this part of the supervisor:
It is also possible to include the ability to determine whether a user has violated the system, and if he has, to observe his malpractice by means of a special high-privilege system function. The latter mechanism includes an additional set of safeguards that provide an audit trail indicating the observer, who was observed, and the date of observation. This auditing information is recorded in such a way as to make it extremely difficult for one or two individuals to destroy it without being observed.
The maintenance of privacy and informational integrity within systems that are still not fully comprehended is a large and intricate problem. The present discussion suggests only some key considerations.
1967 Spring Joint Computer Conference