This paper presents our work concerning flexibility and protection in operating system kernels . In most existing operating systems, security is enforced at the price of flexibility by imposing protection models on the system programmer when building his system. We prove that flexibility can be preserved by separating the management of the protection policy from the tools used to enforce it. We present the secure software framework we have implemented in the THINK architecture to manage protection policies and guarantee they are carried out as specified . We then detail the elementary protection tools provided to the programmer so he can protect his system against unauthorized accesses and denial of service attacks . These tools are implemented in a policy-neutral way so as to guarantee their flexibility. Finally we validate our results by evaluating the flexibility of the protection provided on selected examples of dynamic modification of the protection policy. Flexibility and security are often seen as two conflicting goals in traditional operating systems . Securing a system often results in imposing constraints on the system architecture and on the services provided. On the other hand, improving the flexibility of the system is generally seen as introducing vulnerabilities . For example, recent Linux kernels supports the use of modules, that is system services which can be loaded and unloaded at will in the kernel. This permits the system administrator to add functionnalities to the kernel without having to recompile it, thus enhancing flexibility. However, a malicious user might trick the system administrator into loading a harmful module in the kernel to gain extra privileges for example . On the other hand, forbidding the use of modules strengthens the security of the system but reduces its flexibility since the system administrator is forced to recompile it each time he wants to add a service. We believe that it is possible to guarantee both flexibility and security in an operating system . Our work focuses especially on protection as defined in [5] , that is access control and protection against denial of service attacks . We prove in this paper that flexibility can be preserved in a secure system by separating the management of the protection policy from the tools used to enforce it. The protection policy is the set of rules specifying the access rights of principals and the management of ressources in the system . We thus propose a secure software framework that regulates the interactions between the components in the system and includes the security manager, a component dedicated to the management of policies . Coupled with a set of policy-neutral protection tools, we guarantee that protection policies can be changed dynamically to suit the needs of the system administrator, without needing to recompile or reboot the system, thus preserving its flexibility. Our work is validated using THINK, a flexible system architecture which permits the programmer to build customized operating systems .
THINK REF is a kernel-based framework that is designed to protect flexible operating system architectures.
Protection in flexible operating system architectures
OPSR
Computer Science