Simple assured bastion hosts

It is shown how compartmented mode workstation (CMW) technology can be used as the basis of simple assured firewalls, where the vast majority of the evaluation effort required is reused from the evaluation of the CMW. The generic bastion host architecture described provides ITSEC E3 assurance that the unevaluated proxies cannot be bypassed. Assurance that the inappropriate export of information is prevented, can be gained by extending a trusted path export sanction from the user's desktop to an evaluated release checker in the firewall.