1

1. IBM Virtual Machine Facility/370 : Control Program (CP) Logic, IBM Publication SY20-0880. May be obtained from IBM Corporation, Data Processing Division, 1133 Westchester Avenue, White Plains, New York, 10604.

2

2. IBM System/370 Principles of Operation, IBM Publication GA 22-7000. May be obtained from IBM Corporation, Data Processing Division, 1133 Westchester Avenue, White Plains, New York, 10604.

3

3. Attanasio, C. R., Markstein, P. W., Phillips, R. J., "Penetrating an Operating System: A Study of VM/370 Integrity," IBM Systems Journal, Volume 15, November 1, 1976, pp. 102-116.

4

4. Donovan, J. J., Madnick, S. E., "Hierarchical Approach to Computer System Integrity," IBM Svstems Journal, Volume 14, Number 2, 1975, pp. 188-202.

5

5. Weissman, Clark, "Secure Computer Operations with Virtual Partitioning, " AFIPS Conference Proceedings, Volume 44, National Computer Conference, 1975, pp. 929-934.

6

6. Belady, L. A., Weissman, C., "Experiments with Secure Resource Sharing for Virtual Machines," SDC SP-3769, May 1974. Also published in Proceedings on Protection in Operating Systems, Institute de Recherche d' Informatique et d'Automatique (IRIA), Colloques Internationaux, Rocquencourt, France, August 1974.

7

B. D. Gold , R. R. Linde , M. Schaefer , J. F. Scheid, VM/370 security retrofit program, Proceedings of the 1977 annual conference, p.411-418, January 1977  [doi>10.1145/800179.1124634]

8

Butler W. Lampson, A note on the confinement problem, Communications of the ACM, v.16 n.10, p.613-615, Oct. 1973  [doi>10.1145/362375.362389]

9

9. Linde, R. R., "Operating System Penetration," AFIPS Conference Proceedings, Volume 44, National Computer Conference, 1975, pp. 361-368.

10

10. Lampson, B. W., "Dynamic Protection Structures," AFIPS Conference Proceedings, Volume 35, 1969 FJCC, pp. 27-38.

11

Dorothy E. Denning, A lattice model of secure information flow, Communications of the ACM, v.19 n.5, p.236-243, May 1976  [doi>10.1145/360051.360056]

12

12. Denning, D., Denning, P. and Graham, G. S., "Selectively Confined Subsystems" Proceedings International Workshop on Protection in Operating Systems, IRIA, Colloques Internationaux, Rocquencourt, France, August, 1974, pp. 55-61.

13

13. Anderson, J. P., "Computer Security Technology Planning Study," ESD-TR-73-51, Volume I, October 1972.

14

14. Schiller, W. L., "The Design and Specification of a Security Kernel for the PDP-11/45," MITRE Technical Report, MITR-2934, March 1975.

15

15. Bell, E. D., LaPadula, L. D., "Secure Computer Systems : Mathematical Foundations," MITRE Technical Report Number 2547, 1 March 1973.

Richard A. Kemmerer, Shared resource matrix methodology: an approach to identifying storage and timing channels, ACM Transactions on Computer Systems (TOCS), v.1 n.3, p.256-277, August 1983

Jonathan M. Silverman, Reflections on the verification of the security of an operating system kernel, ACM SIGOPS Operating Systems Review, v.17 n.5, p.143-154, October 1983

Keith Loepere, Resolving covert channels within a B2 class secure system, ACM SIGOPS Operating Systems Review, v.19 n.3, p.9-28, July 1985

Tal Garfinkel , Ben Pfaff , Jim Chow , Mendel Rosenblum , Dan Boneh, Terra: a virtual machine-based platform for trusted computing, Proceedings of the nineteenth ACM symposium on Operating systems principles, October 19-22, 2003, Bolton Landing, NY, USA

Cleopas O. Angaye , Steven C. Hansen, Inferential security in individual computing environments, ACM SIGICE Bulletin, v.20 n.1, p.27-32, July 1994

Chii-Ren Tsai , Virgil D. Gligor , C. S. Shandersekaran, On the Identification of Covert Storage Channels in Secure Systems, IEEE Transactions on Software Engineering, v.16 n.6, p.569-580, June 1990

Paul A. Karger , Mary Ellen Zurko , Douglas W. Bonin , Andrew H. Mason , Clifford E. Kahn, A Retrospective on the VAX VMM Security Kernel, IEEE Transactions on Software Engineering, v.17 n.11, p.1147-1165, November 1991

Sam Weber , Paul A. Karger , Amit Paradkar, A software flaw taxonomy: aiming tools at security, ACM SIGSOFT Software Engineering Notes, v.30 n.4, July 2005

Richard A. Kemmerer , Phillip A. Porras, Covert Flow Trees: A Visual Approach to Analyzing Covert Storage Channels, IEEE Transactions on Software Engineering, v.17 n.11, p.1166-1185, November 1991

Bryan D. Payne , Reiner Sailer , Ramón Cáceres , Ron Perez , Wenke Lee, A layered approach to simplified access control in virtualized systems, ACM SIGOPS Operating Systems Review, v.41 n.4, July 2007

Alan B. Shaffer , Mikhail Auguston , Cynthia E. Irvine , Timothy E. Levin, A security domain model to assess software for exploitable covert channels, Proceedings of the third ACM SIGPLAN workshop on Programming languages and analysis for security, June 07-13, 2008, Tucson, AZ, USA

Charles R. Young, A security policy for a profile-oriented operating system, Proceedings of the May 4-7, 1981, national computer conference, May 04-07, 1981, Chicago, Illinois

Serdar Cabuk , Carla E. Brodley , Clay Shields, IP Covert Channel Detection, ACM Transactions on Information and System Security (TISSEC), v.12 n.4, p.1-29, April 2009

Marvin Schaefer: colleagues

Barry Gold: colleagues

Richard Linde: colleagues

John Scheid: colleagues