Saltzer–Schroeder Saltzer–Schroeder is a set of design principles for secure computer system architecture articulated by Jerome H. Saltzer and Michael D. Schroeder. First presented in 1975, these principles have informed design practices across Massachusetts Institute of Technology, Bell Laboratories, Stanford University, Carnegie Mellon University, and industry efforts at IBM, Digital Equipment Corporation, and Intel. The principles remain cited in discussions at forums such as the Internet Engineering Task Force, ACM SIGCOMM, IEEE Symposium on Security and Privacy, and standards work by NIST.
The formulation arose during intensive research into protection mechanisms at institutions including MIT's Project MAC, Bell Labs' work on UNIX, and collaborations with researchers affiliated with Harvard University and Princeton University. Jerome H. Saltzer, with appointments tied to MIT, and Michael D. Schroeder, later connected to Carnegie Mellon University and Xerox PARC, synthesized findings from projects like the Multics operating system, the CTSS experiments at MIT, and early ARPANET security debates. Influences trace through conferences such as AFIPS symposiums and publications in journals associated with ACM and IEEE.
The canonical principles include concepts frequently taught alongside material from Donald Knuth and Edsger W. Dijkstra and invoked in texts by Andrew S. Tanenbaum and Ross Anderson. Key principles are: - Economy of mechanism: advocated by practitioners linked to DEC and discussed at USENIX conferences. - Fail-safe defaults: debated in contexts involving RAND Corporation analyses and John von Neumann-inspired reliability studies. - Complete mediation: cited in security models influenced by work at SRI International and Honeywell. - Open design: contrasted with practices at NSA and referenced in policy debates involving Electronic Frontier Foundation. - Separation of privilege: paralleled in access-control research at Carnegie Mellon University's SEI and formal models like Bell–LaPadula. - Least privilege: linked historically to administrative models in MITRE reports and consulting by Booz Allen Hamilton. - Least common mechanism: related to design in distributed systems from Sun Microsystems and DEC. - Psychological acceptability: considered in human factors work at Stanford University and University of California, Berkeley's CS Division.
Saltzer and Schroeder's guidance influenced designs at MITRE Corporation and adoption in operating systems such as Multics, BSD, and various UNIX derivatives developed at Bell Labs and UC Berkeley. Standards bodies like ISO and IEEE referenced similar notions when shaping protocols in TCP/IP stacks championed by Vint Cerf and Bob Kahn. The principles informed threat modeling practices used by teams at Microsoft, Apple Inc., and Google and underpinned certification efforts like Common Criteria and government procurement standards from NIST and FIPS publications.
Concrete implementations appear in access-control mechanisms in systems such as Multics and role-based controls later formalized at Carnegie Mellon University. Network protocol defenses applying least privilege and complete mediation were adopted in implementations by Cisco Systems and in projects shepherded through IETF working groups like IPsec and TLS. Open-source projects at Free Software Foundation and distributions rooted in Debian and Red Hat communities showcased economy of mechanism in minimal-kernel designs influenced by advocates such as Linus Torvalds. Hardware-enforced isolation in processors from Intel and ARM Holdings echoes separation of privilege debates from Xerox PARC research.
Scholars at Oxford University and Cambridge University have critiqued the principles for lacking prescriptive metrics, paralleling debates in works by Bruce Schneier and Ross Anderson. Industry commentators from Gartner and Forrester Research note scalability and practical trade-offs in large deployments at organizations like Amazon and Facebook. Some security engineers at Google and Microsoft Research argue that evolving threat landscapes, including supply-chain attacks studied by Kaspersky Lab and Mandiant, require complementary approaches such as formal verification from Z3 and model checking techniques developed at NASA and Bell Labs.
The Saltzer–Schroeder corpus continues to be cited in curricula at MIT, Stanford University School of Engineering, and Carnegie Mellon University's CyLab and influencing guidance from NIST and the IETF. Elements appear in modern standards like RFC series, ISO/IEC frameworks, and certification programs at Common Criteria evaluation facilities. The principles inform contemporary initiatives at Cloudflare, Amazon Web Services, and in open-source governance adopted by Linux Foundation projects, ensuring continued relevance in protocol design discussions at venues such as Black Hat and DEF CON.
Category:Computer security