Trusted operating system with emulation and process isolation

• US 7,549,165 B2
• Filed: 07/17/2006
• Issued: 06/16/2009
• Est. Priority Date: 06/17/2002
• Status: Expired due to Term

• Current Assignee: BAE Systems Information and Electronic Systems Integration Incorporated (BAE Systems Plc)
• Original Assignee: BAE Systems Information Technology Incorporated (BAE Systems Plc)
• Inventors: Wherley, Robert D., Focke, Michael W., Knoke, James E., Ata, John G., Engen, Dwight B., Barbieri, Paul A.
• Primary Examiner(s): Lipman; Jacob
• Application Number:
  US11/487,404
• Publication Number:
  US 20070130458A1
• Time in Patent Office: 1,065 Days
• Field of Search: 726/22, 713/166, 703/21, 703/22
• US Class Current: 726/22
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 9/45537 Provision of facilities of other operating environments, e.g. WINE I/O emulation G06F13/105

Abstract

A trusted computer system that offers Linux® compatibility and supports contemporary hardware speeds. It is designed to require no porting of common applications which run on Linux, to be easy to develop for, and to allow the use of a wide variety of modern development tools. The system is further designed to meet or exceed the Common Criteria EAL-5 or higher rating through incorporation of required security features, as well as a very high level of assurance for handling data at a wide range of sensitivity (e.g., classification) levels in a wide range of operational environments. This is achieved through the implementation of a well-layered operating system which has been designed from the ground up to enforce security, but which also supports Linux operating system functions and methods.

Claims

1. Computer program product stored on tangible computer readable media, the computer program product comprising:

a trusted operating system executable by a processor on a computing system, the trusted operating system emulating another operating system by allowing an application program written for the other operating system to execute on the trusted operating system without requiring changes to the application program, the trusted operating system further comprising code for enforcing a set of security rules designed to protect a first process from unauthorized access by a second process, the second process having a security level different than that of the first process.

2. The computer program product of claim 1, the trusted operating system further comprising:

a security kernel layer;

an operating system services layer;

an application domain, the application domain limiting applications running within the applications domain to interfacing with only the operating system services layer, the applications within the application domain prevented from directly calling functions provided by the trusted system services or kernel layer; and

,

a trusted system services layer.

3. The computer program product of claim 1, the trusted operating system further comprising a trusted operating system services layer, the other operating system emulated within the trusted operating system services layer.

4. The computer program product of claim 3, the operating system services layer further comprising at least one API to manage and use trusted aspects of the trusted system services layer.

5. The computer program product of claim 4, the operating system services layer translating API calls into trusted operating system primitives provided by the security kernel and trusted system services layers.

6. The computer program product of claim 1, further comprising a reference monitor.

7. The computer program product of claim 1, user login failures being monitored to detect the accumulation of events that indicate an imminent security policy violation.

8. The computer program product of claim 1, the operating system utilizing multi-domain process isolation capabilities in hardware on which the operating system is running to ensure process isolation.

9. The computer program product of claim 8, the hardware multi-domain process isolation capability restricting access to segments, pages, and instructions.

10. The computer program product of claim 9, the hardware multi-domain process isolation capability further providing multiple checks for protections violations within memory references.

11. The computer program product of claim 1, the operating system further comprising an application domain, in which trusted and untrusted applications can be executed.

12. The computer program product of claim 11, the application domain allowing at least one integrated development environment to be run.

13. The computer program product of claim 1, the operating system comprising a security kernel layer, the security kernel enforcing a set of security rules, the security rules comprising:

mandatory security;

mandatory integrity; and

,

subtype control.

14. The computer program product of claim 13, the security kernel separating users and data by enforcing mandatory security and mandatory integrity access controls.

15. The computer program product of claim 14, the security kernel further separating users and data by enforcing discretionary access controls.

16. The computer program product of claim 15, the security kernel separating administrator and operator roles using an integrity policy.

17. The computer program product of claim 15, further comprising at least one audit log, the audit log recording user and administrator actions.

18. The computer program product of claim 17, the at least one audit log being protected from modification by an unauthorized user or process.

19. The computer program product of claim 13, the security kernel layer allowing users with different clearances to simultaneously store and process information that exists at different classification levels.

20. The computer program product of claim 19, the security kernel layer allowing the user to process data only when that data is at the user'"'"'s integrity level or a higher integrity level.

21. The computer program product of claim 13, wherein the security kernel layer enforces process isolation to keep untrusted software from accessing working data associated with trusted software processes.

22. Computer program product stored on tangib1e computer readable media, the computer program product comprising a trusted operating system executable by a processor on a computing system, the trusted operating system, comprising:

an application domain, the application domain permitting trusted and untrusted applications to be executed therein;

an operating system services layer, the operating system services layer emulating at least one other operating system by allowing an application program written for the other operating system to execute on the trusted operating system without requiring changes to the application program; and

,

a security kernel, the security kernel protecting a first process from unauthorized access by a second process, the second process having a security level different than that of the first process.

23. The computer program product of claim 22, the security kernel enforcing system security policy and integrity rules.

24. The computer program product of claim 22, the security kernel providing basic operating system services, including facilitating user and administrator actions.