A kernel and task isolation method, wherein the method is applied to a computer system (100; 200; 800), an operating system OS and an application run on the computer system (100; 200; 800), a kernel (81; 121) runs on the OS, the application comprises one or more tasks, a trusted base further runs on the OS, and the method comprises: searching (S131, S201), by the kernel (81; 121), a task preparation queue for a first task; searching (S132, S203)), by the trusted base, a memory for first memory switching configuration information of the first task, and configuring a memory protection apparatus based on the first memory switching configuration information, wherein the memory protection apparatus is a hardware component configured to protect a memory of the computer system (100; 200; 800); and the first memory switching configuration information comprises memory address information of the kernel (81; 121) and memory operation permission of the kernel (81; 121), and memory address information of the first task and memory operation permission of the first task, operation permission of the first task for a memory of the kernel (81; 121) is no permission after the configuration, and operation permission of the kernel (81; 121) for a memory of the first task is readable after the configuration; and calling (S133, S206), by the kernel (81; 121), the first task; and characterized in that before the calling (S133, S206), by the kernel (81; 121), the first task, the method further comprises: determining, by the trusted base, whether first memory switching configuration information stored in a register is the same as the first memory switching configuration information stored in the memory; if the first memory switching configuration information stored in the register is the same as the first memory switching configuration information stored in the memory, determining that the first memory switching configuration information is valid; and when the first memory switching configuration information is valid, calling, by the kernel (81; 121), the first task. searching (S131, S201), by the kernel (81; 121), a task preparation queue for a first task; searching (S132, S203)), by the trusted base, a memory for first memory switching configuration information of the first task, and configuring a memory protection apparatus based on the first memory switching configuration information, wherein the memory protection apparatus is a hardware component configured to protect a memory of the computer system (100; 200; 800); and the first memory switching configuration information comprises memory address information of the kernel (81; 121) and memory operation permission of the kernel (81; 121), and memory address information of the first task and memory operation permission of the first task, operation permission of the first task for a memory of the kernel (81; 121) is no permission after the configuration, and operation permission of the kernel (81; 121) for a memory of the first task is readable after the configuration; and calling (S133, S206), by the kernel (81; 121), the first task; and characterized in that before the calling (S133, S206), by the kernel (81; 121), the first task, the method further comprises: determining, by the trusted base, whether first memory switching configuration information stored in a register is the same as the first memory switching configuration information stored in the memory; if the first memory switching configuration information stored in the register is the same as the first memory switching configuration information stored in the memory, determining that the first memory switching configuration information is valid; and when the first memory switching configuration information is valid, calling, by the kernel (81; 121), the first task. determining, by the trusted base, whether first memory switching configuration information stored in a register is the same as the first memory switching configuration information stored in the memory; if the first memory switching configuration information stored in the register is the same as the first memory switching configuration information stored in the memory, determining that the first memory switching configuration information is valid; and when the first memory switching configuration information is valid, calling, by the kernel (81; 121), the first task.