600.436 High-Assurance
Systems
Fall 01/System Security Realization
51
All Relevant Security Functionality
¨Between TSS and FSP
–Only TOE security functions: assurance measures not
required
¨Between LLD and Implementation
–For subset implementation of TSF,
required refinements limited to security functionality in the subset
¨For all other cases, all parts of
more abstract TSF representation must be refined into less abstract TSF
representation