一个分层隔离的操作系统内核

传统单块结构操作系统的所有内核代码在一个公共的、共享的地址空间运行,因此内核中任何一个漏洞或在内核中加载任何不可靠模块都会威胁到整个系统的安全。研究并实现了一个分层隔离的操作系统安全内核,将内核特权分割隔离,阻止内核安全漏洞的扩散,防止恶意内核模块代码对内核代码数据的随意篡改。原型操作系统完全自主开发,支持i386体系结构。

Layered and separated operating system kernel

In traditional monolithic kernel operating systems, all kernel codes run within a common and shared address space, and any vulnerabilities in kernel or any untrusted modules loaded in kernel would compromise the whole system security. The development of a layered and separated secure kernel was described in this paper. Since the powers of kernel are partitioned, the vulnerabilities of kernel are confined, and arbitrarily tampering of kernel by malice codes was prevented. The prototype system is entirely developed from beginning for the i386 architecture.