Which of the following rated systems of the Orange book has mandatory protection of the TCB?