一个新的安全内核模型研究  

Towards a Novel Model of Security Kernel

作　　者：孟江涛[1] 卢显良[1] 董贵山[1] 

机构地区：[1]电子科技大学计算机科学与工程学院,四川成都610054

出　　处：《小型微型计算机系统》2008年第6期1113-1116,共4页Journal of Chinese Computer Systems

基　　金：国家"八六三"项目宽带安全远程数据传输系统子课题(2003AA143010)资助

摘　　要：利用保护环和安全内核的功能,提出了一种新的增强操作系统安全性的模型.新模型中,虚拟机监控器中被用来保护运行时安全内核.虚拟机监控器运行在有最高特权级的保护环上,安全内核和用户进程分别运行在次高特权级和最低特权级的保护环上.当次高特权级的安全内核试图写某些关键的系统资源时,写操作必须经过运行于最高特权级的虚拟机监控器的验证和许可.结果,该模型能够阻止恶意代码修改并绕过运行时安全内核.With function of protection ring and security kernel,a novel model for enhancing security of operating system is proposed.In the model,a virtual machine monitor is used to protect the runtime security kernel.The virtual machine monitor runs in the most-privileged ring,security kernel and user process runs respectively in the much-privileged and least-privileged ring.When the much-privileged security kernel attempts to write some critical system resources, it is mandatory for the writing permission to be verified and approved by the virtual machine monitor.So,the model can prevent malicious code from modifying and then bypassing the runtime security kernel.

关 键 词：保护环 安全内核 虚拟机监控器 虚拟机 

分 类 号：TP316[自动化与计算机技术—计算机软件与理论]