Implementing commercial data integrity with secure capabilities

The author examines the model of D.D. Clark and D.R. Wilson (1987) for commercial data integrity and proposes an implementation based on his own secure capability architecture. He shows how secure capabilities and protected subsystems are ideal for implementing commercial data integrity, but also indicates areas where the Clark-Wilson model may have difficulties in actual use. The level of formal verification required appears higher than would be feasible for most commercial systems and the user interface for specifying separation of duties appears extremely complex.<
>