APPARATUS FOR CONFIGURING OPERATING SYSTEM AND METHOD THEREFOR

• US 20150026447A1
• Filed: 07/18/2014
• Published: 01/22/2015
• Est. Priority Date: 07/18/2013
• Status: Active Grant

• Current Assignee: Postech Academy-Industry Foundation
• Original Assignee: Postech Academy-Industry Foundation
• Inventors: Park, Chan Ik, Park, Se Jin
• Granted Patent: US 9,684,525 B2
• Time in Patent Office: Days
• US Class Current: 713/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]

Abstract

Disclosed are an apparatus and a method for configuring an operating system. An apparatus for configuring an operating system may comprise a system resource management part managing system resources by assigning control permission for system resources which interwork with the operating system to a first domain of the operating system; and a system operation part executing an application program in a second domain of the operating system which is independent from the first domain by utilizing the system resources managed by the system resource management part. Therefore, performance of the operating system may be enhanced at the same time of supporting high security of the operating system so that reliability of the operating system can also be enhanced.

Claims

1. An apparatus for configuring an operating system, the apparatus comprising:

a system resource management part, in a first domain of the operating system, managing system resources by assigning control permissions for the system resources interworking with the operating system; and

a system operation part, in a second domain of the operating system which is independent from the first domain, executing an application program by utilizing the system resources managed by the system resource management part.

2. The apparatus of claim 1, wherein the first domain and the second domain are implemented respectively in separate domains of a monolithic kernel, and perform independent functions.

3. The apparatus of claim 1, wherein the system resource management part includes a resource allocation module allocating a system resource required for the application program, and generating identification information of the application program and information on the system resource allocated to the application program.

4. The apparatus of claim 3, wherein the system resource management part includes an access control information database receiving the identification information of the application program and the information on the system resource, generating access control information by mapping the information on the system resource to the identification information of the application program, and storing the generated access control information.

5. The apparatus of claim 4, wherein the system resource management part includes a resource release module deleting the information on the system resource corresponding to the identification information of the application program in the access control information database based on the access control information stored in the access control information database in response to a request of the application program to release the system resource.

6. The apparatus of claim 4, wherein the system resource management part includes a resource access module controlling access on the system resource by checking whether the information on the system resource corresponding the identification information of the application program exist or not in the access control information database based on the access control information stored in the access control information database in response to a request of the application program to access the system resource.

7. The apparatus of claim 1, wherein the system resource management part performs a scheduling function for determining an order of processes constituting the application program.

8. The apparatus of claim 1, wherein the system operation part executes the application program by using an access address of the system resource generated by virtualizing the system resource on which access of the application program is permitted.

9. The apparatus of claim 1, wherein the system resource includes at least one of an input/output device, a storage device, and a computation device which are used for executing the application program.

10. A method for configuring an operating system, the method comprising:

managing system resources by assigning control permission for the system resources interworking with the operating system in a first domain of the operating system; and

executing an application program by utilizing the system resources in a second domain which is independent from the first domain.

11. The method of claim 10, wherein the managing system resources and the executing an application program are performed respectively in the first domain and the second domain of a monolithic kernel.

12. The method of claim 10, wherein, in the managing system resource, the system resource required for the application program is allocated, and access control information generated by mapping information on the system resource allocated to the application program to the application program are stored.

13. The method of claim 12, wherein, in the managing system resources, whether access of the application program on the system resource on which access of the application is requested is permitted or not is determined based on the stored access control information in response to a request of the application program to access the system resource.

14. The method of claim 12, wherein, in the managing system resources, the information on the system resource corresponding to the identification information of the application program is deleted based on the stored access control information in response to a request of the application program to release the system resource.

15. The method of claim 10, wherein, in the managing system resources, a scheduling function for determining an order of processes constituting the application program is performed.

16. The method of claim 10, wherein, in the executing an application program, the application program is executed by using an access address of the system resource generated by virtualizing the system resource on which access of the application program is permitted.